Posture and workload protection with Defender for Cloud
Defender for Cloud does two things you buy as one product: CSPM tells you whether your platform is set up the way you think, CWPP whether something is happening right now. Where you draw that line decides your coverage and your bill.
Architecture
Click a step for details
Resources
The first return is not detection but an inventory: you see what is running before you choose what to protect.
AI security posture management hangs off the assessment and builds the AI bill of materials; AI threat protection hangs off the plans and watches for prompt injection and data leaks at runtime.
Overview
Defender for Cloud does two different things and you buy them as one product. That is why most implementations end up lopsided.
CSPM answers whether your environment is set up the way you think it is. It continuously assesses your resources, subscriptions and organization against a standard, turns deviations into recommendations and summarizes the result in a secure score. The standard that is on by default is the Microsoft Cloud Security Benchmark; regulation such as ISO 27001 or NIS2 goes on top of that as a separate compliance standard.
CWPP answers whether something is happening right now. That is not a continuous assessment but runtime detection, and it is enabled per plan: Servers, Containers, Storage, Databases, App Service, Key Vault, Resource Manager, APIs and AI Services.
Those two scale differently, and that is where the architectural decision sits. CSPM is broad and cheap, so it belongs everywhere, including development and test subscriptions; a misconfigured test environment is a real path into production. CWPP is priced per plan and per resource, so that is where you deliberately choose the places a breach would actually cost you money.
For a Data & AI platform there is a third piece. AI security posture management discovers which AI workloads you are running by itself — Azure OpenAI Service, Microsoft Foundry, Azure Machine Learning, and on other clouds Amazon Bedrock and Google Vertex AI — and builds an AI bill of materials from that. AI threat protection watches those same workloads at runtime, with Azure AI Content Safety prompt shields and Microsoft threat intelligence underneath it, and reports direct and indirect prompt injection, data leaks and wallet abuse among other things.
At a glance
- Best for
- Posture and workload protection across clouds
- Complexity
- Medium
- Scalability
- ★★★★★
- Cost
- Variable
- Workloads
- Servers · Containers · Storage · Databases · AI Services
When to use this
- More than one subscription and nobody with an overview. the first return is not detection but an inventory. You see what is running before you decide what to protect.
- A Data & AI platform where the data plane matters. storage accounts, databases and AI endpoints are the resources your data actually passes through, and there are plans for exactly those.
- A compliance obligation you must evidence continuously. attaching a standard gives you a score per control with the evidence underneath it, instead of an audit assembled by hand once a year.
- More than one cloud. AWS accounts and GCP projects land in the same assessment, so you do not have to maintain a separate definition of "set up correctly" per cloud.
- One subscription, one team, nothing sensitive. the reporting costs you more attention than it returns. Start with a handful of Azure Policy rules.
- As a replacement for identity or data governance. Entra is about who gets in, Purview about what the data is and who may reach it, Defender about how it is configured and what is happening now. Buy the third to cover the first two and you are left with a gap nobody sees.
- As the place to investigate. Defender raises alerts, but building one timeline across signals from multiple products is Sentinel's job. Defender is the source, not the workbench.
- If you are not going to act on the findings. a secure score that has been at 42 percent for a year is not a measurement, it is something people have got used to.
Key Design Decisions
CSPM versus CWPP
Why separate the two? CSPM answers whether your environment is set up the way you think, CWPP whether something is happening right now. The first is broad and cheap and belongs everywhere, the second is billed per plan and per resource and belongs where a breach would actually cost money.
Microsoft Cloud Security Benchmark
Why a standard as the baseline? MCSB is on by default and gives you one definition of 'set up correctly' across Azure, AWS and GCP. Regulation such as ISO 27001 or NIS2 goes on top as a separate compliance standard, not instead of it.
AI bill of materials
Why discover instead of register? AI security posture management finds which AI workloads are running by itself, from Azure OpenAI and Microsoft Foundry to Amazon Bedrock and Google Vertex AI. A hand-written list falls behind after the first sprint.
Agentless or an agent
Why choose per server group? The Log Analytics agent was retired in August 2024; Defender for Servers has since worked through the Defender for Endpoint integration or through agentless scanning. Agentless is cheaper to roll out and sees less at runtime.
Trade-offs
Foundational CSPM/Defender CSPM
the free tier gives you recommendations and the score, the paid tier adds the security graph, attack path analysis and agentless scanning. The difference is not more rules but the question of whether somebody *can* walk a path to your data. Note: from 27 October 2026 Foundational CSPM is no longer on by default for new Azure subscriptions and has to be enabled deliberately.
Agentless/an agent
the Log Analytics agent was retired in August 2024. Defender for Servers has since worked through the Defender for Endpoint integration or through agentless scanning. Agentless is cheaper to roll out and sees less at runtime; you make that choice per server group, not per tenant.
Secure score/risk
the Cloud secure score in the Defender portal is risk-based and takes asset criticality into account. That makes it prioritize differently from a count of open recommendations, and that is the point: a hundred findings on a test environment should not outweigh three on the production data platform.
Enable broadly/enable selectively
plans are enabled per subscription and billed per resource. Turning everything on everywhere is defensible as long as you can explain it; it only becomes a problem when the first invoice opens the debate and something gets switched off at random.
Where Defender stops and Purview and Sentinel start
These three are often discussed as competitors while they answer different questions. Purview says what data is and who may reach it. Defender says how the platform is configured and whether something is happening now. Sentinel says what that means together.
The practical boundary is the word correlation. As long as a signal can be judged on its own — a storage account that is public, a suspicious call on an AI endpoint — it belongs to Defender. The moment you have to put two signals from different products side by side to see whether they are one event, you are in Sentinel. See Tiered SIEM with Microsoft Sentinel for that side.
What follows for your design: enable Defender with the assumption that the alerts go somewhere. Turning on a plan without the alerts landing in your SIEM produces a second console nobody looks at.
Common pitfalls
The oldest pitfall is enabling a plan before diagnostic logging is on. The alert does arrive, but the data you would investigate it with is not there, because logging does not collect retroactively. You notice the effect at the worst possible moment: you have a detection and no timeline underneath it. Turn on diagnostic settings as the first step, not as the finishing touch.
The second is treating the secure score as a target instead of a measurement. The number is pleasantly easy to push upwards by ticking off recommendations that cost little on their own, while the findings with a real path to your data stay open because they are work. Use the risk-based view and attack paths to decide what you do this sprint, and the score only to show whether it is heading the right way.
The third is exempting development and test environments to save money. That is exactly backwards: those subscriptions have wider permissions, less oversight and often a network route into production. CSPM is cheap there, so it belongs on them. What you switch off is CWPP, and then deliberately and with a reason.
The fourth applies specifically to AI. AI security posture management only discovers what is within Defender's reach. An AI workload a team put in its own subscription outside your management group is not in your AI bill of materials, which makes the inventory look more complete than it is. Periodically check that the number of subscriptions under Defender equals the number of subscriptions you have.
Good versus bad
- You see everything before you choose
- The invoice can be explained
- Nobody knows what is covered anymore
- The gaps sit where it was busiest
Best practices
Diagnostic logging first
Turn on diagnostic settings before you enable a plan. The alert does arrive, but logging does not collect retroactively, so without that step you have a detection with no timeline underneath it.
CSPM on dev and test too
Development and test subscriptions have wider permissions, less oversight and often a route into production. CSPM is cheap there, so it belongs on; what you switch off is CWPP, and then with a reason.
Attack paths over score
Steer on the risk-based view and on attack path analysis, not on the number of open recommendations. A hundred findings on a test environment should not outweigh three on the production platform.
Alerts into your SIEM
Only enable a plan if the alerts land somewhere. A plan without a route into Sentinel produces a second console nobody looks at.
Count your subscriptions
Periodically check that the number of subscriptions under Defender equals the number you have. An AI workload outside your management group is not in your AI bill of materials, which makes the inventory look more complete than it is.
A secure score that has been at 42 percent for a year is not a measurement, it is something people have got used to. Enable CSPM broadly, but only if somebody actually follows up on the findings.