Defender for Cloud Beyond the Secure Score

Most organizations running in Azure have already met Microsoft Defender for Cloud, usually as the secure score dashboard that nags them about open ports and missing encryption. What far fewer realize is that the posture dashboard is just the handle. Folded inside the same product is a set of blades that can protect almost everything you run, not only in Azure, but across AWS, Google Cloud, and your on-premises servers too. It is one of the most capable and most underused tools in the Microsoft security portfolio, and treating it as a compliance scorecard leaves most of its value on the table.

This article opens up the knife. We will walk through what Defender for Cloud actually protects, how its two engines work, which blades deliver the fastest return in real environments, and how the same product extends from a single Azure subscription out to a full multicloud and hybrid estate.

Validate coverage before enabling plans

Microsoft describes Defender for Cloud through posture management, development security, and workload protection. Coverage differs by cloud, resource type, plan, integration, and configuration. Treat the examples below as a planning inventory, not a claim that every feature covers every environment. Verify the current support matrix and pricing for the exact deployment before enabling a plan.

Two Engines Under One Cover

Defender for Cloud does two fundamentally different jobs, and understanding the split is the key to using it well.

The first is Cloud Security Posture Management, or CSPM. This is the preventive engine. It continuously assesses your resources against security best practices and regulatory standards, scores your posture, and tells you what to fix before an attacker finds it. A foundational layer of CSPM is on by default and free for every Azure subscription, which is why so many teams know the secure score and assume that is the whole product.

The second is Cloud Workload Protection, or CWPP. This is the active defense engine. It is a family of paid plans, each tuned to a specific kind of workload, that watch for threats in real time and raise alerts when something is actually under attack. This is the part many organizations never switch on, and it is where the knife earns its name.

The value: CSPM keeps you from being an easy target, and CWPP catches the attacks that get attempted anyway. You want both, and Defender for Cloud delivers them through one console with one set of recommendations and a shared operational view.

Supporting reference: Microsoft Defender for Cloud Overview - Microsoft Defender for Cloud ↗

The Free Layer You Already Have

Before paying for anything, every Azure customer gets foundational CSPM: secure score, security recommendations, asset inventory, and assessment against the Microsoft cloud security benchmark. If you do nothing else, acting on those recommendations measurably reduces your exposure at no cost.

Stepping up to the paid Defender CSPM plan adds the features that turn posture management from a checklist into an investigation tool, and it is a useful option to evaluate when attack-path and sensitive-data context are required. Attack path analysis traces the actual routes an attacker could take from an exposed resource to your crown-jewel data. The cloud security graph maps relationships across your environment so you can ask questions like which internet-facing machines have a path to a database with sensitive data. Agentless scanning inspects virtual machines for vulnerabilities and secrets without installing anything. Data-aware security posture finds where your sensitive data lives and flags when it is overexposed. These capabilities work across Azure, AWS, and GCP from the same plan, which is exactly why it tends to be the first blade we open.

The Blades: What It Actually Protects

Here is where the breadth becomes obvious. Defender for Cloud is not one protection, it is a collection of workload-specific plans you enable as needed:

Servers. Defender for Servers protects virtual machines, integrating Microsoft Defender for Endpoint for endpoint detection and response, vulnerability assessment, file integrity monitoring, just-in-time VM access to shrink the attack surface, and agentless scanning. Critically, this covers not just Azure VMs but on-premises and other-cloud servers through Azure Arc.

Storage. Defender for Storage is the workload plan we see enabled most often, and for good reason. Blob and file storage is everywhere and a frequent target, and this plan adds near real-time malware scanning of uploaded files and sensitive data threat detection on top of its threat alerts, so a poisoned upload or an exfiltration attempt surfaces immediately. Evaluate its value against your storage exposure, data volume, and response requirements.

Containers. Defender for Containers secures Kubernetes wherever it runs, including Azure Kubernetes Service, plus Amazon EKS, Google GKE, and Arc-enabled clusters on-premises. It covers image scanning, runtime threat detection, and Kubernetes posture hardening.

Databases. Defender for Databases protects Azure SQL, SQL Server on machines, open-source relational databases like PostgreSQL and MySQL, and Azure Cosmos DB, watching for SQL injection, anomalous access, and brute-force attempts.

DevOps. DevOps security extends protection left into your pipelines across GitHub, Azure DevOps, and GitLab, scanning for exposed secrets, misconfigurations, and vulnerabilities in infrastructure as code before they ever reach production. It is fast becoming one of the most requested plans we deploy, as more teams recognize that stopping a leaked secret before it ships beats hunting for it afterward.

App Service. Defender for App Service guards your web apps and APIs hosted on App Service against common web attacks and reconnaissance.

Key Vault. Defender for Key Vault flags unusual access to your secrets, keys, and certificates, which is exactly the signal you want when credentials are being harvested.

Resource Manager. Defender for Resource Manager monitors the control plane itself, catching suspicious management operations and the kind of privilege abuse that precedes a broader compromise.

APIs. Defender for APIs discovers and protects APIs published in Azure API Management, surfacing exposed, unauthenticated, or sensitive-data-carrying endpoints.

AI workloads. Threat protection for AI services watches your generative AI applications for prompt injection and abuse, addressing a risk class that did not exist a couple of years ago.

The pattern is the same across all of them: you turn on the blade you need, when you need it, and pay only for that workload type. You are not forced into an all-or-nothing license. In practice, the order most organizations grow into starts with Defender CSPM and Defender for Storage, with DevOps security close behind, and expands from there as the estate and the appetite for coverage mature.

Beyond Azure: Multicloud and Hybrid

This is the part that surprises people. Defender for Cloud is not an Azure-only tool. Through native connectors, it brings AWS and GCP accounts under the same posture management and the same workload protections. After you onboard an AWS or GCP environment, Defender for Cloud begins assessing those resources against industry standards, scores them alongside your Azure estate, and can extend server, container, and database protection to them. The CSPM features are agentless and need only the connector to start working.

For on-premises and other-cloud machines, Azure Arc is the bridge. Arc projects a non-Azure server, SQL instance, or Kubernetes cluster into Azure as a manageable resource, and once it is there, Defender for Cloud can protect it through supported onboarding and plan capabilities. That means a single pane of glass over your Azure VMs, your AWS workloads, your GCP clusters, and the servers still sitting in your own data center.

The value: for an organization with a genuinely mixed estate, this collapses what would otherwise be three or four separate security tools into one. You get consistent recommendations, consistent threat detection, and one secure score across everything, instead of stitching together a different posture tool per cloud.

The Connective Tissue

What ties the blades together is the cloud security graph and attack path analysis underneath them. Because Defender for Cloud understands the relationships between resources, it does not just hand you a flat list of ten thousand findings. It can tell you which handful of issues actually create a path to something that matters, so your team fixes the five things that break an attack chain rather than drowning in noise.

It also does not live in isolation. Alerts from Defender for Cloud flow into Microsoft Defender XDR for correlation with endpoint, identity, and email signals, and into Microsoft Sentinel for SIEM-level hunting and response. The posture tool and the threat detection plans become part of your broader security operations rather than a side console nobody watches.

How to Turn It On Without Overspending

The flexibility that makes Defender for Cloud powerful also means you should be deliberate about enabling it. The sequence we most often recommend, drawn from what actually delivers value first:

Act on foundational CSPM first. It is free and already running. Work the secure score before you spend a dollar.

Enable Defender CSPM next. This is the plan we see pay off most consistently, bringing attack path analysis, agentless scanning, and data-aware posture to anywhere you hold sensitive data.

Add Defender for Storage early. As the most commonly enabled workload plan, it protects an asset class that is both pervasive and frequently targeted, and it shows value almost immediately.

Bring in DevOps security close behind. Catching exposed secrets and misconfigured infrastructure as code before it reaches production is one of the highest-leverage moves available, and it is increasingly where teams want to start.

Expand to the remaining workload plans by risk. Layer in servers, databases, containers, and the rest in the order that matches your exposure.

Extend to multicloud and hybrid deliberately. Onboard AWS, GCP, and Arc-connected machines so your highest-value non-Azure assets get the same coverage.

Wire alerts into Sentinel and Defender XDR so the findings drive real response instead of accumulating in a dashboard.

Pricing is per workload and per resource, so the cost scales with what you choose to protect. That is a feature, not a limitation: you can match spend to risk rather than buying one large bundle.

Should Your Organization Lean On It

Defender for Cloud is a strong fit if you run meaningful workloads in Azure, especially if you also run in AWS or GCP or still operate on-premises servers. It is particularly compelling if you are trying to reduce the number of point security tools you operate, because one product can cover posture and threat protection across the whole estate. And it is close to essential if you hold regulated or sensitive data in the cloud, where the compliance assessments and data-aware posture features map directly to your obligations.

The honest caveat is that the breadth is also the catch. The product only protects what you enable, and the default free layer is a small fraction of what it can do. Organizations that treat Defender for Cloud as just the secure score are getting a sliver of the value they could have. The tool is hidden in plain sight, already in the portal, waiting to be switched on. Starting with CSPM and Storage, then DevOps, is the path we have seen deliver the fastest, most durable return.

The Bottom Line

Defender for Cloud is misnamed in the minds of most people who use it. It is not a posture dashboard with some extra features, it is a full cloud protection platform that happens to includes a posture dashboard. From a single Azure VM to a sprawling multicloud and hybrid environment, the same product can assess, harden, and actively defend almost everything you run. The blades are all there in one handle. The only question is how many of them you have actually opened.