Enable workload protection services in Microsoft Defender for Cloud

Provision and Manage Defender Agents and Plans for Workload Protection

Microsoft Defender for Cloud is a security management platform that protects Azure and hybrid resources. Enabling workload protection requires provisioning Defender agents and configuring Defender plans. The platform integrates several services that work together to collect data, detect threats, and enforce security policies across your environment.

Enable Defender Plans

Activating Defender plans is the first step toward comprehensive security. Each plan targets a specific resource type and monitors it for threats:

• Defender for Resource Manager monitors Azure resource management operations for unusual activities, such as suspicious role assignments or template deployments.
• Defender for Storage protects against threats specific to storage accounts, including malware uploads, data leakage, and unauthorized access patterns.
• Defender for App Service identifies attacks targeting applications running on Azure App Service, such as brute force attempts or injection attacks.
• Defender for Databases provides threat detection and response across Azure SQL, Azure Cosmos DB, and other database types, alerting on SQL injection or unusual access patterns.
• Defender for Key Vault monitors Key Vault accounts for potential exploits, such as unauthorized secret retrieval or unusual API calls.
• Defender for APIs enhances API security by providing visibility into critical business APIs, detecting misconfigurations and anomalous traffic.

These plans are independent of each other; you can enable them selectively based on which resources you need to protect. The plans share a common alert pipeline in Defender for Cloud, so all detected threats appear in a single dashboard.

Provisioning Agents

Provisioning the Log Analytics Agent and Azure Monitor Agent across Azure and hybrid environments is essential for consistent data collection and monitoring. Auto-provisioning simplifies this process: when enabled, Defender for Cloud automatically installs the agent on new virtual machines as they are created. The agent collects security-related logs and performance data, which flows to a Log Analytics workspace. From there, Defender for Cloud analyzes the data for threats and compliance issues. For hybrid environments, the same agents can be deployed to on-premises servers using Azure Arc, extending the security monitoring boundary beyond Azure.

Vulnerability Assessment

Implementing vulnerability assessments is another vital aspect of workload protection. Defender for Cloud integrates with vulnerability scanning solutions that run regular scans of virtual machines and container registries. The scanner compares the software inventory against known vulnerability databases and reports findings directly in the Defender for Cloud interface. You can then investigate each vulnerability, assess its severity, and apply remediation steps—such as patching the software or updating the container image—directly from the same interface. The scanning happens on a schedule you configure, and results are refreshed each time a scan completes.

Kubernetes Cluster Protection

Securing Kubernetes clusters through Microsoft Defender for Containers provides real-time threat protection and environment hardening. This solution protects both the cluster runtime and Linux nodes, detecting misconfigurations, suspicious pod activity, and privilege escalation attempts. Defender for Containers integrates with Azure Kubernetes Service (AKS) and can also monitor hybrid Kubernetes clusters. When a threat is detected, an alert is generated in Defender for Cloud, and you can investigate the affected pods, namespaces, or nodes to contain the issue.

Compliance and Threat Protection

Defender for Cloud also provides continuous compliance assessment against various security standards and regulatory benchmarks, such as Azure Security Benchmark, CIS, and PCI DSS. The platform maps your resources to these standards and reports which controls pass or fail. When a new compliance standard is added or updated, Defender for Cloud reassesses your environment automatically. This monitoring helps organizations maintain a secure and compliant posture without manual audits.