Microsoft Defender for Servers is a Microsoft Defender for Cloud plan for protecting Azure virtual machines. Enable it at subscription scope to cover resources within that subscription, then use layered controls to reduce compromise risk and monitor server activity. section 7.2 section 7.2.1
Its protection surface combines endpoint security, assessment, access reduction, application control, monitoring, and network hardening:
- Microsoft Defender for Endpoint provides endpoint detection and response, next-generation antivirus, attack-surface reduction, vulnerability management, investigation, and remediation. section 7.2.1
- Vulnerability assessment continuously scans installed applications, using either Qualys or Microsoft's threat and vulnerability assessment solution. section 7.2.1
- Just-in-time VM access reduces exposure from inbound management ports while preserving access when required. section 7.2.1
- Adaptive application control builds an allow list from machine-learning observations of applications running on the machine. section 7.2.1
- File integrity monitoring watches selected operating-system files, Windows registries, application software, and Linux system files for suspicious changes. section 7.2.1
- Adaptive network hardening recommends stricter network security group rules to reduce the attack surface. section 7.2.1
Enable the standard VM protection tier
Use Azure CLI to configure the VirtualMachines pricing tier: `az security pricing create -n VirtualMachines --tier 'standard'`. A successful response reports `name: VirtualMachines`, `pricingTier: Standard`, and the Microsoft.Security pricing resource identifier. Compare plan capabilities before selecting a tier: the higher plan adds features such as agentless vulnerability scanning, JIT VM access, adaptive application control, file integrity monitoring, adaptive network hardening, network-layer detections, Qualys assessment, and free Log Analytics ingestion.
