cuong do

Posted on Oct 22 Originally published at gitlab.com

Defender for Cloud in one page (plus a mock case)

#azure #security #cloud #cybersecurity

Defender for Cloud has a lot of plans. Every plan has its own toggle, its own scope rules and its own idea of who's allowed to touch it. My readiness notes for this topic were mostly question marks. So I did what I always do: rebuilt it in my lab and checked every answer against Microsoft Learn (October 2026).

Part 1 is the one-page version: what you get for free, what you pay for, where each plan can be turned on, and who can change what. Part 2 is a mock case: three small puzzles from my notes, each with the answer.

My lab: a Contoso tenant, subscription sub-lab-prod, resource group rg-lab-mdc with a Windows Server VM vm-lab-01 and a storage account stlabmdc01, a Log Analytics workspace law-lab-mdc, and two test users, lab-reader@contoso.com and lab-secadmin@contoso.com. All names and numbers are made up.

TL;DR

Defender for Cloud is posture (CSPM) plus workload protection (CWPP). Foundational CSPM is free: recommendations, secure score, asset inventory and the Microsoft cloud security benchmark. Alerts and extra regulatory standards come with paid plans.
Most plans are switched on per subscription. Storage, SQL and open-source relational databases can also go per resource, and Defender for Servers Plan 1 can go per machine. Plan 2 can't.
Security Reader looks, Security Admin changes policy and plans, Owner can do everything. Some features (agentless scanning with Defender CSPM) only switch on fully when an Owner enables the plan.

Lab at a glance


Goal	Map the free and paid parts of Defender for Cloud, turn a plan on at subscription and resource level, and see which role can do what
You need (license, role)	An Azure subscription you can break. Owner on it for the full lab, plus two test users for Security Reader and Security Admin. No paid plan needed to start
Time	About 90 minutes, plus waiting time (secure score controls update every eight hours)
Cost	Foundational CSPM is free. Paid plans start a 30-day trial you can't pause, then normal billing. Check the pricing page before you flip anything
What we break on purpose	A Security Reader tries to enable a plan, a Security Admin tries to add a compliance standard without the right plan, and we try to put Servers Plan 2 on one VM

Part 1: Defender for Cloud in one page
Build
Verify
Break it
Fix
Clean up
Mock case: three puzzles from my notes
Gotchas
Checklist
Sources

Part 1: Defender for Cloud in one page

CSPM plus CWPP

Microsoft calls Defender for Cloud a cloud-native application protection platform (CNAPP). Big name, three parts:

Part	What it does	Example
CSPM (cloud security posture management)	Finds misconfigurations and tells you how to fix them	"Storage account allows public access"
CWPP (cloud workload protection platform)	Protects running workloads and raises alerts	"Suspicious process on vm-lab-01"
DevSecOps	Code and pipeline security for GitHub, Azure DevOps and GitLab	IaC misconfigurations, exposed secrets

It covers Azure, AWS, GCP and on-premises machines (through Azure Arc). It's also moving into the Defender portal, so some pages now exist in two places. The Azure portal is still where you configure most things.

Foundational CSPM vs Defender CSPM

When you open Defender for Cloud on a subscription, you already have Foundational CSPM. It's free and needs no toggle.

	Foundational CSPM (free)	Defender CSPM (paid)
Recommendations, secure score, asset inventory	Yes	Yes
Microsoft cloud security benchmark (MCSB)	Yes	Yes
Continuous export, workflow automation, workbooks	Yes	Yes
Extra regulatory compliance standards	No	Yes
Attack path analysis, cloud security explorer	No	Yes
Agentless VM vulnerability and secrets scanning	No	Yes
Governance rules, custom recommendations	No	Yes
Data security posture (sensitive data discovery)	No	Yes

So what do you get with no paid plan at all? Posture. You see what's wrong and how to fix it, scored against MCSB. What you don't get: security alerts and incidents. Those need a workload protection plan.

Defender CSPM bills per resource type (VMs, storage accounts, databases and a few more). Learn keeps the full list and the pricing page has the numbers. I won't quote prices here because they change more often than my lab passwords.

The plans and where you can turn them on

The plans you toggle on Environment settings > your subscription > Defender plans:

Plan	Protects	Where you can turn it on
Defender CSPM	Posture, attack paths, data posture	Subscription (or AWS/GCP connector)
Defender for Servers (Plan 1, Plan 2)	Windows and Linux machines	Subscription. Plan 1 also per machine. Plan 2 can only be turned off per machine. Also at workspace level
Defender for Storage	Blob, Files, Data Lake Storage	Subscription or storage account
Defender for SQL / open-source relational databases	Azure SQL and open-source relational databases	Subscription or resource. SQL servers on machines also at workspace level
Defender for Containers	Kubernetes in Azure, AWS, GCP and on Arc	Subscription (or connector)
Defender for App Service, Key Vault, Resource Manager, APIs, AI services	What the names say	Subscription (Learn lists no resource-level option for these)

Two notes:

Defender for DNS is no longer a separate plan for new subscriptions. Its alerts are part of Defender for Servers Plan 2. Old subscriptions that already had it can keep the standalone plan.
Learn recommends subscription level for Servers. Resource level is for mixing plans or excluding machines, not for saving money by picking favorites.

Who can do what

Defender for Cloud uses Azure RBAC. Here is Learn's role table, shortened:

Action	Security Reader / Reader	Security Admin	Contributor (sub)	Owner (sub)
View alerts and recommendations	✔	✔	✔	✔
Enable or disable Defender plans	-	✔	✔	✔
Edit security policy	-	✔	-	✔
Add or assign initiatives (incl. compliance standards)	-	✔	-	✔
Exempt recommendations	-	✔	-	✔
Dismiss alerts	-	✔	✔	✔
Apply a recommendation with Fix	-	-	✔	✔

The fine print that bites:

Security Admin, Contributor and Owner can all toggle plans, but Learn says Owner is needed to enable all capabilities of a plan. Example: if someone below Owner enables Defender CSPM, agentless scanning isn't turned on, and attack path analysis stays empty of vulnerabilities.
Security Admin can't use Fix. Contributor can, but can't edit policy. Nobody gets everything except Owner. That's the point.

How to enable plans, one or a hundred

Scale	How
One subscription	Portal: Environment settings > subscription > Defender plans, toggle, Save. Or `az security pricing create -n VirtualMachines --tier standard --subplan P1`
One machine (Servers Plan 1)	REST: `PUT` on the VM's `Microsoft.Security/pricings/virtualMachines` with `pricingTier: Standard` and `subPlan: P1`
Machines by tag	Built-in policy in the Security Center - Granular Pricing category, or Microsoft's PowerShell script
All subscriptions in a management group	Policy Enable Microsoft Defender for Cloud on your subscription, assigned at management group scope, with a remediation task. Its `pricingTier` parameter defaults to `free`; change it to turn on plans
Storage everywhere	Learn recommends the built-in Azure Policy for Defender for Storage

In the API and in policies, standard means a plan is on and free means it's off. Useful when you read JSON at 11 pm.

Secure score and recommendations

Recommendations come from the security standards assigned to your scope. MCSB is assigned by default. The secure score turns them into one number: higher score, lower risk.

What counts:

Only built-in MCSB recommendations affect the score. Preview recommendations don't.
Recommendations are grouped into security controls. You only get a control's points when all its recommendations are fixed on all resources. Fixing half of "Secure management ports" gives you exactly nothing. Sorry.
Controls are recalculated every eight hours, so the score lags behind the recommendation list.
There are now two secure scores: the classic one in the Azure portal, and the risk-based Cloud Secure Score in the Defender portal. Different math, different numbers. Don't compare them in a meeting.

Regulatory compliance basics

Standards are Azure Policy initiatives. MCSB is on by default (plus AWS and GCP defaults for those clouds).
Other standards (ISO 27001, NIST, PCI DSS, CIS and many more) need a paid plan. Learn's assignment page says any plan except Defender for Servers Plan 1 or Defender for APIs Plan 1. The CSPM comparison lists regulatory compliance assessments under Defender CSPM.
Assigning a standard happens in the Azure portal. The Defender portal only shows progress.
A standard with no relevant resources doesn't show up on the dashboard, even when it's assigned.
Controls that can't be checked automatically show as greyed out. Green on the dashboard is not a certificate. An auditor still wants to talk to you.

Build

You do all of this as Owner on sub-lab-prod, unless a step says otherwise.

Step 1. See what you have for free

In the Azure portal, open Microsoft Defender for Cloud.
Go to Environment settings > sub-lab-prod > Defender plans.
You should see Foundational CSPM included and the paid plans Off (if nobody touched this subscription before).

Same view from Cloud Shell:

az security pricing list --subscription sub-lab-prod -o table

Every plan with tier Free is off.

Step 2. Give two test users two different roles

In sub-lab-prod > Access control (IAM):

lab-reader@contoso.com gets Security Reader.
lab-secadmin@contoso.com gets Security Admin.

We'll use them in Break it.

Step 3. Turn on Defender for Servers Plan 1 for one VM only

Leave Servers Off at subscription level. Then turn on Plan 1 for vm-lab-01 with the Pricings REST API (from any REST client):

PUT https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/rg-lab-mdc/providers/Microsoft.Compute/virtualMachines/vm-lab-01/providers/Microsoft.Security/pricings/virtualMachines?api-version=2024-01-01

{
  "properties": {
    "pricingTier": "Standard",
    "subPlan": "P1"
  }
}

Only that VM is now covered. The subscription-level toggle still says Off.

Step 4. Set up continuous export

Environment settings > sub-lab-prod > Continuous export, tab Log Analytics workspace.
Data types: Security recommendations and Secure score.
Frequency: Streaming.
Target: law-lab-mdc.
When the page asks where to save the configuration, pick a new resource group: rg-lab-mdc-export. Remember this. It's mock case 1.
Save.

Verify

Plans. Open the coverage workbook (Defender for Cloud > Workbooks). It shows which plans are on per subscription and per resource. You should see vm-lab-01 with Servers Plan 1 while the subscription shows Servers off.
Recommendations. Open Recommendations. Within minutes to hours you should see items for vm-lab-01 and stlabmdc01.
Secure score. Check the tile on Overview, or run this in Azure Resource Graph Explorer:

   SecurityResources
   | where type == 'microsoft.security/securescores'
   | extend current = properties.score.current, max = todouble(properties.score.max)
   | project subscriptionId, current, max, percentage = ((current / max)*100)

A brand-new subscription may need a few rounds of the eight-hour cycle before the number settles.

Compliance. Regulatory compliance should show MCSB only.
Export. In Cloud Shell:

   az security automation list -g rg-lab-mdc-export -o table

You should see one automation. In law-lab-mdc, rows land in SecurityRecommendation. Streaming only sends data when a health state changes, so a quiet lab means a quiet table.

Break it

Three small breaks, all on purpose.

Break 1. The reader wants to help. Sign in as lab-reader@contoso.com and open Environment settings > sub-lab-prod > Defender plans. Try to switch Defender CSPM to On. Security Reader is read-only, so this shouldn't save.

Break 2. The admin wants ISO 27001. Sign in as lab-secadmin@contoso.com. Open Regulatory compliance > Manage compliance policies > sub-lab-prod > Security policies and look for ISO IEC 27001:2022. With only Foundational CSPM and one VM on Servers Plan 1, the subscription doesn't meet the plan requirement for extra standards. Note what the portal shows you here. That's mock case 2.

Break 3. Plan 2 for one VM. Change the body from Step 3 to "subPlan": "P2" and send it again. Learn is clear: Plan 2 can't be enabled at resource level, only disabled. Don't expect this to work.

Fix

Fix 1. Plans are changed by Security Admin, Contributor (subscription) or Owner. Give the reader a role that fits the job, or let the admin do it. Don't hand out Owner because someone asked nicely.

Fix 2. Two things must be true:

A qualifying plan is on. As Owner, turn on Defender CSPM for sub-lab-prod (Owner, so agentless scanning gets switched on too). Any paid plan except Servers Plan 1 or APIs Plan 1 meets Learn's prerequisite.
The person adding the standard has Owner or Policy Contributor (Learn's assignment page). The role table also lists Security Admin for adding initiatives. If the toggle still won't move, check the role at the exact scope you picked.

Then turn ISO IEC 27001:2022 On. It appears on the dashboard once there are relevant resources to assess.

Fix 3. If you want Plan 2, enable it at subscription level. If some machines should stay on Plan 1, downgrade them per machine with "subPlan": "P1". If some shouldn't be covered at all, set them to "pricingTier": "Free".

Clean up

Paid plans keep billing after the trial. Clean up the same day.

Environment settings > sub-lab-prod > Defender plans: switch off Defender CSPM, Servers and anything else you enabled. The plan's extensions aren't uninstalled, but they stop collecting data after a while.
If you ever enabled Servers Plan 2 on a Log Analytics workspace, switch it off there too. It doesn't follow the subscription.
Remove the per-VM setting for vm-lab-01 with a DELETE on the same pricing URL from Step 3.
Delete the export: az security automation delete -g rg-lab-mdc-export -n <automation name>, or remove it on the Continuous export page.
Switch off any compliance standards you added.
Remove the role assignments and the two test users.
Delete rg-lab-mdc, rg-lab-mdc-export and law-lab-mdc if they were only for this lab.

Mock case: three puzzles from my notes

Same lab, same Contoso, three questions I had written down with no answers. Here they are, with the answers from Learn.

Puzzle 1. "Why does continuous export want a resource group? Export isn't a resource."

The setup. You configure continuous export for sub-lab-prod, and the page asks you for a resource group. A colleague asks what gets deployed there. Nobody remembers creating anything.

The answer. Export is a resource. The configuration is saved as a security automation: resource type Microsoft.Security/automations. Its REST path lives under /subscriptions/{id}/resourceGroups/{rg}/providers/Microsoft.Security/automations/{name}. That's why it needs a resource group. The Azure Policy version of continuous export asks for the same thing: resource group name and location.

How to find it.

az security automation list -o table                    # all automations in the subscription
az security automation list -g rg-lab-mdc-export -o table
az security automation show -g rg-lab-mdc-export -n <automation name>

The output shows the scopes (what is exported), the sources (alerts, assessments, secure score) and the actions (which workspace or event hub).

What to remember.

Delete the resource group, and you delete the export with it. Put it somewhere boring and permanent, not in a test group someone cleans up on Fridays.
The portal handles one export configuration per subscription, at subscription scope. The API can create several, and can scope one to a resource group. If someone did that, the portal shows a banner saying other configurations exist.
The person setting it up needs Security Admin or Owner on that resource group, plus write access to the target.

Puzzle 2. "Why can't I add a regulatory compliance standard?"

The setup. lab-secadmin@contoso.com opens Manage compliance policies to add ISO 27001 and can't. The subscription runs Foundational CSPM plus Defender for Servers Plan 1 on one VM.

The answer. Two gates, and both must open:

Gate	Requirement (Learn)	In our lab
Plan	Any Defender for Cloud plan except Defender for Servers Plan 1 or Defender for APIs Plan 1	Only Servers Plan 1. Gate closed
Role	Owner or Policy Contributor to add a standard (the role table also lists Security Admin for adding initiatives)	Check the role at the exact scope

The fix. Turn on a qualifying plan (Defender CSPM is the natural one for compliance), then add the standard with the right role. That's what we did in Fix 2.

Two look-alikes that are not this problem:

A standard is assigned but missing from the dashboard: there are no relevant resources for it in that scope.
Some controls inside a standard are greyed out: they can't be assessed automatically. That's expected, not broken.

Puzzle 3. "A third-party EDR is installed, but 'Endpoint protection should be installed on your machines' stays unhealthy"

The setup. vm-lab-01 runs a third-party EDR. Someone's old runbook says to check Endpoint protection should be installed on your machines. It looks unhealthy, and the security team insists the EDR is fine.

The answer. That recommendation is retired. Learn lists Endpoint protection should be installed on machines and Endpoint protection health issues on machines should be resolved as deprecated. They relied on the Log Analytics agent (MMA), and MMA-based scanning was deprecated in November 2024. If an old runbook, a saved query or a dashboard still points at them, you're looking at a ghost.

Today the check is agentless, and the recommendations are:

EDR solution should be installed on Virtual Machines (plus versions for EC2 and GCP)
EDR configuration issues should be resolved on virtual machines (Defender for Endpoint settings)

What to check, in order:

Plan. The agentless EDR check needs Defender for Servers Plan 2 or Defender CSPM. Our VM has Servers Plan 1 only, so the new check doesn't run there. That alone explains a lot.
Agentless scanning. It must be on. It's on by default in both plans, but remember Owner: if someone below Owner enabled Defender CSPM, the scanner may be off.
Supported product. Learn has a short list of supported non-Microsoft EDRs, and some only count on certain platforms or install methods. If yours isn't on the list, Defender for Cloud can't see it, no matter how healthy it is.
Where the machine lives. Azure, AWS and GCP machines are supported. On-premises servers aren't, for these agentless recommendations.
What it found. Open the recommendation, tab Healthy resources, column Discovered EDRs. If your EDR shows up there, you're done.
Patience. After a change it can take up to 24 hours for the machine to move to Healthy.

If the EDR is real but not detected: exempt the machine with category Resolved through third-party service (mitigated). Mitigated exemptions count as healthy. For these EDR assessments, Learn says the Azure CSPM initiative must be assigned (it's on by default with Defender CSPM), and exemptions in general need MCSB assigned.

Careful with Fix. The Enable Microsoft Defender for Endpoint integration action only appears when no supported third-party EDR is detected, and it installs the Defender for Endpoint sensor on all Windows and Linux servers in the subscription. Running two EDR products on one server is a conversation you want to have before, not after.

Gotchas

Free isn't nothing. Foundational CSPM gives you recommendations, secure score and MCSB at no cost. It doesn't give you alerts.
Owner matters. Security Admin can turn on Defender CSPM, but agentless scanning only comes with it when an Owner does it.
Plan 2 is all or nothing per subscription. You can switch it off per machine, but not on.
Workspace plans don't follow the subscription. Servers Plan 2 enabled on a workspace must be switched off on the workspace.
Trials don't pause. A 30-day trial starts when you enable a plan. Storage malware scanning isn't included in the free trial at all.
Two secure scores. Azure portal classic score and Defender portal Cloud Secure Score use different math.
Export lives in a resource group. Delete the group, lose the export.
Old recommendation names. Anything that says "Endpoint protection should be installed" is from the MMA era.

Checklist

[ ] Know which plans are on: az security pricing list and the coverage workbook
[ ] Resource-level settings documented (Servers Plan 1 per machine, Storage, SQL)
[ ] Roles reviewed: Security Reader to look, Security Admin for policy and plans, Owner only where needed
[ ] Defender CSPM enabled by an Owner if you need agentless scanning
[ ] Secure score checked after at least one eight-hour cycle
[ ] Extra compliance standards backed by a qualifying plan and added by the right role
[ ] Continuous export: automation found in its resource group, data arriving in SecurityRecommendation
[ ] EDR checked with the new agentless recommendation, Discovered EDRs column reviewed
[ ] Lab plans, per-VM settings, export, standards and role assignments cleaned up

Which Defender for Cloud toggle surprised you the most when the bill arrived? Mine would have been a workspace-level plan I forgot existed.

Sources

Top comments (1)

Yoshiyuku • Oct 22

Nice lab, and the deprecated EDR recommendation puzzle is a trap I’ve seen people lose hours on. Good call spelling out that the old MMA-era check is a ghost.

One related gap worth knowing: posture and agentless scanning tell you what’s installed and which known CVEs apply, but they say nothing about what a compiled in-house or vendor program actually does. That includes undocumented network calls, how it handles credentials, and whether it bundles its own crypto or certificate store. For legacy Windows workloads, that blind spot is often bigger than the config toggles.

I do reverse engineering on Windows software (10 years), including behavior and logic analysis written up as a spec, so I’d be glad to compare notes if anyone here has that problem.

DEV Community