Microsoft Defender for Cloud Complete Guide: CSPM, CWPP, JIT VM, Multi-Cloud Protection

Microsoft Defender for Cloud (formerly Azure Security Center) is an integrated CSPM (Cloud Security Posture Management) + CWPP (Cloud Workload Protection Platform) that comprehensively protects Azure, AWS, and GCP environments. CSPM features visualize the organization's security posture (Microsoft Secure Score), assess compliance (NIST, ISO, PCI DSS, etc.), and provide recommendations. CWPP features protect individual Azure resources (VMs, Storage, SQL DB, Key Vault, AKS, App Service, OSS DBs) with threat detection, vulnerability scanning, and Just-in-Time VM Access. Multi-cloud support (AWS Connector, GCP Connector) enables unified enterprise security management.

Free Tier (basic CSPM only, free): Security Score, Recommendations, Secure Score, Microsoft Cloud Security Benchmark assessment, and Asset Inventory. Defender Plans (paid, per resource): Defender for Servers Plan 1/2 (EDR, Vulnerability Assessment, Adaptive Application Controls), Defender for Storage (malicious upload detection, Sensitive Data Discovery), Defender for SQL (threat detection, Vulnerability Assessment), Defender for Containers (AKS protection, container image scanning), Defender for Key Vault, Defender for App Service, Defender for OSS DB, Defender for Resource Manager, Defender for DNS, Defender for DevOps (GitHub / Azure DevOps integration), and Defender CSPM (advanced CSPM, Attack Path analysis). Plans are enabled individually and billed per resource. In production, Defender for Servers, SQL, Storage, Key Vault, and Containers are essentially mandatory.

Microsoft Secure Score is a 0-100% metric that quantifies an organization's Azure security posture. It evaluates controls based on the Microsoft Cloud Security Benchmark (formerly Azure Security Benchmark) — for example, VM disk encryption, disabling Storage public access, and enabling SQL DB auditing — and computes a score by completion rate. Recommendations highlight specific improvements (e.g., an 'Enable VM disk encryption' button that triggers automatic remediation). Multi-cloud (AWS, GCP) is included in the unified score. Target values vary by organization, but 70-80% is a typical production benchmark. It's also used as a reporting metric for leadership and is heavily referenced in compliance audits and board-level security reports.

JIT VM Access is a Defender for Servers feature that keeps VM management ports (RDP 3389, SSH 22, PowerShell Remoting 5986) closed by default and only opens them temporarily when needed. By default, management ports are denied via NSG. A user requests access from Defender for Cloud (specifying a window like 3 hours), the NSG rules are dynamically updated to allow only that user's source IP, and access is automatically denied when the window expires. This eliminates constant exposure to brute-force attacks and scanners, dramatically improving production VM security. Combined with Microsoft Entra ID authentication and Conditional Access, you can enforce strict controls like 'JIT activation allowed only from compliant devices.' Applying JIT to every VM with a public IP is a modern production best practice.

Vulnerability Assessment automatically scans VMs, container images, and SQL DBs for vulnerabilities. Microsoft Defender Vulnerability Management (MDVM), integrated into Defender for Servers Plan 2, detects OS, software, and middleware vulnerabilities against the CVE database, prioritizes them by CVSS score, and provides remediation guides. VMs: monthly automatic scans plus real-time detection. Container Registry: automatic scanning on image push plus runtime detection (Defender for Containers). SQL DB: monthly scans plus baselined recommendations. Post-detection response: apply Patch Tuesday (Windows), run apt/yum update (Linux), rebuild container images, and apply SQL DB Security Baseline. In production, the standard is automated patch management combining Defender for Cloud Vulnerability Assessment with Microsoft Update Manager.

Defender for Cloud extends protection to other clouds via the AWS Connector and GCP Connector. AWS Connector: connect AWS accounts to Defender for Cloud and gain CSPM (Recommendations, Secure Score) plus CWPP (Defender for Servers also covers AWS EC2; Defender for SQL also covers RDS). GCP Connector: connect GCP projects and apply Defender for Servers to Compute Engine VMs. Multi-cloud Secure Score provides a unified dashboard for Azure, AWS, and GCP for centralized security posture management. A common enterprise pattern is unified management of a primary cloud (Azure) and secondary cloud (AWS) in Defender for Cloud so SOC analysts can monitor all environments from a single pane. Multi-cloud integration positions the Microsoft security stack as the core platform for multi-cloud enterprises.

Defender for Cloud and Microsoft Sentinel are complementary. Defender for Cloud focuses on 'security posture management plus per-resource protection' for cloud resources, generating Recommendations and Security Alerts. Microsoft Sentinel focuses on organization-wide 'threat detection, incident response, and threat hunting,' aggregating alerts from Defender for Cloud and other sources (Defender XDR, third-party firewalls, SaaS apps). Standard pattern: Defender for Cloud generates Security Alerts → forwarded to Microsoft Sentinel (auto-ingested via Data Connector) → analyzed in Sentinel with KQL, automated responses via Logic App Playbook, and threat hunting. The combination forms the complete picture of Microsoft cloud security, and SOC analysts must deeply understand both tools.

SC-200 (Security Operations Analyst Associate) is the headline certification for this area — Domain 2 (Configure protections and detections, 15-20%) covers Defender for Cloud deeply. Also covered in: SC-100 (Cybersecurity Architect Expert) as the Infrastructure pillar of Zero Trust strategy; AZ-104 (Administrator) Domain 5 for monitoring; MS-102 (Microsoft 365 Administrator Expert) Domain 3 for Defender XDR integration; and SC-500 (formerly AZ-500, GA 2026-09) for overall Azure security implementation. As the core of the Microsoft security stack, it's an essential skill for SOC analysts and security architects.