Microsoft Defender for Cloud

These are the two pillars of Defender for Cloud, addressing different aspects of cloud security:

• CSPM (Cloud Security Posture Management): Continuously assesses your cloud configuration against security best practices. It identifies misconfigurations like publicly accessible storage accounts, missing encryption, overly permissive network rules, and non-compliant resources. CSPM is preventative: it finds weaknesses before attackers do. The foundational CSPM tier is free; Defender CSPM (premium) adds attack path analysis, cloud security graph, agentless scanning, and governance rules.
• CWPP (Cloud Workload Protection Platform): Provides runtime threat protection for workloads. Defender plans detect active threats against servers (file integrity monitoring, adaptive application controls, JIT access), containers (image scanning, runtime protection), databases (SQL threat detection, anomalous queries), storage (malware scanning, data exfiltration), and more.

Together: CSPM prevents breaches by hardening configuration; CWPP detects and responds to active attacks that target your workloads.

CSPM overview

Yes. Defender for Cloud provides native multi-cloud support across all three major clouds:

• AWS integration: Native connector using AWS CloudFormation StackSets. Provides CSPM recommendations for AWS resources, CIS benchmark assessments, and optionally deploys Defender for Servers on EC2 instances via Azure Arc.
• GCP integration: Native connector using GCP service accounts. Provides CSPM assessments for GCP resources, CIS benchmarks for GCP, and Defender for Servers on GCE instances via Azure Arc.
• Unified view: All security recommendations, compliance assessments, and alerts from Azure, AWS, and GCP appear in a single Defender for Cloud dashboard with a unified Secure Score.
• Regulatory compliance: Map multi-cloud resources against frameworks like CIS, NIST 800-53, PCI-DSS, and ISO 27001 across all three clouds simultaneously.

Multi-cloud CSPM is included in the free tier. Multi-cloud workload protection (Defender for Servers on AWS/GCP) requires the Defender for Servers plan and Azure Arc.

Multi-cloud security

Secure Score is a percentage metric representing your overall cloud security posture. It provides a prioritised action plan for improvement:

• Calculation: Each security recommendation has a weight (max points). Your score = (points achieved / total possible points) × 100. Only recommendations for enabled resources count.
• Controls: Recommendations are grouped into security controls (e.g., "Enable MFA", "Encrypt data in transit", "Restrict network access"). Completing all recommendations in a control awards bonus points.
• Prioritisation: Recommendations are ranked by severity (Critical, High, Medium, Low), freshness score (how recently the resource became non-compliant), and potential impact on your score.
• Exemptions: You can exempt specific resources with a documented business justification. Exempted resources don't affect your score but remain visible for audit.

Industry benchmark: organisations typically start at 30–40% and reach 70–80% within 6 months of active remediation. Focus on Critical and High recommendations first for maximum score improvement.

Secure Score

Just-in-Time (JIT) VM Access reduces the attack surface of your virtual machines by blocking management ports by default and opening them only when needed:

• Default state: NSG rules block all inbound traffic on management ports (RDP 3389, SSH 22, WinRM 5985/5986, and custom ports you configure)
• Access request: When an admin needs to connect, they request access through the Azure portal, API, or PowerShell. The request specifies the source IP, port, and duration (1–24 hours).
• Approval: Requests can be auto-approved or require manual approval based on your policy configuration
• Port opening: Upon approval, JIT automatically modifies the NSG to allow inbound traffic from the requester's IP for the specified duration only
• Auto-close: When the duration expires, the NSG rule is automatically removed, closing the port
• Audit trail: All JIT access requests are logged in Azure Activity Log for compliance and forensics

JIT reduces your exposed attack surface by 96–98% vs. always-open management ports. It is one of the highest-impact security improvements for IaaS environments.

JIT VM access

Defender for Cloud offers individual plans that can be enabled independently per subscription:

• Defender for Servers P1: MDE integration, network-level protection. ~$5/server/month
• Defender for Servers P2: P1 + JIT access, file integrity monitoring, adaptive application controls, vulnerability assessment, agentless scanning. ~$15/server/month
• Defender for Containers: Image scanning, runtime protection, admission control, Kubernetes audit. ~$7/vCore/month
• Defender for SQL: Threat detection for Azure SQL, SQL on VMs, and SQL Managed Instance. ~$15/instance/month
• Defender for Storage: Malware scanning, sensitive data detection, anomalous access patterns. ~$10/storage account/month
• Defender for Key Vaults: Anomalous access detection. ~$0.02/10K transactions
• Defender for App Service: Threat detection for web apps. ~$15/instance/month
• Defender CSPM: Attack path analysis, cloud security graph, agentless scanning, governance. ~$5/server/month

The foundational CSPM (Secure Score, basic recommendations, Azure Security Benchmark) is free for all Azure subscriptions.

Defender for Cloud overview

Attack path analysis (Defender CSPM premium) uses a cloud security graph to identify exploitable paths from the internet to your critical assets:

• Graph-based model: Maps all relationships between resources: VMs, storage, databases, identities, network configurations, and vulnerabilities
• Attack simulation: Simulates how an attacker could chain multiple weaknesses: e.g., a publicly exposed VM with a known CVE that has access to a database containing sensitive data
• Risk prioritisation: Ranks attack paths by exploitability and impact, helping you focus on the paths attackers are most likely to use
• Remediation guidance: Shows exactly which resource to fix to break the attack path. often a single NSG rule change or permission removal eliminates an entire path

Attack path analysis shifts security from "fix all vulnerabilities" to "fix the vulnerabilities that actually matter". dramatically reducing remediation effort while improving security outcomes.

Attack path analysis