Microsoft Defender for Cloud improves the security posture of Azure environments through continuous assessment, recommendations, and workload threat detection. It supports layered defense: harden resources against known weaknesses, then monitor for signs that an attack is under way. Its coverage spans infrastructure, networking, applications, data, virtual machines, Kubernetes, databases, key vaults, and other Azure resource types. section 1.8.2 section 7.0
For posture management, Defender for Cloud continuously assesses resource configurations against the Microsoft Security Benchmark and detects misconfigurations. Onboarded subscriptions receive a secure score and recommendations; some scenarios can automatically remediate resource misconfigurations. Regulatory Compliance can benchmark configurations against standards such as CIS and NIST, while custom policy initiatives can surface organization-specific checks in the same dashboard. section 6.9 section 10.4 section 1.8.3
Deploy and operate Defender for Cloud with a scalable security baseline:
- Organize subscriptions with management groups where possible, then choose least-privilege access: Security Reader can view recommendations and alerts, while Security Admin suits daily operational work. section 6.2.1
- Register each subscription with the Microsoft.Security resource provider. Contributor or Owner permissions are required for this registration. section 6.2.1
- Assign the Microsoft Cloud Security Benchmark so Defender for Cloud can generate security recommendations, including for PaaS resources such as storage accounts and Azure App Service. section 6.2.1
- Review recommendations and remediate prioritized weaknesses. Use security governance to assign responsibility, set remediation timing, and track progress. section 6.9
Kubernetes exposure and runtime detection
A Kubernetes cluster with an exposed privileged interface, such as the Kubeflow dashboard, can enable lateral movement. Defender for Cloud can identify exposed sensitive interfaces and crypto-mining activity on nodes. Its continuous assessment also identifies cluster misconfigurations and provides guidance to correct them. At runtime, suspicious processes, fileless attacks, and newly discovered vulnerabilities require continued monitoring; changing a running container does not fix the unpatched image that future scale-out operations use. section 1.8.2 section 4.4.3
Workload protection complements posture management after configuration problems have been addressed. Defender for Cloud monitors for suspicious activity and signs of compromise, generating a security alert when confidence is high enough. Forward alerts to Microsoft Sentinel for broader investigation using other data sources and for automated response. Defender for Cloud plans provide monitoring appropriate to differing workloads rather than treating VM and Kubernetes monitoring as identical. section 4.4.3 section 7.0
Free posture capabilities provide secure score and recommendations. Advanced CSPM capabilities require the Defender CSPM plan, including the cloud security graph, attack paths, cloud security explorer, and Regulatory Compliance dashboard. Attack paths help prioritize security problems that an attacker could exploit; graph-based queries explore relationships in cloud security graph data. section 6.9
az provider register --namespace 'Microsoft.Security' #1
Use this Azure CLI command to register a subscription with the Microsoft.Security provider before onboarding it to Defender for Cloud. section 6.2.1
az policy assignment create #1 --name ‘policyAssignmentName’ #2 --policy-set-definition 1f3afdf9-d0c9-4c3d -847f-89da613e70a8 #3 #1 The Azure CLI command used to assign MCSB #2 The name of the policy assignment #3 The name or ID of the policy definition used in the policy assignment. To assign MCSB, the value here needs to be 1f3afdf9-d0c9-4c3d-847f-89da613e70a8.
Use this Azure CLI policy assignment as the implementation pattern for assigning the Microsoft Cloud Security Benchmark to a subscription. section 6.2.1
