Microsoft Defender for Cloud is a cloud-native security platform that protects Azure workloads from threats. To enable protection, you first enable Microsoft Defender for Cloud on your Azure subscription, which activates the security posture management capabilities. After enabling the core platform, you then enable individual workload protection plans such as Defender for Servers, Defender for Databases, and Defender for Storage. Each workload protection plan enables specific threat detection sensors and security alerts tailored to that workload type. The protection plans build on each other, so enabling the core Defender for Cloud is the first step before any workload-specific protection becomes active.
Microsoft Defender for Servers protects virtual machines by deploying the Log Analytics agent or the Azure Defender agent, which collects security events and sends them to Defender for Cloud for analysis. This plan detects threats like brute force attacks, malware, and suspicious process execution. You can configure the agent settings to control which events are collected and how often data is sent. The protection extends to both Windows and Linux VMs, and you can set up auto-provisioning so new VMs automatically receive the agent.
Microsoft Defender for Databases protects database services such as Azure SQL, SQL Server on VMs, and Azure Cosmos DB. This plan enables vulnerability assessment scans that identify weak configurations and missing patches, plus threat detection that spots unusual query patterns indicating attacks like SQL injection. You configure the sensitivity of threat detection alerts and can integrate with Azure Sentinel for advanced security operations. The protection works by analyzing audit logs and database activity in real time.
Microsoft Defender for Storage protects blob storage accounts, Azure Files, and Azure Data Lake Storage from threats like malware upload and data exfiltration. This plan scans uploaded files for malware using Microsoft Defender antivirus engines and generates alerts when suspicious activity occurs. You configure which storage accounts to protect and can enable or disable specific capabilities like malware scanning per account. The scanning happens when files are uploaded, and the service stores threat intelligence metadata without storing the actual file content.
Agentless scanning provides threat detection for VMs without installing any software on them, which is useful for large environments or when agent installation is not feasible. The scanner runs from within Azure and connects to VMs through their network interface to perform periodic scans. It detects vulnerabilities, misconfigurations, and indicators of compromise by reading disk images and memory dumps. Agentless scanning complements agent-based protection rather than replacing it, and you can run both approaches on the same VMs for layered defense. You configure scanning frequency and scope through Defender for Cloud settings, and results appear in the same vulnerability dashboard as agent-based findings.
Defender Vulnerability Management identifies security weaknesses in VMs and prioritizes them based on risk so teams can fix the most dangerous issues first. The service scans for missing OS patches, weak security settings, exposed credentials, and vulnerable applications. Results flow into Defender for Cloud's recommendations, where you can track remediation progress and assign tasks to team members. The vulnerability data integrates with Microsoft Defender for Endpoint to correlate findings with active threats on the same machines. You configure the scanning schedule and can exclude specific VMs from scanning when needed, such as development machines that do not require strict security controls.
Microsoft Defender for Cloud DevOps Security integrates with GitHub, Azure DevOps, and GitLab to protect code repositories and CI/CD pipelines. The integration scans code for secrets, vulnerabilities, and misconfigurations during development and flags issues before they reach production. You connect each platform by authorizing Defender for Cloud to access your repositories, which then enables security scans and pulls findings into the unified Defender for Cloud dashboard. Alerts from all connected DevOps platforms appear alongside Azure workload alerts, giving security teams a single view of risks across development and production environments. You configure which repositories to scan, what types of issues to detect, and how alerts are routed to your security operations workflows.
Are you a guardian of your domain? Lean how to leverage your aptitude in security to protect Microsoft Azure technologies, with a goal of earning the Microsoft Certified: Azure Security Engineer Associate certification!
Prepare and test your skills
Prepare and test your skills
Agent-based protection deploys the Log Analytics agent or Azure Defender agent on the VM to collect security events, while agentless scanning runs from within Azure and connects to VMs through their network interface to perform periodic scans without installing any software. Agentless scanning complements agent-based protection rather than replacing it, and you can run both approaches on the same VMs for layered defense.
You first enable Microsoft Defender for Cloud on your Azure subscription to activate security posture management capabilities, then enable individual workload protection plans such as Defender for Servers, Defender for Databases, and Defender for Storage. The protection plans build on each other, so enabling the core Defender for Cloud is the first step before any workload-specific protection becomes active.
Microsoft Defender for Storage protects blob storage accounts, Azure Files, and Azure Data Lake Storage from threats like malware upload and data exfiltration. It scans uploaded files for malware using Microsoft Defender antivirus engines and generates alerts when suspicious activity occurs, storing threat intelligence metadata without storing the actual file content.
StudyCerts
StudyCerts