Crisp answer: Defender for Cloud is Microsoft's CSPM (Cloud Security Posture Management) and CWPP (Cloud Workload Protection Platform). It does two things: scores your security posture via Secure Score and protects workloads with threat detection and alerting.
The two pillars:
1. CSPM — Cloud Security Posture Management
Defender for Cloud continuously assesses your Azure resources against security best practices and generates recommendations:
Secure Score: a percentage (0-100%) reflecting how many security
recommendations you have implemented.
Example recommendations:
- "MFA should be enabled on accounts with owner permissions" — High
- "Storage accounts should restrict network access" — Medium
- "System updates should be installed on your machines" — Low
Each recommendation has:
- Description of the risk
- Affected resources
- Remediation steps (often a one-click fix or policy assignment)
- Impact on Secure Score if remediated
2. CWPP — Cloud Workload Protection Platform
Threat detection for specific resource types. Requires a paid plan per resource type:
| Plan | Protects |
|---|---|
| Defender for Servers | VMs and Arc-enabled servers — MDE integration, file integrity monitoring, JIT access |
| Defender for Containers | AKS clusters — runtime threat detection, Kubernetes audit logs |
| Defender for SQL | Azure SQL and SQL Server — SQL injection detection, anomalous access |
| Defender for Storage | Blob and Files — malware scanning, anomalous access patterns |
| Defender for Key Vault | Unusual access patterns, access from suspicious IPs |
| Defender for DNS | Detects DNS exfiltration and C2 communication |
Azure Arc integration:
Defender for Cloud extends to on-premises and other cloud servers via Azure Arc. Arc-enables the server (installs an agent), which then registers it in Azure Resource Manager. Defender for Servers can then protect it exactly like an Azure VM.
# Check Defender for Cloud coverage via Azure CLI
az security assessment list --query "[].{Name:displayName, Status:status.code}" -o table
# Check Secure Score
az security secure-score list -o table
# List unhealthy recommendations
az security assessment list \
--query "[?status.code=='Unhealthy'].{Name:displayName,Severity:metadata.severity}" \
--output table
What to say in the interview:
"At the RHS I automated Defender for Cloud onboarding across our Azure VM and Arc-enabled server estate, reaching 100% coverage within 30 days. I used Ansible to deploy the Azure Monitor Agent and the MDE onboarding package at scale, then tracked coverage daily in the Defender inventory. I then worked through the Secure Score recommendations systematically, starting with High severity findings and using Azure Policy to enforce remediations at scale rather than fixing resources one by one."