Microsoft Azure — Microsoft Defender for Cloud

Azure is Microsoft's cloud computing platform offering over 200 services. This article covers microsoft defender for cloud with production-ready configurations, best practices, and hands-on examples.

Why Defender for Cloud Is Not Optional

In production environments, security misconfigurations are the leading cause of breaches. Microsoft Defender for Cloud (MDC) provides a unified view of security posture across Azure, hybrid, and multi-cloud workloads. It combines CSPM (Cloud Security Posture Management) and CWPP (Cloud Workload Protection Platform) into a single dashboard. Without it, you're flying blind. MDC surfaces critical vulnerabilities, misconfigurations, and regulatory compliance gaps in real time. It integrates with Azure Policy, Sentinel, and DevOps pipelines to enforce security as code. For any organization running production workloads on Azure, MDC is the baseline — not an add-on.

#!/bin/bash
# Enable Defender for Cloud on a subscription
az security pricing create \
  --name 'VirtualMachines' \
  --tier 'Standard' \
  --subscription 'your-subscription-id'

echo 'Defender for Cloud enabled for Virtual Machines'

Setting Up Continuous Export for SIEM Integration

MDC alerts are useless if they're siloed. You must stream them to your SIEM (e.g., Sentinel, Splunk) for correlation and automated response. Continuous export pushes security alerts, recommendations, and secure score changes to Event Hubs or Log Analytics. This enables real-time ingestion. Use Azure Policy to enforce continuous export across all subscriptions. Without this, you'll miss alerts during off-hours. Configure export for both 'Security alerts' and 'Recommendations' to get full visibility.

# Set continuous export to Log Analytics workspace
$workspaceId = (Get-AzOperationalInsightsWorkspace -ResourceGroupName 'rg-security' -Name 'law-sec').ResourceId

Set-AzSecurityContinuousExport `
  -ResourceGroupName 'rg-security' `
  -Name 'exportToLAW' `
  -WorkspaceResourceId $workspaceId `
  -Enabled $true `
  -ExportType 'Alert' `
  -ExportScope 'Subscription'

Write-Host 'Continuous export configured for alerts'

Hardening VMs with Just-In-Time Access

Management ports (RDP/SSH) open to the internet are a top attack vector. Defender for Cloud's Just-In-Time (JIT) VM access locks down these ports by default and opens them on-demand for approved users. It integrates with Azure AD and RBAC. When a user requests access, MDC logs the request, opens the port for a configurable window (e.g., 3 hours), and then closes it. This reduces the attack surface dramatically. For production, enforce JIT via Azure Policy and require multi-factor authentication.

# Enable JIT on a VM
$vm = Get-AzVM -ResourceGroupName 'rg-prod' -Name 'web-vm'

$jitPolicy = @{
  '3389' = @{
    'allowedSourceAddressPrefix' = '*'  # Restrict in production
    'maxRequestAccessDuration' = 'PT3H'
  }
}

Set-AzJitNetworkAccessPolicy `
  -ResourceGroupName 'rg-prod' `
  -Location 'eastus' `
  -Name 'default' `
  -VirtualMachine $vm `
  -JitNetworkAccessPolicy $jitPolicy

Write-Host 'JIT enabled for web-vm'

Automating Remediation with Azure Policy and MDC

MDC generates thousands of recommendations. Manual remediation doesn't scale. Use Azure Policy to automatically enforce security configurations. For example, require encryption on storage accounts or enforce latest TLS version. MDC integrates with Azure Policy via 'DeployIfNotExists' policies that auto-remediate non-compliant resources. This shifts security left. For production, create custom policies for your specific compliance standards (e.g., SOC 2, PCI DSS).

{
  "properties": {
    "displayName": "Enforce TLS 1.2 on Storage Accounts",
    "policyType": "Custom",
    "mode": "Indexed",
    "parameters": {},
    "policyRule": {
      "if": {
        "allOf": [
          {
            "field": "type",
            "equals": "Microsoft.Storage/storageAccounts"
          },
          {
            "field": "Microsoft.Storage/storageAccounts/minimumTlsVersion",
            "notEquals": "1.2"
          }
        ]
      },
      "then": {
        "effect": "modify",
        "details": {
          "roleDefinitionIds": [
            "/providers/microsoft.authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c"
          ],
          "operations": [
            {
              "operation": "addOrReplace",
              "field": "Microsoft.Storage/storageAccounts/minimumTlsVersion",
              "value": "1.2"
            }
          ]
        }
      }
    }
  }
}

Securing Containers with Defender for Containers

Container security is a beast. Defender for Containers provides runtime threat detection, vulnerability scanning, and compliance checks for AKS, Azure Container Instances, and on-premises Kubernetes. It monitors container activities, detects privilege escalations, and alerts on suspicious images. Enable it per AKS cluster. For production, integrate with Azure Policy to enforce admission controller rules (e.g., disallow privileged containers).

#!/bin/bash
# Enable Defender for Containers on an AKS cluster
az aks update \
  --resource-group rg-prod \
  --name prod-aks \
  --enable-defender

echo 'Defender for Containers enabled'

Regulatory Compliance Dashboards That Actually Help

MDC provides built-in compliance dashboards for standards like SOC 2, ISO 27001, PCI DSS, and Azure CIS. These map recommendations to specific controls. For production, use the 'Regulatory Compliance' blade to track your score and drill into failed controls. Export compliance data to Log Analytics for custom reporting. But beware: the default dashboards are generic. Customize them to match your internal compliance framework.

# Get compliance score for a standard
$standard = Get-AzSecurityComplianceResult -StandardName 'SOC 2'

$standard.Properties.ComplianceScore | Format-Table -AutoSize

# Output
# ComplianceStandard : SOC 2
# Score              : 87.5
# PassedControls     : 42
# FailedControls     : 6

Integrating with DevOps Pipelines for Shift-Left Security

MDC can scan infrastructure-as-code templates (ARM, Bicep, Terraform) for misconfigurations before deployment. Use the 'Security Posture' API in your CI/CD pipeline to fail builds if critical vulnerabilities exist. This prevents insecure resources from reaching production. For Azure DevOps, use the 'Microsoft Security Code Analysis' extension. For GitHub, use the 'Defender for Cloud' action. This is non-negotiable for production.

trigger:
- main

pool:
  vmImage: 'ubuntu-latest'

steps:
- task: MicrosoftSecurityDevOps@1
  displayName: 'Run Defender for Cloud scan'
  inputs:
    Categories: 'IaC'
    Breaker: 'High'  # Fail on high-severity issues

- script: |
    echo 'Deploying...'
  displayName: 'Deploy'

Responding to Alerts with Automated Playbooks

MDC alerts are only useful if acted upon. Use Azure Logic Apps or Sentinel playbooks to automate responses. For example, when a VM is detected with a crypto-miner, automatically isolate the VM, snapshot the disk, and notify the team. MDC integrates with Azure Automation runbooks. For production, design playbooks with approval steps for destructive actions (e.g., terminating a VM).

{
  "definition": {
    "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#",
    "actions": {
      "Isolate_VM": {
        "type": "ApiConnection",
        "inputs": {
          "host": {
            "connection": {
              "name": "@parameters('$connections')['azureautomation']['connectionId']"
            }
          },
          "method": "post",
          "path": "/subscriptions/@{encodeURIComponent('...')}/resourceGroups/@{encodeURIComponent('...')}/providers/Microsoft.Automation/automationAccounts/@{encodeURIComponent('...')}/runbooks/@{encodeURIComponent('Isolate-VM')}/draft/testJob"
        },
        "runAfter": {}
      },
      "Notify_Team": {
        "type": "ApiConnection",
        "inputs": {
          "host": {
            "connection": {
              "name": "@parameters('$connections')['teams']['connectionId']"
            }
          },
          "method": "post",
          "path": "/v1.0/teams/@{encodeURIComponent('...')}/channels/@{encodeURIComponent('...')}/messages"
        },
        "runAfter": {
          "Isolate_VM": ["Succeeded"]
        }
      }
    },
    "triggers": {
      "When_a_security_alert_is_generated": {
        "type": "ApiConnection",
        "inputs": {
          "host": {
            "connection": {
              "name": "@parameters('$connections')['securitygraph']['connectionId']"
            }
          },
          "method": "post",
          "path": "/providers/Microsoft.Security/..."
        }
      }
    }
  }
}

Monitoring Secure Score Trends Over Time

Secure Score is a percentage that measures your security posture based on MDC recommendations. A single snapshot is useless; trends matter. Use Azure Monitor workbooks to track score changes over time, correlate with deployments, and identify regressions. For production, set up alerts when the score drops below a threshold (e.g., 80%). This provides an early warning system for configuration drift.

// Query secure score over time
SecurityResources
| where type == 'microsoft.security/securescores'
| extend score = properties.score.current
| project TimeGenerated, score
| summarize avg(score) by bin(TimeGenerated, 1d)
| render timechart

Cost Management: Optimizing Defender for Cloud Spend

MDC Standard tier costs money per resource. Costs can balloon if you enable it on everything. Use the 'Cost Estimation' feature in the Azure portal to forecast. For production, enable Standard only on critical resources (VMs, SQL servers, storage accounts with sensitive data). Use Azure Policy to enforce Standard on specific resource types. Monitor costs with Azure Cost Management. Disable Defender on non-production environments or use Free tier.

# Get cost for Defender for Cloud
$cost = Get-AzConsumptionUsageDetail -BillingPeriodName '202607' |
  Where-Object { $_.InstanceId -like '*Microsoft.Security*' } |
  Measure-Object -Property PretaxCost -Sum

Write-Host "Total MDC cost: $($cost.Sum)"

Multi-Cloud and Hybrid Scenarios with Arc

MDC extends to AWS, GCP, and on-premises via Azure Arc. Arc connects non-Azure machines to Azure, enabling MDC to assess their security posture. For production, use Arc to unify security management across environments. This is critical for organizations with multi-cloud strategies. MDC can even assess AWS resources like S3 buckets and EC2 instances. However, note that some features (e.g., JIT) are Azure-only.

#!/bin/bash
# Connect AWS account to Defender for Cloud
az security connector create \
  --resource-group rg-security \
  --name 'aws-connector' \
  --environment 'AWS' \
  --cloud-connector-data '{"awsAccountId":"123456789012","roleArn":"arn:aws:iam::123456789012:role/DefenderForCloud"}'

echo 'AWS account connected'

Advanced Threat Detection for SQL and Storage

MDC provides advanced threat detection for Azure SQL Database, SQL Managed Instance, and Azure Storage. It detects SQL injection, anomalous access patterns, and potential data exfiltration. For production, enable 'Advanced Threat Protection' on all SQL servers and storage accounts with sensitive data. Configure alerts to trigger on medium severity and above to reduce noise. Integrate with Azure SQL Auditing for forensic analysis.

# Enable Advanced Threat Protection on SQL Server
Set-AzSqlServerThreatDetectionPolicy `
  -ResourceGroupName 'rg-prod' `
  -ServerName 'sql-prod' `
  -NotificationRecipientsEmails 'security@company.com' `
  -EmailAdmins $True `
  -ExcludedDetectionType 'SqlInjection'  # Exclude if too noisy

Write-Host 'ATP enabled on sql-prod'

AI Security Posture Management for LLM and Agent Workloads

Defender for Cloud now extends to AI workloads, including LLM deployments, AI agents, and Azure OpenAI Service. MDC's AI security posture management monitors for misconfigurations in AI model deployments, data leakage from prompt flows, and excessive permissions on managed identities used by AI agents. It surfaces risks like inappropriate content filters, lack of rate limiting, and exposed API keys in AI configuration. Enable MDC's AI workload protections to gain visibility into your AI estate. For production, integrate with Azure AI Content Safety and enforce policies that require encryption, logging, and network isolation for all AI endpoints.

#!/bin/bash
# Enable AI workload protection
az security pricing create \
  --name 'Ai' \
  --tier 'Standard' \
  --subscription 'your-subscription-id'

echo 'AI workload protection enabled'

Agentless Vulnerability Scanning for VMs, Containers, and Databases

Traditional vulnerability scanning requires installing agents on every VM, creating management overhead and coverage gaps. Defender for Cloud's agentless scanning uses cloud APIs to scan VM disks, container images in ACR, and database configurations without installing any software. It detects OS vulnerabilities, exposed secrets, and malware. For VMs, it takes snapshot-based scans that don't impact performance. For containers, it scans images at rest in ACR and in runtime on AKS. For SQL, it assesses database configurations for vulnerabilities. Agentless scanning is enabled per subscription. For production, combine agentless scanning with the Defender agent for real-time threat detection on critical VMs.

#!/bin/bash
# Enable agentless vulnerability scanning
az security pricing create \
  --name 'AgentlessScanning' \
  --tier 'Standard'

# Verify scanning is active
az security sub-assessment list \
  --query "[?properties.resourceDetails.source=='Azure']" \
  -o table

Attack Path Analysis: Prioritizing Risks That Matter

Not all misconfigurations are equal. A storage account with public blob access is critical only if it contains sensitive data and is accessible from the internet. Attack path analysis in MDC connects the dots between seemingly unrelated misconfigurations to show how an attacker could chain them into a breach. It uses the Cloud Security Graph to model relationships between resources, identities, and network paths. For production, prioritize remediation based on attack path severity rather than individual recommendation scores. This reduces alert fatigue and focuses effort on the risks that actually matter. Enable attack path analysis in the Defender CSPM plan.

// Query attack paths from Defender for Cloud
SecurityAttackPaths
| where TimeGenerated > ago(7d)
| where Severity == 'Critical'
| project TimeGenerated, AttackPathId, RiskLevel, 
  Nodes = array_length(Properties.attackPath.nodes),
  EdgeCount = array_length(Properties.attackPath.edges)
| order by RiskLevel desc