Defender for Cloud is two products wearing one name. The first is posture management (CSPM): continuously assessing your resources against security best practice and compiling the findings into secure score. The second is workload protection (the Defender plans): runtime threat detection for servers, containers, databases, storage, and more, priced per resource type. Conflating them is how teams end up either paying for protection they do not use or believing a dashboard is defending them.

Posture: Free, Paid, and What Score Actually Means

Foundational CSPM is free and already assessing every subscription: misconfigurations, missing encryption, exposed endpoints, all rolled into secure score. The paid Defender CSPM plan adds the pieces that change behavior: attack path analysis, which chains individual findings into exploitable routes (internet exposed VM with a high severity CVE holding a managed identity that can reach the production Key Vault), agentless scanning for vulnerabilities and secrets across VMs and containers, and cloud security explorer for ad hoc risk queries. Attack paths are the killer feature because they solve prioritization: a thousand findings paralyze, but twelve attack paths ending at crown jewels get fixed.

Treat secure score as a program with an owner, a target, and a monthly cadence, not as wall decoration. The mechanics that make it move: fix by recommendation across all resources rather than resource by resource, use the policy driven enforcement from earlier posts so fixed classes of findings cannot recur (a denied misconfiguration never becomes a finding), and use Defender’s governance rules to assign every recommendation an owner and a due date with automatic email nagging. Findings without owners are findings forever.

Choosing Workload Protection Plans

Each Defender plan is a separate purchase decision per subscription, so decide like an engineer. Defender for Servers: P1 gives Defender for Endpoint integration for cloud and Arc connected machines; P2 adds agentless scanning, file integrity monitoring, and the just in time access covered in the Bastion post, choose P2 for production server estates. Defender for Containers: registry vulnerability scanning plus the runtime sensor from the AKS hardening post, effectively mandatory for container platforms. Defender for Storage: malware scanning on upload and anomalous access detection, enable it on accounts that receive files from the outside world, it has caught real malware in every deployment I have run it in. Defender for SQL and open source databases: suspicious query patterns, brute force detection, worth it on anything internet adjacent. For each plan the question is the same: what detection do I get, what would that incident cost me, and is anything else already covering it. Enable at the management group level through policy so new subscriptions inherit the decisions.

Wiring It In

Defender findings and alerts should not live in their own portal silo. Alerts flow to Sentinel through the Defender XDR connector from yesterday’s post, becoming incidents with everything else. Recommendations export continuously to Log Analytics or Event Hubs for your own reporting and for the platform teams’ dashboards. Regulatory compliance dashboards map your posture against the frameworks your auditors care about, and the same data answers their questions in evidence rather than meetings. And the multicloud story is real: connect AWS and GCP through the environment connectors and the same CSPM engine, secure score, and attack paths span all three clouds, which for most organizations is the only unified security view they will ever get.

Cheers
Osama