Situation: Shortly after joining RHS as Cloud Operations Engineer, I noticed Defender for Cloud wasn't onboarded consistently across our Azure VMs and Arc-enabled on-prem servers. We had a real visibility gap on patching status and security posture, and the security team was getting fragmented reports.
Task: I was asked to lead the rollout: get every server onboarded, automate it so new servers wouldn't drift, and reduce alert noise so the security team could actually act on what came through.
Action: I rolled out the Arc agent across the on-prem estate, automated patching policies via Azure Policy, and set up policy-based auto-onboarding so any new VM was captured by default. I worked with the security team to tune alert thresholds — we cut several categories of noisy false positives. I then documented the runbook for re-onboarding any stragglers.
Result: We reached 100% coverage within 30 days. The security team now has real-time visibility across the entire estate.
Preventative action: The policy-as-code piece means new servers can't silently drift out of compliance. The runbook is owned by my team so any of us can resolve onboarding issues without escalation.