Aug. 7, 2026
Microsoft Defender for Cloud - Simply Explained
Microsoft Defender for Cloud can sound like another antivirus product because of the Defender name. In reality, its scope is much broader. Instead of focusing on a single laptop or server, Defender for Cloud helps organizations understand and improve the security of their entire cloud environment. It shows how securely resources are configured, identifies suspicious activity, and helps teams prioritize what should be fixed first.
ㅤ
ㅤ
WHY CLOUD SECURITY GETS COMPLICATED
Modern cloud environments change constantly. Virtual machines, databases, storage accounts, containers, and other services can be created within minutes, often by different teams. A temporary test server might remain online with RDP or SSH exposed to the internet. Storage could accidentally allow public access, or an old administrator account might retain permissions long after it is needed. The challenge becomes even larger when organizations operate across Azure, AWS, Google Cloud, and on-premises infrastructure. Defender for Cloud provides security context across these connected environments rather than forcing security teams to investigate every resource individually.
ㅤ
ㅤ
CLOUD SECURITY POSTURE MANAGEMENT
One of the main building blocks is Cloud Security Posture Management, or CSPM. Think of CSPM as a continuous security inspection of your cloud environment. Defender for Cloud evaluates configurations and looks for weaknesses such as excessive permissions, missing encryption, insecure network rules, and resources that don't comply with organizational policies. Because cloud infrastructure changes continuously, these assessments continue as resources are created and modified. A central concept is Secure Score. It provides an overview of how many recommended security controls have been implemented and where improvements remain. The objective isn't simply to achieve a perfect number. The recommendations behind the score identify specific resources and actions that can reduce risk.
ㅤ
ㅤ
ATTACK PATHS AND RISK PRIORITIZATION
Not every security finding represents the same level of risk. Defender for Cloud can identify attack paths: possible routes through which an attacker could move from an exposed resource toward sensitive systems or data. For example, a publicly accessible resource might connect to an identity with extensive permissions, which in turn could access a sensitive database. Individually, each configuration might appear manageable. Together, they can create a significant attack path. Defender for Cloud can also identify choke points, where fixing one weakness can eliminate several potential attack paths simultaneously.
ㅤ
ㅤ
WORKLOAD PROTECTION
Security posture focuses primarily on configuration. Workload protection focuses on what is actually running. Defender for Cloud provides different Defender plans depending on the workload, including protection for servers, storage, containers, and databases. Instead of applying one generic security mechanism everywhere, organizations can select protection according to the importance and exposure of each workload. For servers, Defender for Cloud can identify software vulnerabilities, missing updates, and other security weaknesses. Microsoft Defender for Endpoint can complement this by monitoring processes, files, and suspicious behavior inside the operating system. Together, the two products provide both workload-level and cloud-level security context.
ㅤ
ㅤ
JUST-IN-TIME SERVER ACCESS
Leaving RDP or SSH management ports permanently accessible creates unnecessary exposure. Just-in-time access provides another approach. Management access can remain closed until an administrator actually needs it. Access is temporarily enabled for an approved period before being closed again automatically. This reduces the amount of time that administrative interfaces are exposed.
ㅤ
ㅤ
PROTECTING STORAGE, CONTAINERS AND DATABASES
Different workloads require different security controls. Defender for Storage can scan uploaded files for malware and detect suspicious access patterns. Container protection focuses on container images, configurations, and runtime behavior, while database protection can identify suspicious queries, login behavior, and data-related threats. The goal isn't to run the same security scan against everything. It's to provide protection appropriate to each workload.
ㅤ
ㅤ
MULTICLOUD AND HYBRID SECURITY
Most enterprises no longer operate exclusively in one environment. Defender for Cloud can bring connected Azure, AWS, Google Cloud Platform, and on-premises resources into a common security view. Asset inventory becomes particularly important here. Organizations need to know what resources exist, where they are located, and whether the expected security coverage is actually enabled. A dashboard cannot protect resources that were never connected or onboarded. Coverage therefore needs to be verified rather than assumed. Forgotten Azure subscriptions, AWS accounts, GCP projects, or older on-premises servers can otherwise become security blind spots.
ㅤ
ㅤ
CONTINUOUS COMPLIANCE
Defender for Cloud can continuously evaluate resources against security and compliance standards. Examples include CIS, NIST, ISO 27001, HIPAA, PCI DSS, and the Microsoft Cloud Security Benchmark. Instead of relying entirely on screenshots and spreadsheets collected shortly before an audit, teams can review current control status and identify the resources responsible for failed checks. Compliance should not be confused with complete security. Passing defined controls doesn't eliminate vulnerabilities, stolen credentials, or new attack techniques. Compliance provides a structured way to measure requirements, identify gaps, and demonstrate progress.
ㅤ
ㅤ
HOW TO GET STARTED WITH DEFENDER FOR CLOUD
A practical implementation starts with understanding what you actually operate. Map your Azure subscriptions, servers, storage accounts, databases, containers, AWS and GCP workloads, and relevant on-premises systems. Then verify coverage before attempting to solve hundreds of recommendations. Start with posture management and review Secure Score and high-risk findings. Prioritize issues such as public exposure, weak identity controls, open management ports, and missing patches. After that, enable workload protection based on business importance and risk rather than simply switching everything on. Assign owners to findings and establish a recurring review process so recommendations turn into actual remediation work.
ㅤ
ㅤ
THE KEY TAKEAWAY
Microsoft Defender for Cloud combines cloud security posture management, workload protection, attack-path analysis, multicloud visibility, asset coverage, and compliance monitoring. The objective isn't to chase a perfect security score. It's to understand where your most important risks exist and systematically remove the easiest paths attackers could use. A good first step is simple: connect one Azure subscription, verify which resources appear in the coverage view, identify the most exposed resource, and assign someone to remediate it.
Become a supporter of this podcast: https://www.spreaker.com/podcast/m365-fm-modern-work-security-and-productivity-with-microsoft-365--6704921/support.
🚀 Want to be part of m365.fm?
Then stop just listening… and start showing up.
👉 Connect with me on LinkedIn and let’s make something happen:
- 🎙️ Be a podcast guest and share your story
- 🎧 Host your own episode (yes, seriously)
- 💡 Pitch topics the community actually wants to hear
- 🌍 Build your personal brand in the Microsoft 365 space
This isn’t just a podcast — it’s a platform for people who take action.
🔥 Most people wait. The best ones don’t.
👉 Connect with me on LinkedIn and send me a message:
"I want in"
Let’s build something awesome 👊
1
00:00:00,000 --> 00:00:04,560
Hello everyone and welcome to another episode of Microsoft Knowledge Nuggets here on M365,
2
00:00:04,560 --> 00:00:06,840
FM, I'm Mirko Peters.
3
00:00:06,840 --> 00:00:10,320
So Microsoft Defender for Cloud sounds like antivirus, right?
4
00:00:10,320 --> 00:00:14,460
That's a fair guess because the Defender name shows up on a lot of Microsoft security tools.
5
00:00:14,460 --> 00:00:18,360
But here's the thing, Defender for Cloud isn't there to scan your laptop for a bad file
6
00:00:18,360 --> 00:00:20,040
that watches your whole cloud setup.
7
00:00:20,040 --> 00:00:24,600
Think of it this way, Defender for Endpoint keeps security inside a single room.
8
00:00:24,600 --> 00:00:29,320
It watches one laptop or server for malware, strange programs, or signs someone is trying
9
00:00:29,320 --> 00:00:30,320
to take control.
10
00:00:30,320 --> 00:00:33,520
Defender for Cloud watches the entire office building around that room.
11
00:00:33,520 --> 00:00:37,600
It checks who can enter, it checks whether a side door faces the street, it looks at the
12
00:00:37,600 --> 00:00:42,640
locks, the alarms, the storage rooms, and the rules that decide who can reach sensitive
13
00:00:42,640 --> 00:00:43,640
areas.
14
00:00:43,640 --> 00:00:45,280
In plain English it helps you see three things.
15
00:00:45,280 --> 00:00:49,200
How safely your cloud resources are set up, whether something suspicious is happening,
16
00:00:49,200 --> 00:00:50,400
and what you should fix first.
17
00:00:50,400 --> 00:00:54,240
A warning might tell you a door is unlocked, an active threat alert tells you somebody may
18
00:00:54,240 --> 00:00:56,120
already be trying that door.
19
00:00:56,120 --> 00:00:57,120
That difference matters.
20
00:00:57,120 --> 00:01:00,640
Let's start with why cloud security becomes messy so quickly.
21
00:01:00,640 --> 00:01:02,800
Why cloud security breaks down so easily?
22
00:01:02,800 --> 00:01:08,320
Years ago, a company might have had a small server room, a few physical servers, and one
23
00:01:08,320 --> 00:01:10,160
team looking after most of it.
24
00:01:10,160 --> 00:01:11,440
The setup moved slowly.
25
00:01:11,440 --> 00:01:14,160
Today, a company can create a new virtual machine in minutes.
26
00:01:14,160 --> 00:01:18,000
A developer can add storage for a project, another team can create a database, someone else
27
00:01:18,000 --> 00:01:19,800
can run containers for an app.
28
00:01:19,800 --> 00:01:23,000
Each part may have its own team and its own security tool.
29
00:01:23,000 --> 00:01:27,320
You might have one tool for servers, another for databases, another for storage, and another
30
00:01:27,320 --> 00:01:28,320
for containers.
31
00:01:28,320 --> 00:01:31,640
Each tool shows part of the picture, but nobody sees the full building.
32
00:01:31,640 --> 00:01:32,640
That creates gaps.
33
00:01:32,640 --> 00:01:35,480
A storage account might allow public access by mistake.
34
00:01:35,480 --> 00:01:39,960
A virtual machine might leave remote desktop protocol RDP open to the internet.
35
00:01:39,960 --> 00:01:43,960
On Linux, it could be secure shell or SSH, an old admin account might still have access
36
00:01:43,960 --> 00:01:46,080
months after a contractor leaves.
37
00:01:46,080 --> 00:01:48,880
A server might miss security updates because it only ran as a short test.
38
00:01:48,880 --> 00:01:50,760
None of these mistakes need a clever attacker.
39
00:01:50,760 --> 00:01:52,680
They only need one unlock side door.
40
00:01:52,680 --> 00:01:54,440
The cloud environments change all the time.
41
00:01:54,440 --> 00:01:58,880
A resource that looked safe on Monday can become exposed on Tuesday because somebody changes
42
00:01:58,880 --> 00:02:03,920
one setting, creates a new network rule, or copies an old template with weak permissions,
43
00:02:03,920 --> 00:02:04,920
still inside.
44
00:02:04,920 --> 00:02:06,400
You've probably seen this in real life.
45
00:02:06,400 --> 00:02:08,400
A team needs a quick test server.
46
00:02:08,400 --> 00:02:11,920
They create a virtual machine, give it a public address so they can connect from home and
47
00:02:11,920 --> 00:02:14,360
open RDP or SSH because it's faster.
48
00:02:14,360 --> 00:02:15,360
The test works.
49
00:02:15,360 --> 00:02:18,880
Then the project ends, people move on, and that server stays online.
50
00:02:18,880 --> 00:02:20,200
It's public door remains open.
51
00:02:20,200 --> 00:02:22,640
Nobody means for that to happen, but it happens because cloud resources are easy to
52
00:02:22,640 --> 00:02:24,520
create and easy to forget.
53
00:02:24,520 --> 00:02:26,680
Now add the way many companies really work.
54
00:02:26,680 --> 00:02:28,480
You may have workloads in Azure.
55
00:02:28,480 --> 00:02:31,240
You may still run servers in your own office or data center.
56
00:02:31,240 --> 00:02:34,120
A supplier may use Amazon Web Services or AWS.
57
00:02:34,120 --> 00:02:36,240
Another team might use Google Cloud Platform.
58
00:02:36,240 --> 00:02:38,280
Security doesn't stay in one portal anymore.
59
00:02:38,280 --> 00:02:40,760
A long list of alerts doesn't solve that problem either.
60
00:02:40,760 --> 00:02:44,520
If you see hundreds of warnings without knowing which one exposes customer data, which
61
00:02:44,520 --> 00:02:48,760
one affects a test system, and which one creates a route towards something sensitive, you
62
00:02:48,760 --> 00:02:50,200
still don't know where to begin.
63
00:02:50,200 --> 00:02:51,200
You need context.
64
00:02:51,200 --> 00:02:55,080
You need to know what exists, what faces the internet, who can access it and which fix
65
00:02:55,080 --> 00:02:56,400
removes the most risk.
66
00:02:56,400 --> 00:02:57,800
That's where Defender for Cloud starts.
67
00:02:57,800 --> 00:03:00,880
It looks for the weak doors before somebody gets inside.
68
00:03:00,880 --> 00:03:02,560
Cloud security posture management.
69
00:03:02,560 --> 00:03:05,280
The first building block is Cloud security posture management.
70
00:03:05,280 --> 00:03:08,280
That name sounds heavy, so let me put it in plain English.
71
00:03:08,280 --> 00:03:11,080
It's a regular safety inspection for your cloud resources.
72
00:03:11,080 --> 00:03:14,200
Instead of walking around a real building with a clipboard, Defender for Cloud checks
73
00:03:14,200 --> 00:03:16,360
the settings around your cloud services.
74
00:03:16,360 --> 00:03:20,080
It looks for things that could leave a resource exposed, a weak network rule, missing
75
00:03:20,080 --> 00:03:25,160
encryption, too much access, or a setting that no longer matches your company's rules.
76
00:03:25,160 --> 00:03:27,800
And these checks keep running as your environment changes.
77
00:03:27,800 --> 00:03:31,040
That matters because Cloud security isn't something you set once and forget.
78
00:03:31,040 --> 00:03:34,080
A resource can be created, changed, copied, or moved at any time.
79
00:03:34,080 --> 00:03:38,160
Defender for Cloud keeps checking the current setup rather than relying on a review someone
80
00:03:38,160 --> 00:03:39,160
completed months ago.
81
00:03:39,160 --> 00:03:41,320
You'll often see something called Secure Score.
82
00:03:41,320 --> 00:03:43,880
Think of it like an inspection score for a large office site.
83
00:03:43,880 --> 00:03:47,800
It gives you a view of how many recommended safety controls are in place and where work
84
00:03:47,800 --> 00:03:49,840
remains. It isn't a pass or fail test.
85
00:03:49,840 --> 00:03:52,360
A score of 100 doesn't mean no risk exists.
86
00:03:52,360 --> 00:03:55,360
It means the checks included in that score look healthy.
87
00:03:55,360 --> 00:03:57,920
And a lower score doesn't mean your cloud has already been breached.
88
00:03:57,920 --> 00:04:00,880
It means Defender for Cloud found settings that deserve attention.
89
00:04:00,880 --> 00:04:02,160
The score gives you direction.
90
00:04:02,160 --> 00:04:05,520
But more useful than the number itself are the recommendations behind it.
91
00:04:05,520 --> 00:04:09,160
A recommendation tells you what needs attention, which resources face the risk and what
92
00:04:09,160 --> 00:04:10,160
change can reduce it.
93
00:04:10,160 --> 00:04:14,640
You might see that a particular storage account allows access wider than your policy permits.
94
00:04:14,640 --> 00:04:17,840
Or a virtual machine might not have a control your security baseline expects.
95
00:04:17,840 --> 00:04:19,320
You don't need to guess where to look.
96
00:04:19,320 --> 00:04:22,920
The recommendation points to the resource and explains the issue in a way the right team
97
00:04:22,920 --> 00:04:24,040
can act on.
98
00:04:24,040 --> 00:04:26,760
That turns a vague warning into a piece of work with a clear owner.
99
00:04:26,760 --> 00:04:29,120
But not every finding deserves the same response.
100
00:04:29,120 --> 00:04:30,400
Imagine you find two issues.
101
00:04:30,400 --> 00:04:31,760
One affects a small test resource.
102
00:04:31,760 --> 00:04:32,920
No one can reach from outside.
103
00:04:32,920 --> 00:04:37,640
The other affects a public facing resource that can reach customer data or a sensitive system.
104
00:04:37,640 --> 00:04:39,040
You fix the second one first.
105
00:04:39,040 --> 00:04:41,440
That's the thinking behind risk-based priority.
106
00:04:41,440 --> 00:04:44,600
Defender for Cloud tries to help you spend time where a weak setting could lead.
107
00:04:44,600 --> 00:04:48,680
To something more serious rather than treating every warning as equal.
108
00:04:48,680 --> 00:04:51,400
This leads to a term you may see called an attack path.
109
00:04:51,400 --> 00:04:54,560
An attack path is a possible route an attacker could use.
110
00:04:54,560 --> 00:04:57,200
Starting from a weak point and moving towards something important.
111
00:04:57,200 --> 00:04:59,160
Maybe a resource has public access.
112
00:04:59,160 --> 00:05:02,120
Maybe that resource connects to an identity with broad permissions.
113
00:05:02,120 --> 00:05:05,120
Maybe that identity can reach a database holding sensitive information.
114
00:05:05,120 --> 00:05:06,440
Defender for Cloud can show that chain.
115
00:05:06,440 --> 00:05:08,280
It doesn't mean an attacker has used the route.
116
00:05:08,280 --> 00:05:11,880
It means the route exists and you should decide whether to close it before somebody does.
117
00:05:11,880 --> 00:05:12,880
That's a big difference.
118
00:05:12,880 --> 00:05:18,480
Parts help you see why a small setting can matter far beyond the resource where it first appeared.
119
00:05:18,480 --> 00:05:21,400
A public endpoint on its own might look like one minor issue.
120
00:05:21,400 --> 00:05:26,160
Connected to a powerful identity and sensitive data it becomes a much higher priority.
121
00:05:26,160 --> 00:05:29,280
Sometimes several attack paths share the same weak point.
122
00:05:29,280 --> 00:05:30,880
Microsoft calls these choke points.
123
00:05:30,880 --> 00:05:34,520
A choke point is one place where fix can close several possible routes at once.
124
00:05:34,520 --> 00:05:39,480
For example, tightening access on one identity or removing one unnecessary public connection
125
00:05:39,480 --> 00:05:41,520
can reduce risk across multiple resources.
126
00:05:41,520 --> 00:05:42,520
That saves time.
127
00:05:42,520 --> 00:05:46,800
Instead of fixing 10 related symptoms one by one, your security and cloud teams can focus
128
00:05:46,800 --> 00:05:48,240
on the shared cause.
129
00:05:48,240 --> 00:05:50,960
Defender for Cloud also uses policies and compliance checks.
130
00:05:50,960 --> 00:05:54,680
The policy is a rule you apply across your Azure subscriptions and resources.
131
00:05:54,680 --> 00:05:59,200
You might set a rule that storage needs encryption that certain network ports can't remain open,
132
00:05:59,200 --> 00:06:03,320
or that resources need a specific security setting before people use them.
133
00:06:03,320 --> 00:06:04,800
Policies create consistency.
134
00:06:04,800 --> 00:06:08,880
Without them, each team can build resources in its own way and security becomes a manual
135
00:06:08,880 --> 00:06:10,480
check after the fact.
136
00:06:10,480 --> 00:06:15,680
As policies you can check whether resources follow the same rules as they are created and changed.
137
00:06:15,680 --> 00:06:17,040
But there's a common mistake here.
138
00:06:17,040 --> 00:06:21,400
Many teams leave policies in audit only mode and assume those policies will stop risky setups.
139
00:06:21,400 --> 00:06:22,920
Audit mode only reports the issue.
140
00:06:22,920 --> 00:06:26,560
It tells you someone created something outside the rule but it doesn't block the change.
141
00:06:26,560 --> 00:06:31,240
That can be a sensible starting point while you learn what existing resources might break.
142
00:06:31,240 --> 00:06:34,640
Once you understand the impact and fix the older issues, some high risk rules may need
143
00:06:34,640 --> 00:06:35,800
stronger enforcement.
144
00:06:35,800 --> 00:06:39,320
So the goal isn't to chase a perfect score or read every alert in every portal.
145
00:06:39,320 --> 00:06:43,800
To build a clear work list, you see which resources need attention, which risks connect to sensitive
146
00:06:43,800 --> 00:06:47,560
targets and which single fix removes several parts at once.
147
00:06:47,560 --> 00:06:50,960
That gives security teams and cloud teams a shared place to start.
148
00:06:50,960 --> 00:06:56,280
A safer setup reduces the easy opportunities but it can't stop every threat already in motion.
149
00:06:56,280 --> 00:07:00,760
Workload protection, post your management, checks the setup around your cloud services.
150
00:07:00,760 --> 00:07:03,360
Workload protection looks at the things actually running there.
151
00:07:03,360 --> 00:07:05,640
Think about everything your company puts to work in the cloud.
152
00:07:05,640 --> 00:07:09,320
A virtual machine runs an old business app. A database holds customer records, a storage
153
00:07:09,320 --> 00:07:13,600
account keeps uploaded files, containers run parts of a modern app, a web app handles customer
154
00:07:13,600 --> 00:07:14,600
requests.
155
00:07:14,600 --> 00:07:17,840
Those are workloads, Defender for cloud ads protection based on the workload you need to
156
00:07:17,840 --> 00:07:18,840
protect.
157
00:07:18,840 --> 00:07:22,960
It doesn't treat a database, a server and a container as though they all face the same
158
00:07:22,960 --> 00:07:23,960
risks.
159
00:07:23,960 --> 00:07:24,960
That's the point.
160
00:07:24,960 --> 00:07:25,960
It's work happens in two parts.
161
00:07:25,960 --> 00:07:30,600
First, it looks for weak spots before trouble starts, known software weaknesses or missing
162
00:07:30,600 --> 00:07:31,600
security settings.
163
00:07:31,600 --> 00:07:36,200
Then it watches for signs of suspicious activity while the workload runs so it can help you
164
00:07:36,200 --> 00:07:39,120
find a weakness on a server before an attacker finds it.
165
00:07:39,120 --> 00:07:43,440
It can also alert you if activity on that server looks wrong, such as malware signals, unusual
166
00:07:43,440 --> 00:07:46,680
changes, or an attempt to use a known attack method.
167
00:07:46,680 --> 00:07:49,120
Microsoft groups these protections into Defender plans.
168
00:07:49,120 --> 00:07:51,520
You choose plans based on what you run.
169
00:07:51,520 --> 00:07:54,480
If you have virtual machines, you look at Defender for servers.
170
00:07:54,480 --> 00:07:58,200
If your business stores files in Azure Storage, you look at Defender for Storage.
171
00:07:58,200 --> 00:08:02,280
If you run containers or databases, there are plans and checks designed for those workloads.
172
00:08:02,280 --> 00:08:05,800
There isn't one large switch that gives every resource the same protection.
173
00:08:05,800 --> 00:08:08,440
That would create cost and noise where you may not need it.
174
00:08:08,440 --> 00:08:12,920
Instead, you decide which workloads hold important data, support important services, or face
175
00:08:12,920 --> 00:08:15,520
more exposure than turn on the right protection for them.
176
00:08:15,520 --> 00:08:17,040
Let's use a server as an example.
177
00:08:17,040 --> 00:08:21,200
Defender for servers can help find software weaknesses on Windows and Linux servers.
178
00:08:21,200 --> 00:08:24,720
It can report missing updates and show where a known weakness affects a machine.
179
00:08:24,720 --> 00:08:29,100
It can also monitor file changes, which matters when a file or system setting changes in a
180
00:08:29,100 --> 00:08:32,360
way that needs investigation, malware signals matter too.
181
00:08:32,360 --> 00:08:36,200
A server can look healthy from the outside while something harmful runs inside its operating
182
00:08:36,200 --> 00:08:37,200
system.
183
00:08:37,200 --> 00:08:40,200
That's where Defender for Endpoint can connect with Defender for Cloud.
184
00:08:40,200 --> 00:08:42,640
The name sound close, but their jobs are different.
185
00:08:42,640 --> 00:08:44,640
Defender for Endpoint watches the device itself.
186
00:08:44,640 --> 00:08:48,200
It sees activity inside the operating system, processes, files, and behavior on a laptop
187
00:08:48,200 --> 00:08:49,200
or server.
188
00:08:49,200 --> 00:08:52,080
Defender for Cloud looks at the Cloud resource around that device.
189
00:08:52,080 --> 00:08:56,240
It sees the server's cloud setting, its network exposure, the workload protection plan,
190
00:08:56,240 --> 00:08:58,440
and the broader risk connected to that resource.
191
00:08:58,440 --> 00:09:00,520
Together, they give you a fuller picture.
192
00:09:00,520 --> 00:09:04,800
Imagine Defender for Endpoint detects suspicious activity on a virtual machine.
193
00:09:04,800 --> 00:09:08,320
On its own, that alert tells you something may be wrong inside the server.
194
00:09:08,320 --> 00:09:12,400
Defender for Cloud adds context around it, is the virtual machine open to the internet.
195
00:09:12,400 --> 00:09:13,400
Which team owns it?
196
00:09:13,400 --> 00:09:15,360
Does it connect to a sensitive database?
197
00:09:15,360 --> 00:09:17,280
Is there a known weakness on the same machine?
198
00:09:17,280 --> 00:09:21,560
What should the Cloud or Infrastructure team fix while the security team investigates?
199
00:09:21,560 --> 00:09:27,080
It changes the conversation from "We have an alert" to "This server has suspicious activity,
200
00:09:27,080 --> 00:09:30,800
it has public exposure, and this is the person who needs to act."
201
00:09:30,800 --> 00:09:34,080
One practical feature for virtual machines is just in time access.
202
00:09:34,080 --> 00:09:38,040
Many administrators need RDP for Windows servers or SSH for Linux servers.
203
00:09:38,040 --> 00:09:41,480
The risky approach is to leave those management ports open all the time because somebody may
204
00:09:41,480 --> 00:09:42,480
need them later.
205
00:09:42,480 --> 00:09:44,280
Just in time access takes a different approach.
206
00:09:44,280 --> 00:09:48,440
It keeps the management door closed, then opens it for a shorter proof period when an administrator
207
00:09:48,440 --> 00:09:49,680
needs to connect.
208
00:09:49,680 --> 00:09:51,840
After that time expires the door closes again.
209
00:09:51,840 --> 00:09:55,800
You don't leave access available every day just because you might need it next week.
210
00:09:55,800 --> 00:09:57,640
Storage needs its own type of protection.
211
00:09:57,640 --> 00:10:02,840
A storage account may hold documents, backups, reports or files uploaded by customers.
212
00:10:02,840 --> 00:10:07,440
Defender for storage can scan uploaded files for malware and raise alerts around suspicious
213
00:10:07,440 --> 00:10:08,440
access.
214
00:10:08,440 --> 00:10:13,040
It can also help you understand when sensitive data may sit in a place that needs more attention.
215
00:10:13,040 --> 00:10:17,320
That matters because a harmful file in storage may not cause trouble until somebody downloads
216
00:10:17,320 --> 00:10:19,480
it or another service starts processing it.
217
00:10:19,480 --> 00:10:22,640
Containers and databases need different checks again.
218
00:10:22,640 --> 00:10:26,720
Containers often run quickly and in large numbers so their protection focuses on the images,
219
00:10:26,720 --> 00:10:29,720
settings and behavior connected to container workloads.
220
00:10:29,720 --> 00:10:35,840
Databases need attention around suspicious queries, log in activity and data related threats.
221
00:10:35,840 --> 00:10:38,080
The goal isn't to use one generic scan for everything.
222
00:10:38,080 --> 00:10:41,320
It's to apply protection that matches the job each workload performs.
223
00:10:41,320 --> 00:10:45,120
Still, every one of these protections depends on something very basic.
224
00:10:45,120 --> 00:10:48,880
Defender for cloud can only protect and report on resources it can see.
225
00:10:48,880 --> 00:10:53,680
And once you look beyond a single Azure subscription, that becomes a much bigger question.
226
00:10:53,680 --> 00:10:56,880
One view across Azure on premises and other clouds.
227
00:10:56,880 --> 00:10:59,600
Most companies don't keep every workload in one place.
228
00:10:59,600 --> 00:11:04,200
You might run most of your services in Azure while an older server still runs in your office.
229
00:11:04,200 --> 00:11:08,200
A business unit may use Amazon Web Services, often called AWS.
230
00:11:08,200 --> 00:11:12,560
Another team may have services in Google Cloud Platform or GCP that leaves you with separate
231
00:11:12,560 --> 00:11:15,560
portal, separate lists and separate ways to find problems.
232
00:11:15,560 --> 00:11:18,760
It's like having three different security guards who don't talk to each other.
233
00:11:18,760 --> 00:11:22,880
Defender for cloud can bring connected Azure on premises, AWS and GCP environments into
234
00:11:22,880 --> 00:11:23,920
one security view.
235
00:11:23,920 --> 00:11:25,240
The aim is simple.
236
00:11:25,240 --> 00:11:29,800
Instead of opening one dashboard to check Azure virtual machines, another for AWS accounts,
237
00:11:29,800 --> 00:11:33,440
and a third system for servers in your own building, you can view the security state of
238
00:11:33,440 --> 00:11:35,880
those connected environments in one place.
239
00:11:35,880 --> 00:11:38,840
That one view saves you from jumping between screens and losing context.
240
00:11:38,840 --> 00:11:41,840
Now that doesn't mean every cloud works exactly the same way.
241
00:11:41,840 --> 00:11:47,280
Azure, AWS, GCP and on premises systems each have their own services, access rules and
242
00:11:47,280 --> 00:11:48,520
connection methods.
243
00:11:48,520 --> 00:11:52,640
And Defender for cloud can collect security information from the environments you connect,
244
00:11:52,640 --> 00:11:56,480
then show the findings in a common view that reduces the chance of missing context.
245
00:11:56,480 --> 00:12:01,440
For example, an alert on a server means more when you can also see whether that server belongs
246
00:12:01,440 --> 00:12:08,080
to a cloud subscription sits in an AWS account or runs as part of an older on premises service.
247
00:12:08,080 --> 00:12:12,960
The security team can spend less time asking where is this resource and more time deciding
248
00:12:12,960 --> 00:12:14,360
what needs attention.
249
00:12:14,360 --> 00:12:17,680
Before you can protect something, you need to know it exists.
250
00:12:17,680 --> 00:12:19,360
This is where asset inventory matters.
251
00:12:19,360 --> 00:12:23,480
An asset inventory is simply a list of the things your company owns or runs in the cloud.
252
00:12:23,480 --> 00:12:28,320
That can include virtual machines, databases, storage accounts, container clusters and other
253
00:12:28,320 --> 00:12:29,320
services.
254
00:12:29,320 --> 00:12:31,600
It sounds obvious, but cloud resources appear fast.
255
00:12:31,600 --> 00:12:36,400
A project team may create a test environment, a supplier may create resources in another cloud
256
00:12:36,400 --> 00:12:37,400
account.
257
00:12:37,400 --> 00:12:41,480
An old workload may keep running after the person who built it has moved to another role.
258
00:12:41,480 --> 00:12:45,160
If it isn't in your inventory, it can easily fall outside your security work.
259
00:12:45,160 --> 00:12:47,160
Defender for cloud helps you see the resources.
260
00:12:47,160 --> 00:12:51,840
It knows about, along with their security coverage, you can see whether a resource has protection,
261
00:12:51,840 --> 00:12:55,320
has only part of the protection you expect or has no protection at all.
262
00:12:55,320 --> 00:12:56,720
That last group needs attention.
263
00:12:56,720 --> 00:13:01,520
An unprotected resource isn't always unsafe by itself, but if a production database or internet
264
00:13:01,520 --> 00:13:05,600
facing server has no planned coverage, that's a gap you need to understand.
265
00:13:05,600 --> 00:13:09,200
A coverage view turns vague assumptions into a list you can check.
266
00:13:09,200 --> 00:13:10,800
Are all our servers protected?
267
00:13:10,800 --> 00:13:12,600
Becomes a real question with a real answer.
268
00:13:12,600 --> 00:13:14,600
Permissions matter too.
269
00:13:14,600 --> 00:13:19,200
A large company doesn't want every person in the security portal to see and manage every resource.
270
00:13:19,200 --> 00:13:21,920
The infrastructure team may need to work with server findings.
271
00:13:21,920 --> 00:13:24,080
The database team may need to see database findings.
272
00:13:24,080 --> 00:13:29,240
A team responsible for one business area may only need access to that area's cloud resources.
273
00:13:29,240 --> 00:13:31,840
Cloud scopes and permissions help create those boundaries.
274
00:13:31,840 --> 00:13:35,040
Think of a cloud scope as a defined area someone can work with.
275
00:13:35,040 --> 00:13:39,640
You can connect a role to specific environments, subscriptions or resource groups, so people
276
00:13:39,640 --> 00:13:43,400
see what they are responsible for without gaining access to everything else.
277
00:13:43,400 --> 00:13:45,320
That keeps responsibility clear.
278
00:13:45,320 --> 00:13:48,440
The infrastructure team can focus on servers and their related findings.
279
00:13:48,440 --> 00:13:51,840
At the same time, the database team can review database findings and deal with the systems
280
00:13:51,840 --> 00:13:52,840
they own.
281
00:13:52,840 --> 00:13:56,400
Both teams work from the same connected security picture, but neither team needs to manage
282
00:13:56,400 --> 00:13:57,640
the other team's services.
283
00:13:57,640 --> 00:13:59,800
There is one limit you should always remember.
284
00:13:59,800 --> 00:14:03,680
Defender for cloud can only report on environments that you have connected and unborted.
285
00:14:03,680 --> 00:14:07,040
If an Azure subscription isn't included, it can become a blind spot.
286
00:14:07,040 --> 00:14:10,880
If an AWS account has not been connected, Defender for cloud can't report on the resources
287
00:14:10,880 --> 00:14:11,880
inside it.
288
00:14:11,880 --> 00:14:16,840
The same applies to GCP and on-premises servers that haven't been brought into the service.
289
00:14:16,840 --> 00:14:19,000
No dashboard can show what it doesn't know about.
290
00:14:19,000 --> 00:14:21,080
Incomplete onboarding causes a common problem.
291
00:14:21,080 --> 00:14:24,880
A company sees a need security dashboard assumes it covers the whole business and later finds
292
00:14:24,880 --> 00:14:28,600
a forgotten subscription or separate cloud account that never appeared in the view.
293
00:14:28,600 --> 00:14:31,520
So review your coverage before you trust the results.
294
00:14:31,520 --> 00:14:32,920
Ask which subscriptions exist.
295
00:14:32,920 --> 00:14:35,400
Ask who owns AWS and GCP accounts.
296
00:14:35,400 --> 00:14:37,480
Ask whether older servers are still in use.
297
00:14:37,480 --> 00:14:40,840
Then compare that list with what Defender for cloud can actually see.
298
00:14:40,840 --> 00:14:44,320
Once the view is connected, compliance becomes much more useful than a spreadsheet full of
299
00:14:44,320 --> 00:14:45,640
old checks.
300
00:14:45,640 --> 00:14:47,960
Compliance without the spreadsheet chase.
301
00:14:47,960 --> 00:14:51,240
Compliance means checking whether your cloud settings meet rules your company has agreed to
302
00:14:51,240 --> 00:14:52,240
follow.
303
00:14:52,240 --> 00:14:56,520
Those rules may come from a customer contract, a legal requirement, an industry standard,
304
00:14:56,520 --> 00:14:58,440
or your own internal security policy.
305
00:14:58,440 --> 00:15:01,800
In the past, this often meant someone collecting screenshots before an audit.
306
00:15:01,800 --> 00:15:06,000
They would ask whether encryption was enabled, whether logging was turned on or whether access
307
00:15:06,000 --> 00:15:07,880
rules matched company policy.
308
00:15:07,880 --> 00:15:12,520
By the time the spreadsheet reached the auditor, parts of the environment may already have changed.
309
00:15:12,520 --> 00:15:14,360
Cloud services don't wait for annual reviews.
310
00:15:14,360 --> 00:15:17,920
Defender for cloud gives you a way to check cloud resources against built in standards on
311
00:15:17,920 --> 00:15:19,080
an ongoing basis.
312
00:15:19,080 --> 00:15:24,800
You may see standards such as CIS, NIST, ISO 27001, HIPAA, PCI DSS, and the Microsoft Cloud
313
00:15:24,800 --> 00:15:26,160
Security benchmark.
314
00:15:26,160 --> 00:15:29,240
You don't need to memorize every standard to understand the basic idea.
315
00:15:29,240 --> 00:15:30,680
Each one contains controls.
316
00:15:30,680 --> 00:15:32,840
A control is a rule or expected safeguard.
317
00:15:32,840 --> 00:15:37,480
It might check whether a setting is enabled, whether access is restricted or whether a
318
00:15:37,480 --> 00:15:40,000
resource follows a required configuration.
319
00:15:40,000 --> 00:15:43,720
The compliance view shows which checks passed, which checks failed, and which resources cause
320
00:15:43,720 --> 00:15:44,800
the failed result.
321
00:15:44,800 --> 00:15:47,120
That makes a large standard easier to work with.
322
00:15:47,120 --> 00:15:51,040
Rather than seeing a line that says control failed, you can look deeper and see the affected
323
00:15:51,040 --> 00:15:52,040
resources.
324
00:15:52,040 --> 00:15:55,200
You can also see suggested repairs tied to the findings, so the person responsible for
325
00:15:55,200 --> 00:15:56,920
the resource has a starting point.
326
00:15:56,920 --> 00:16:00,280
Imagine an auditor asks whether your cloud storage follows a particular rule.
327
00:16:00,280 --> 00:16:05,040
Instead of searching through old notes, you can review the current control status, see
328
00:16:05,040 --> 00:16:08,760
the resources included in the check and identify any open issues.
329
00:16:08,760 --> 00:16:12,280
Your security team gets a work list, your auditor gets evidence based on the environment
330
00:16:12,280 --> 00:16:13,440
as it looks now.
331
00:16:13,440 --> 00:16:15,800
The checks keep updating as resources change.
332
00:16:15,800 --> 00:16:20,080
If someone changes a cloud setting after the last audit, that change can appear in the
333
00:16:20,080 --> 00:16:21,080
compliance view.
334
00:16:21,080 --> 00:16:25,840
This turns compliance from a once a year scramble into a regular part of managing cloud resources.
335
00:16:25,840 --> 00:16:28,240
That saves time, but it also creates accountability.
336
00:16:28,240 --> 00:16:31,480
A failed control shows that a rule needs attention.
337
00:16:31,480 --> 00:16:35,920
The team that owns the affected resource can fix it, document an accepted exception, or explain
338
00:16:35,920 --> 00:16:37,120
why the setting doesn't apply.
339
00:16:37,120 --> 00:16:41,440
The result becomes clearer than a spreadsheet where nobody knows who last updated a cell.
340
00:16:41,440 --> 00:16:45,600
Still, a high compliance score doesn't guarantee safety from every attack.
341
00:16:45,600 --> 00:16:48,080
Compliance checks whether you meet a defined set of rules.
342
00:16:48,080 --> 00:16:49,920
Attackers don't limit themselves to a checklist.
343
00:16:49,920 --> 00:16:54,000
A resource can meet a standard and still face a new software weakness, a stolen password,
344
00:16:54,000 --> 00:16:56,080
or suspicious activity that needs investigation.
345
00:16:56,080 --> 00:17:00,360
So use compliance as a way to check your agreed rules and keep evidence current.
346
00:17:00,360 --> 00:17:03,120
Use it to find gaps, assign work and show progress.
347
00:17:03,120 --> 00:17:06,560
All of this can feel large when you first open the portal, which is why the best next move
348
00:17:06,560 --> 00:17:08,160
is a simple first week plan.
349
00:17:08,160 --> 00:17:10,160
How to start without turning on everything.
350
00:17:10,160 --> 00:17:11,160
So how do you begin?
351
00:17:11,160 --> 00:17:13,960
First, make a simple map of what you actually run.
352
00:17:13,960 --> 00:17:19,000
List your Azure subscriptions, then your servers, storage accounts, databases, container services,
353
00:17:19,000 --> 00:17:22,600
and any workloads in AWS, Google Cloud, or your own data center.
354
00:17:22,600 --> 00:17:23,600
Keep it practical.
355
00:17:23,600 --> 00:17:25,480
You're trying to answer one question.
356
00:17:25,480 --> 00:17:27,880
What needs protection and where does it live?
357
00:17:27,880 --> 00:17:31,760
Once you have that map, connect the environments you want to fend off for Cloud to monitor.
358
00:17:31,760 --> 00:17:35,640
But before you dive into hundreds of recommendations, check the coverage view first.
359
00:17:35,640 --> 00:17:39,000
Findings only help when you know whether the right resources are showing up.
360
00:17:39,000 --> 00:17:40,480
Begin with Posture Management.
361
00:17:40,480 --> 00:17:43,760
Review your secure score, then look at the highest risk findings behind it.
362
00:17:43,760 --> 00:17:45,720
Don't try to clear every warning on day one.
363
00:17:45,720 --> 00:17:49,240
Instead look for problems that keep appearing across your environment.
364
00:17:49,240 --> 00:17:54,280
Public exposure, weak identity controls, open management ports, and missing patches.
365
00:17:54,280 --> 00:17:56,520
Those are often the fastest places to reduce risk.
366
00:17:56,520 --> 00:18:01,120
Next, choose Workload Protection Plans based on the services you really use and the risk they carry.
367
00:18:01,120 --> 00:18:05,040
A production server, holding business data, deserves different attention than a short-lived
368
00:18:05,040 --> 00:18:07,280
test system with no sensitive information.
369
00:18:07,280 --> 00:18:11,800
So turn on protection with a reason for servers that need deeper device level detection,
370
00:18:11,800 --> 00:18:14,240
connect Microsoft Defender for Endpoint.
371
00:18:14,240 --> 00:18:18,400
That gives you a better view of activity inside the operating system, while Defender for Cloud
372
00:18:18,400 --> 00:18:20,960
keeps the Cloud resource and its exposure in view.
373
00:18:20,960 --> 00:18:23,640
Then assign an owner to every finding that needs action.
374
00:18:23,640 --> 00:18:27,280
A recommendation without an owner becomes a reminder that nobody handles.
375
00:18:27,280 --> 00:18:31,920
Your infrastructure team may own server fixes, your app team may own a database setting, and
376
00:18:31,920 --> 00:18:35,760
your security team may track the work and review whether it was completed.
377
00:18:35,760 --> 00:18:37,160
Set a regular review time.
378
00:18:37,160 --> 00:18:40,640
Weekly may suit a busy environment, while monthly may suit a smaller one.
379
00:18:40,640 --> 00:18:43,040
The schedule matters less than making it routine.
380
00:18:43,040 --> 00:18:44,880
You aren't trying to reach a perfect score.
381
00:18:44,880 --> 00:18:48,920
You're removing the easy paths into your Cloud, one clear fix at a time.
382
00:18:48,920 --> 00:18:52,760
Think of Defender for Cloud as a security guard who checks how your Cloud is set up, protects
383
00:18:52,760 --> 00:18:57,280
the important rooms and points your teams towards the risks that deserve attention first.
384
00:18:57,280 --> 00:19:00,440
For a simple challenge, connect one Azure subscription this week.
385
00:19:00,440 --> 00:19:04,560
Check which resources appear in coverage, find the most exposed resource, and assign someone
386
00:19:04,560 --> 00:19:05,560
to fix it.
387
00:19:05,560 --> 00:19:09,000
That gives you a real starting point, not another security dashboard to ignore.
388
00:19:09,000 --> 00:19:13,360
The next, knowledge nugget to explore is Microsoft Defender for Endpoint versus Defender
389
00:19:13,360 --> 00:19:14,520
for Cloud.
390
00:19:14,520 --> 00:19:18,000
One watches what happens on devices, the other watches the Cloud resources around them,
391
00:19:18,000 --> 00:19:20,880
and together they help you see both sides of the same security problem.
00:00:00,000 --> 00:00:04,560
Hello everyone and welcome to another episode of Microsoft Knowledge Nuggets here on M365,
2
00:00:04,560 --> 00:00:06,840
FM, I'm Mirko Peters.
3
00:00:06,840 --> 00:00:10,320
So Microsoft Defender for Cloud sounds like antivirus, right?
4
00:00:10,320 --> 00:00:14,460
That's a fair guess because the Defender name shows up on a lot of Microsoft security tools.
5
00:00:14,460 --> 00:00:18,360
But here's the thing, Defender for Cloud isn't there to scan your laptop for a bad file
6
00:00:18,360 --> 00:00:20,040
that watches your whole cloud setup.
7
00:00:20,040 --> 00:00:24,600
Think of it this way, Defender for Endpoint keeps security inside a single room.
8
00:00:24,600 --> 00:00:29,320
It watches one laptop or server for malware, strange programs, or signs someone is trying
9
00:00:29,320 --> 00:00:30,320
to take control.
10
00:00:30,320 --> 00:00:33,520
Defender for Cloud watches the entire office building around that room.
11
00:00:33,520 --> 00:00:37,600
It checks who can enter, it checks whether a side door faces the street, it looks at the
12
00:00:37,600 --> 00:00:42,640
locks, the alarms, the storage rooms, and the rules that decide who can reach sensitive
13
00:00:42,640 --> 00:00:43,640
areas.
14
00:00:43,640 --> 00:00:45,280
In plain English it helps you see three things.
15
00:00:45,280 --> 00:00:49,200
How safely your cloud resources are set up, whether something suspicious is happening,
16
00:00:49,200 --> 00:00:50,400
and what you should fix first.
17
00:00:50,400 --> 00:00:54,240
A warning might tell you a door is unlocked, an active threat alert tells you somebody may
18
00:00:54,240 --> 00:00:56,120
already be trying that door.
19
00:00:56,120 --> 00:00:57,120
That difference matters.
20
00:00:57,120 --> 00:01:00,640
Let's start with why cloud security becomes messy so quickly.
21
00:01:00,640 --> 00:01:02,800
Why cloud security breaks down so easily?
22
00:01:02,800 --> 00:01:08,320
Years ago, a company might have had a small server room, a few physical servers, and one
23
00:01:08,320 --> 00:01:10,160
team looking after most of it.
24
00:01:10,160 --> 00:01:11,440
The setup moved slowly.
25
00:01:11,440 --> 00:01:14,160
Today, a company can create a new virtual machine in minutes.
26
00:01:14,160 --> 00:01:18,000
A developer can add storage for a project, another team can create a database, someone else
27
00:01:18,000 --> 00:01:19,800
can run containers for an app.
28
00:01:19,800 --> 00:01:23,000
Each part may have its own team and its own security tool.
29
00:01:23,000 --> 00:01:27,320
You might have one tool for servers, another for databases, another for storage, and another
30
00:01:27,320 --> 00:01:28,320
for containers.
31
00:01:28,320 --> 00:01:31,640
Each tool shows part of the picture, but nobody sees the full building.
32
00:01:31,640 --> 00:01:32,640
That creates gaps.
33
00:01:32,640 --> 00:01:35,480
A storage account might allow public access by mistake.
34
00:01:35,480 --> 00:01:39,960
A virtual machine might leave remote desktop protocol RDP open to the internet.
35
00:01:39,960 --> 00:01:43,960
On Linux, it could be secure shell or SSH, an old admin account might still have access
36
00:01:43,960 --> 00:01:46,080
months after a contractor leaves.
37
00:01:46,080 --> 00:01:48,880
A server might miss security updates because it only ran as a short test.
38
00:01:48,880 --> 00:01:50,760
None of these mistakes need a clever attacker.
39
00:01:50,760 --> 00:01:52,680
They only need one unlock side door.
40
00:01:52,680 --> 00:01:54,440
The cloud environments change all the time.
41
00:01:54,440 --> 00:01:58,880
A resource that looked safe on Monday can become exposed on Tuesday because somebody changes
42
00:01:58,880 --> 00:02:03,920
one setting, creates a new network rule, or copies an old template with weak permissions,
43
00:02:03,920 --> 00:02:04,920
still inside.
44
00:02:04,920 --> 00:02:06,400
You've probably seen this in real life.
45
00:02:06,400 --> 00:02:08,400
A team needs a quick test server.
46
00:02:08,400 --> 00:02:11,920
They create a virtual machine, give it a public address so they can connect from home and
47
00:02:11,920 --> 00:02:14,360
open RDP or SSH because it's faster.
48
00:02:14,360 --> 00:02:15,360
The test works.
49
00:02:15,360 --> 00:02:18,880
Then the project ends, people move on, and that server stays online.
50
00:02:18,880 --> 00:02:20,200
It's public door remains open.
51
00:02:20,200 --> 00:02:22,640
Nobody means for that to happen, but it happens because cloud resources are easy to
52
00:02:22,640 --> 00:02:24,520
create and easy to forget.
53
00:02:24,520 --> 00:02:26,680
Now add the way many companies really work.
54
00:02:26,680 --> 00:02:28,480
You may have workloads in Azure.
55
00:02:28,480 --> 00:02:31,240
You may still run servers in your own office or data center.
56
00:02:31,240 --> 00:02:34,120
A supplier may use Amazon Web Services or AWS.
57
00:02:34,120 --> 00:02:36,240
Another team might use Google Cloud Platform.
58
00:02:36,240 --> 00:02:38,280
Security doesn't stay in one portal anymore.
59
00:02:38,280 --> 00:02:40,760
A long list of alerts doesn't solve that problem either.
60
00:02:40,760 --> 00:02:44,520
If you see hundreds of warnings without knowing which one exposes customer data, which
61
00:02:44,520 --> 00:02:48,760
one affects a test system, and which one creates a route towards something sensitive, you
62
00:02:48,760 --> 00:02:50,200
still don't know where to begin.
63
00:02:50,200 --> 00:02:51,200
You need context.
64
00:02:51,200 --> 00:02:55,080
You need to know what exists, what faces the internet, who can access it and which fix
65
00:02:55,080 --> 00:02:56,400
removes the most risk.
66
00:02:56,400 --> 00:02:57,800
That's where Defender for Cloud starts.
67
00:02:57,800 --> 00:03:00,880
It looks for the weak doors before somebody gets inside.
68
00:03:00,880 --> 00:03:02,560
Cloud security posture management.
69
00:03:02,560 --> 00:03:05,280
The first building block is Cloud security posture management.
70
00:03:05,280 --> 00:03:08,280
That name sounds heavy, so let me put it in plain English.
71
00:03:08,280 --> 00:03:11,080
It's a regular safety inspection for your cloud resources.
72
00:03:11,080 --> 00:03:14,200
Instead of walking around a real building with a clipboard, Defender for Cloud checks
73
00:03:14,200 --> 00:03:16,360
the settings around your cloud services.
74
00:03:16,360 --> 00:03:20,080
It looks for things that could leave a resource exposed, a weak network rule, missing
75
00:03:20,080 --> 00:03:25,160
encryption, too much access, or a setting that no longer matches your company's rules.
76
00:03:25,160 --> 00:03:27,800
And these checks keep running as your environment changes.
77
00:03:27,800 --> 00:03:31,040
That matters because Cloud security isn't something you set once and forget.
78
00:03:31,040 --> 00:03:34,080
A resource can be created, changed, copied, or moved at any time.
79
00:03:34,080 --> 00:03:38,160
Defender for Cloud keeps checking the current setup rather than relying on a review someone
80
00:03:38,160 --> 00:03:39,160
completed months ago.
81
00:03:39,160 --> 00:03:41,320
You'll often see something called Secure Score.
82
00:03:41,320 --> 00:03:43,880
Think of it like an inspection score for a large office site.
83
00:03:43,880 --> 00:03:47,800
It gives you a view of how many recommended safety controls are in place and where work
84
00:03:47,800 --> 00:03:49,840
remains. It isn't a pass or fail test.
85
00:03:49,840 --> 00:03:52,360
A score of 100 doesn't mean no risk exists.
86
00:03:52,360 --> 00:03:55,360
It means the checks included in that score look healthy.
87
00:03:55,360 --> 00:03:57,920
And a lower score doesn't mean your cloud has already been breached.
88
00:03:57,920 --> 00:04:00,880
It means Defender for Cloud found settings that deserve attention.
89
00:04:00,880 --> 00:04:02,160
The score gives you direction.
90
00:04:02,160 --> 00:04:05,520
But more useful than the number itself are the recommendations behind it.
91
00:04:05,520 --> 00:04:09,160
A recommendation tells you what needs attention, which resources face the risk and what
92
00:04:09,160 --> 00:04:10,160
change can reduce it.
93
00:04:10,160 --> 00:04:14,640
You might see that a particular storage account allows access wider than your policy permits.
94
00:04:14,640 --> 00:04:17,840
Or a virtual machine might not have a control your security baseline expects.
95
00:04:17,840 --> 00:04:19,320
You don't need to guess where to look.
96
00:04:19,320 --> 00:04:22,920
The recommendation points to the resource and explains the issue in a way the right team
97
00:04:22,920 --> 00:04:24,040
can act on.
98
00:04:24,040 --> 00:04:26,760
That turns a vague warning into a piece of work with a clear owner.
99
00:04:26,760 --> 00:04:29,120
But not every finding deserves the same response.
100
00:04:29,120 --> 00:04:30,400
Imagine you find two issues.
101
00:04:30,400 --> 00:04:31,760
One affects a small test resource.
102
00:04:31,760 --> 00:04:32,920
No one can reach from outside.
103
00:04:32,920 --> 00:04:37,640
The other affects a public facing resource that can reach customer data or a sensitive system.
104
00:04:37,640 --> 00:04:39,040
You fix the second one first.
105
00:04:39,040 --> 00:04:41,440
That's the thinking behind risk-based priority.
106
00:04:41,440 --> 00:04:44,600
Defender for Cloud tries to help you spend time where a weak setting could lead.
107
00:04:44,600 --> 00:04:48,680
To something more serious rather than treating every warning as equal.
108
00:04:48,680 --> 00:04:51,400
This leads to a term you may see called an attack path.
109
00:04:51,400 --> 00:04:54,560
An attack path is a possible route an attacker could use.
110
00:04:54,560 --> 00:04:57,200
Starting from a weak point and moving towards something important.
111
00:04:57,200 --> 00:04:59,160
Maybe a resource has public access.
112
00:04:59,160 --> 00:05:02,120
Maybe that resource connects to an identity with broad permissions.
113
00:05:02,120 --> 00:05:05,120
Maybe that identity can reach a database holding sensitive information.
114
00:05:05,120 --> 00:05:06,440
Defender for Cloud can show that chain.
115
00:05:06,440 --> 00:05:08,280
It doesn't mean an attacker has used the route.
116
00:05:08,280 --> 00:05:11,880
It means the route exists and you should decide whether to close it before somebody does.
117
00:05:11,880 --> 00:05:12,880
That's a big difference.
118
00:05:12,880 --> 00:05:18,480
Parts help you see why a small setting can matter far beyond the resource where it first appeared.
119
00:05:18,480 --> 00:05:21,400
A public endpoint on its own might look like one minor issue.
120
00:05:21,400 --> 00:05:26,160
Connected to a powerful identity and sensitive data it becomes a much higher priority.
121
00:05:26,160 --> 00:05:29,280
Sometimes several attack paths share the same weak point.
122
00:05:29,280 --> 00:05:30,880
Microsoft calls these choke points.
123
00:05:30,880 --> 00:05:34,520
A choke point is one place where fix can close several possible routes at once.
124
00:05:34,520 --> 00:05:39,480
For example, tightening access on one identity or removing one unnecessary public connection
125
00:05:39,480 --> 00:05:41,520
can reduce risk across multiple resources.
126
00:05:41,520 --> 00:05:42,520
That saves time.
127
00:05:42,520 --> 00:05:46,800
Instead of fixing 10 related symptoms one by one, your security and cloud teams can focus
128
00:05:46,800 --> 00:05:48,240
on the shared cause.
129
00:05:48,240 --> 00:05:50,960
Defender for Cloud also uses policies and compliance checks.
130
00:05:50,960 --> 00:05:54,680
The policy is a rule you apply across your Azure subscriptions and resources.
131
00:05:54,680 --> 00:05:59,200
You might set a rule that storage needs encryption that certain network ports can't remain open,
132
00:05:59,200 --> 00:06:03,320
or that resources need a specific security setting before people use them.
133
00:06:03,320 --> 00:06:04,800
Policies create consistency.
134
00:06:04,800 --> 00:06:08,880
Without them, each team can build resources in its own way and security becomes a manual
135
00:06:08,880 --> 00:06:10,480
check after the fact.
136
00:06:10,480 --> 00:06:15,680
As policies you can check whether resources follow the same rules as they are created and changed.
137
00:06:15,680 --> 00:06:17,040
But there's a common mistake here.
138
00:06:17,040 --> 00:06:21,400
Many teams leave policies in audit only mode and assume those policies will stop risky setups.
139
00:06:21,400 --> 00:06:22,920
Audit mode only reports the issue.
140
00:06:22,920 --> 00:06:26,560
It tells you someone created something outside the rule but it doesn't block the change.
141
00:06:26,560 --> 00:06:31,240
That can be a sensible starting point while you learn what existing resources might break.
142
00:06:31,240 --> 00:06:34,640
Once you understand the impact and fix the older issues, some high risk rules may need
143
00:06:34,640 --> 00:06:35,800
stronger enforcement.
144
00:06:35,800 --> 00:06:39,320
So the goal isn't to chase a perfect score or read every alert in every portal.
145
00:06:39,320 --> 00:06:43,800
To build a clear work list, you see which resources need attention, which risks connect to sensitive
146
00:06:43,800 --> 00:06:47,560
targets and which single fix removes several parts at once.
147
00:06:47,560 --> 00:06:50,960
That gives security teams and cloud teams a shared place to start.
148
00:06:50,960 --> 00:06:56,280
A safer setup reduces the easy opportunities but it can't stop every threat already in motion.
149
00:06:56,280 --> 00:07:00,760
Workload protection, post your management, checks the setup around your cloud services.
150
00:07:00,760 --> 00:07:03,360
Workload protection looks at the things actually running there.
151
00:07:03,360 --> 00:07:05,640
Think about everything your company puts to work in the cloud.
152
00:07:05,640 --> 00:07:09,320
A virtual machine runs an old business app. A database holds customer records, a storage
153
00:07:09,320 --> 00:07:13,600
account keeps uploaded files, containers run parts of a modern app, a web app handles customer
154
00:07:13,600 --> 00:07:14,600
requests.
155
00:07:14,600 --> 00:07:17,840
Those are workloads, Defender for cloud ads protection based on the workload you need to
156
00:07:17,840 --> 00:07:18,840
protect.
157
00:07:18,840 --> 00:07:22,960
It doesn't treat a database, a server and a container as though they all face the same
158
00:07:22,960 --> 00:07:23,960
risks.
159
00:07:23,960 --> 00:07:24,960
That's the point.
160
00:07:24,960 --> 00:07:25,960
It's work happens in two parts.
161
00:07:25,960 --> 00:07:30,600
First, it looks for weak spots before trouble starts, known software weaknesses or missing
162
00:07:30,600 --> 00:07:31,600
security settings.
163
00:07:31,600 --> 00:07:36,200
Then it watches for signs of suspicious activity while the workload runs so it can help you
164
00:07:36,200 --> 00:07:39,120
find a weakness on a server before an attacker finds it.
165
00:07:39,120 --> 00:07:43,440
It can also alert you if activity on that server looks wrong, such as malware signals, unusual
166
00:07:43,440 --> 00:07:46,680
changes, or an attempt to use a known attack method.
167
00:07:46,680 --> 00:07:49,120
Microsoft groups these protections into Defender plans.
168
00:07:49,120 --> 00:07:51,520
You choose plans based on what you run.
169
00:07:51,520 --> 00:07:54,480
If you have virtual machines, you look at Defender for servers.
170
00:07:54,480 --> 00:07:58,200
If your business stores files in Azure Storage, you look at Defender for Storage.
171
00:07:58,200 --> 00:08:02,280
If you run containers or databases, there are plans and checks designed for those workloads.
172
00:08:02,280 --> 00:08:05,800
There isn't one large switch that gives every resource the same protection.
173
00:08:05,800 --> 00:08:08,440
That would create cost and noise where you may not need it.
174
00:08:08,440 --> 00:08:12,920
Instead, you decide which workloads hold important data, support important services, or face
175
00:08:12,920 --> 00:08:15,520
more exposure than turn on the right protection for them.
176
00:08:15,520 --> 00:08:17,040
Let's use a server as an example.
177
00:08:17,040 --> 00:08:21,200
Defender for servers can help find software weaknesses on Windows and Linux servers.
178
00:08:21,200 --> 00:08:24,720
It can report missing updates and show where a known weakness affects a machine.
179
00:08:24,720 --> 00:08:29,100
It can also monitor file changes, which matters when a file or system setting changes in a
180
00:08:29,100 --> 00:08:32,360
way that needs investigation, malware signals matter too.
181
00:08:32,360 --> 00:08:36,200
A server can look healthy from the outside while something harmful runs inside its operating
182
00:08:36,200 --> 00:08:37,200
system.
183
00:08:37,200 --> 00:08:40,200
That's where Defender for Endpoint can connect with Defender for Cloud.
184
00:08:40,200 --> 00:08:42,640
The name sound close, but their jobs are different.
185
00:08:42,640 --> 00:08:44,640
Defender for Endpoint watches the device itself.
186
00:08:44,640 --> 00:08:48,200
It sees activity inside the operating system, processes, files, and behavior on a laptop
187
00:08:48,200 --> 00:08:49,200
or server.
188
00:08:49,200 --> 00:08:52,080
Defender for Cloud looks at the Cloud resource around that device.
189
00:08:52,080 --> 00:08:56,240
It sees the server's cloud setting, its network exposure, the workload protection plan,
190
00:08:56,240 --> 00:08:58,440
and the broader risk connected to that resource.
191
00:08:58,440 --> 00:09:00,520
Together, they give you a fuller picture.
192
00:09:00,520 --> 00:09:04,800
Imagine Defender for Endpoint detects suspicious activity on a virtual machine.
193
00:09:04,800 --> 00:09:08,320
On its own, that alert tells you something may be wrong inside the server.
194
00:09:08,320 --> 00:09:12,400
Defender for Cloud adds context around it, is the virtual machine open to the internet.
195
00:09:12,400 --> 00:09:13,400
Which team owns it?
196
00:09:13,400 --> 00:09:15,360
Does it connect to a sensitive database?
197
00:09:15,360 --> 00:09:17,280
Is there a known weakness on the same machine?
198
00:09:17,280 --> 00:09:21,560
What should the Cloud or Infrastructure team fix while the security team investigates?
199
00:09:21,560 --> 00:09:27,080
It changes the conversation from "We have an alert" to "This server has suspicious activity,
200
00:09:27,080 --> 00:09:30,800
it has public exposure, and this is the person who needs to act."
201
00:09:30,800 --> 00:09:34,080
One practical feature for virtual machines is just in time access.
202
00:09:34,080 --> 00:09:38,040
Many administrators need RDP for Windows servers or SSH for Linux servers.
203
00:09:38,040 --> 00:09:41,480
The risky approach is to leave those management ports open all the time because somebody may
204
00:09:41,480 --> 00:09:42,480
need them later.
205
00:09:42,480 --> 00:09:44,280
Just in time access takes a different approach.
206
00:09:44,280 --> 00:09:48,440
It keeps the management door closed, then opens it for a shorter proof period when an administrator
207
00:09:48,440 --> 00:09:49,680
needs to connect.
208
00:09:49,680 --> 00:09:51,840
After that time expires the door closes again.
209
00:09:51,840 --> 00:09:55,800
You don't leave access available every day just because you might need it next week.
210
00:09:55,800 --> 00:09:57,640
Storage needs its own type of protection.
211
00:09:57,640 --> 00:10:02,840
A storage account may hold documents, backups, reports or files uploaded by customers.
212
00:10:02,840 --> 00:10:07,440
Defender for storage can scan uploaded files for malware and raise alerts around suspicious
213
00:10:07,440 --> 00:10:08,440
access.
214
00:10:08,440 --> 00:10:13,040
It can also help you understand when sensitive data may sit in a place that needs more attention.
215
00:10:13,040 --> 00:10:17,320
That matters because a harmful file in storage may not cause trouble until somebody downloads
216
00:10:17,320 --> 00:10:19,480
it or another service starts processing it.
217
00:10:19,480 --> 00:10:22,640
Containers and databases need different checks again.
218
00:10:22,640 --> 00:10:26,720
Containers often run quickly and in large numbers so their protection focuses on the images,
219
00:10:26,720 --> 00:10:29,720
settings and behavior connected to container workloads.
220
00:10:29,720 --> 00:10:35,840
Databases need attention around suspicious queries, log in activity and data related threats.
221
00:10:35,840 --> 00:10:38,080
The goal isn't to use one generic scan for everything.
222
00:10:38,080 --> 00:10:41,320
It's to apply protection that matches the job each workload performs.
223
00:10:41,320 --> 00:10:45,120
Still, every one of these protections depends on something very basic.
224
00:10:45,120 --> 00:10:48,880
Defender for cloud can only protect and report on resources it can see.
225
00:10:48,880 --> 00:10:53,680
And once you look beyond a single Azure subscription, that becomes a much bigger question.
226
00:10:53,680 --> 00:10:56,880
One view across Azure on premises and other clouds.
227
00:10:56,880 --> 00:10:59,600
Most companies don't keep every workload in one place.
228
00:10:59,600 --> 00:11:04,200
You might run most of your services in Azure while an older server still runs in your office.
229
00:11:04,200 --> 00:11:08,200
A business unit may use Amazon Web Services, often called AWS.
230
00:11:08,200 --> 00:11:12,560
Another team may have services in Google Cloud Platform or GCP that leaves you with separate
231
00:11:12,560 --> 00:11:15,560
portal, separate lists and separate ways to find problems.
232
00:11:15,560 --> 00:11:18,760
It's like having three different security guards who don't talk to each other.
233
00:11:18,760 --> 00:11:22,880
Defender for cloud can bring connected Azure on premises, AWS and GCP environments into
234
00:11:22,880 --> 00:11:23,920
one security view.
235
00:11:23,920 --> 00:11:25,240
The aim is simple.
236
00:11:25,240 --> 00:11:29,800
Instead of opening one dashboard to check Azure virtual machines, another for AWS accounts,
237
00:11:29,800 --> 00:11:33,440
and a third system for servers in your own building, you can view the security state of
238
00:11:33,440 --> 00:11:35,880
those connected environments in one place.
239
00:11:35,880 --> 00:11:38,840
That one view saves you from jumping between screens and losing context.
240
00:11:38,840 --> 00:11:41,840
Now that doesn't mean every cloud works exactly the same way.
241
00:11:41,840 --> 00:11:47,280
Azure, AWS, GCP and on premises systems each have their own services, access rules and
242
00:11:47,280 --> 00:11:48,520
connection methods.
243
00:11:48,520 --> 00:11:52,640
And Defender for cloud can collect security information from the environments you connect,
244
00:11:52,640 --> 00:11:56,480
then show the findings in a common view that reduces the chance of missing context.
245
00:11:56,480 --> 00:12:01,440
For example, an alert on a server means more when you can also see whether that server belongs
246
00:12:01,440 --> 00:12:08,080
to a cloud subscription sits in an AWS account or runs as part of an older on premises service.
247
00:12:08,080 --> 00:12:12,960
The security team can spend less time asking where is this resource and more time deciding
248
00:12:12,960 --> 00:12:14,360
what needs attention.
249
00:12:14,360 --> 00:12:17,680
Before you can protect something, you need to know it exists.
250
00:12:17,680 --> 00:12:19,360
This is where asset inventory matters.
251
00:12:19,360 --> 00:12:23,480
An asset inventory is simply a list of the things your company owns or runs in the cloud.
252
00:12:23,480 --> 00:12:28,320
That can include virtual machines, databases, storage accounts, container clusters and other
253
00:12:28,320 --> 00:12:29,320
services.
254
00:12:29,320 --> 00:12:31,600
It sounds obvious, but cloud resources appear fast.
255
00:12:31,600 --> 00:12:36,400
A project team may create a test environment, a supplier may create resources in another cloud
256
00:12:36,400 --> 00:12:37,400
account.
257
00:12:37,400 --> 00:12:41,480
An old workload may keep running after the person who built it has moved to another role.
258
00:12:41,480 --> 00:12:45,160
If it isn't in your inventory, it can easily fall outside your security work.
259
00:12:45,160 --> 00:12:47,160
Defender for cloud helps you see the resources.
260
00:12:47,160 --> 00:12:51,840
It knows about, along with their security coverage, you can see whether a resource has protection,
261
00:12:51,840 --> 00:12:55,320
has only part of the protection you expect or has no protection at all.
262
00:12:55,320 --> 00:12:56,720
That last group needs attention.
263
00:12:56,720 --> 00:13:01,520
An unprotected resource isn't always unsafe by itself, but if a production database or internet
264
00:13:01,520 --> 00:13:05,600
facing server has no planned coverage, that's a gap you need to understand.
265
00:13:05,600 --> 00:13:09,200
A coverage view turns vague assumptions into a list you can check.
266
00:13:09,200 --> 00:13:10,800
Are all our servers protected?
267
00:13:10,800 --> 00:13:12,600
Becomes a real question with a real answer.
268
00:13:12,600 --> 00:13:14,600
Permissions matter too.
269
00:13:14,600 --> 00:13:19,200
A large company doesn't want every person in the security portal to see and manage every resource.
270
00:13:19,200 --> 00:13:21,920
The infrastructure team may need to work with server findings.
271
00:13:21,920 --> 00:13:24,080
The database team may need to see database findings.
272
00:13:24,080 --> 00:13:29,240
A team responsible for one business area may only need access to that area's cloud resources.
273
00:13:29,240 --> 00:13:31,840
Cloud scopes and permissions help create those boundaries.
274
00:13:31,840 --> 00:13:35,040
Think of a cloud scope as a defined area someone can work with.
275
00:13:35,040 --> 00:13:39,640
You can connect a role to specific environments, subscriptions or resource groups, so people
276
00:13:39,640 --> 00:13:43,400
see what they are responsible for without gaining access to everything else.
277
00:13:43,400 --> 00:13:45,320
That keeps responsibility clear.
278
00:13:45,320 --> 00:13:48,440
The infrastructure team can focus on servers and their related findings.
279
00:13:48,440 --> 00:13:51,840
At the same time, the database team can review database findings and deal with the systems
280
00:13:51,840 --> 00:13:52,840
they own.
281
00:13:52,840 --> 00:13:56,400
Both teams work from the same connected security picture, but neither team needs to manage
282
00:13:56,400 --> 00:13:57,640
the other team's services.
283
00:13:57,640 --> 00:13:59,800
There is one limit you should always remember.
284
00:13:59,800 --> 00:14:03,680
Defender for cloud can only report on environments that you have connected and unborted.
285
00:14:03,680 --> 00:14:07,040
If an Azure subscription isn't included, it can become a blind spot.
286
00:14:07,040 --> 00:14:10,880
If an AWS account has not been connected, Defender for cloud can't report on the resources
287
00:14:10,880 --> 00:14:11,880
inside it.
288
00:14:11,880 --> 00:14:16,840
The same applies to GCP and on-premises servers that haven't been brought into the service.
289
00:14:16,840 --> 00:14:19,000
No dashboard can show what it doesn't know about.
290
00:14:19,000 --> 00:14:21,080
Incomplete onboarding causes a common problem.
291
00:14:21,080 --> 00:14:24,880
A company sees a need security dashboard assumes it covers the whole business and later finds
292
00:14:24,880 --> 00:14:28,600
a forgotten subscription or separate cloud account that never appeared in the view.
293
00:14:28,600 --> 00:14:31,520
So review your coverage before you trust the results.
294
00:14:31,520 --> 00:14:32,920
Ask which subscriptions exist.
295
00:14:32,920 --> 00:14:35,400
Ask who owns AWS and GCP accounts.
296
00:14:35,400 --> 00:14:37,480
Ask whether older servers are still in use.
297
00:14:37,480 --> 00:14:40,840
Then compare that list with what Defender for cloud can actually see.
298
00:14:40,840 --> 00:14:44,320
Once the view is connected, compliance becomes much more useful than a spreadsheet full of
299
00:14:44,320 --> 00:14:45,640
old checks.
300
00:14:45,640 --> 00:14:47,960
Compliance without the spreadsheet chase.
301
00:14:47,960 --> 00:14:51,240
Compliance means checking whether your cloud settings meet rules your company has agreed to
302
00:14:51,240 --> 00:14:52,240
follow.
303
00:14:52,240 --> 00:14:56,520
Those rules may come from a customer contract, a legal requirement, an industry standard,
304
00:14:56,520 --> 00:14:58,440
or your own internal security policy.
305
00:14:58,440 --> 00:15:01,800
In the past, this often meant someone collecting screenshots before an audit.
306
00:15:01,800 --> 00:15:06,000
They would ask whether encryption was enabled, whether logging was turned on or whether access
307
00:15:06,000 --> 00:15:07,880
rules matched company policy.
308
00:15:07,880 --> 00:15:12,520
By the time the spreadsheet reached the auditor, parts of the environment may already have changed.
309
00:15:12,520 --> 00:15:14,360
Cloud services don't wait for annual reviews.
310
00:15:14,360 --> 00:15:17,920
Defender for cloud gives you a way to check cloud resources against built in standards on
311
00:15:17,920 --> 00:15:19,080
an ongoing basis.
312
00:15:19,080 --> 00:15:24,800
You may see standards such as CIS, NIST, ISO 27001, HIPAA, PCI DSS, and the Microsoft Cloud
313
00:15:24,800 --> 00:15:26,160
Security benchmark.
314
00:15:26,160 --> 00:15:29,240
You don't need to memorize every standard to understand the basic idea.
315
00:15:29,240 --> 00:15:30,680
Each one contains controls.
316
00:15:30,680 --> 00:15:32,840
A control is a rule or expected safeguard.
317
00:15:32,840 --> 00:15:37,480
It might check whether a setting is enabled, whether access is restricted or whether a
318
00:15:37,480 --> 00:15:40,000
resource follows a required configuration.
319
00:15:40,000 --> 00:15:43,720
The compliance view shows which checks passed, which checks failed, and which resources cause
320
00:15:43,720 --> 00:15:44,800
the failed result.
321
00:15:44,800 --> 00:15:47,120
That makes a large standard easier to work with.
322
00:15:47,120 --> 00:15:51,040
Rather than seeing a line that says control failed, you can look deeper and see the affected
323
00:15:51,040 --> 00:15:52,040
resources.
324
00:15:52,040 --> 00:15:55,200
You can also see suggested repairs tied to the findings, so the person responsible for
325
00:15:55,200 --> 00:15:56,920
the resource has a starting point.
326
00:15:56,920 --> 00:16:00,280
Imagine an auditor asks whether your cloud storage follows a particular rule.
327
00:16:00,280 --> 00:16:05,040
Instead of searching through old notes, you can review the current control status, see
328
00:16:05,040 --> 00:16:08,760
the resources included in the check and identify any open issues.
329
00:16:08,760 --> 00:16:12,280
Your security team gets a work list, your auditor gets evidence based on the environment
330
00:16:12,280 --> 00:16:13,440
as it looks now.
331
00:16:13,440 --> 00:16:15,800
The checks keep updating as resources change.
332
00:16:15,800 --> 00:16:20,080
If someone changes a cloud setting after the last audit, that change can appear in the
333
00:16:20,080 --> 00:16:21,080
compliance view.
334
00:16:21,080 --> 00:16:25,840
This turns compliance from a once a year scramble into a regular part of managing cloud resources.
335
00:16:25,840 --> 00:16:28,240
That saves time, but it also creates accountability.
336
00:16:28,240 --> 00:16:31,480
A failed control shows that a rule needs attention.
337
00:16:31,480 --> 00:16:35,920
The team that owns the affected resource can fix it, document an accepted exception, or explain
338
00:16:35,920 --> 00:16:37,120
why the setting doesn't apply.
339
00:16:37,120 --> 00:16:41,440
The result becomes clearer than a spreadsheet where nobody knows who last updated a cell.
340
00:16:41,440 --> 00:16:45,600
Still, a high compliance score doesn't guarantee safety from every attack.
341
00:16:45,600 --> 00:16:48,080
Compliance checks whether you meet a defined set of rules.
342
00:16:48,080 --> 00:16:49,920
Attackers don't limit themselves to a checklist.
343
00:16:49,920 --> 00:16:54,000
A resource can meet a standard and still face a new software weakness, a stolen password,
344
00:16:54,000 --> 00:16:56,080
or suspicious activity that needs investigation.
345
00:16:56,080 --> 00:17:00,360
So use compliance as a way to check your agreed rules and keep evidence current.
346
00:17:00,360 --> 00:17:03,120
Use it to find gaps, assign work and show progress.
347
00:17:03,120 --> 00:17:06,560
All of this can feel large when you first open the portal, which is why the best next move
348
00:17:06,560 --> 00:17:08,160
is a simple first week plan.
349
00:17:08,160 --> 00:17:10,160
How to start without turning on everything.
350
00:17:10,160 --> 00:17:11,160
So how do you begin?
351
00:17:11,160 --> 00:17:13,960
First, make a simple map of what you actually run.
352
00:17:13,960 --> 00:17:19,000
List your Azure subscriptions, then your servers, storage accounts, databases, container services,
353
00:17:19,000 --> 00:17:22,600
and any workloads in AWS, Google Cloud, or your own data center.
354
00:17:22,600 --> 00:17:23,600
Keep it practical.
355
00:17:23,600 --> 00:17:25,480
You're trying to answer one question.
356
00:17:25,480 --> 00:17:27,880
What needs protection and where does it live?
357
00:17:27,880 --> 00:17:31,760
Once you have that map, connect the environments you want to fend off for Cloud to monitor.
358
00:17:31,760 --> 00:17:35,640
But before you dive into hundreds of recommendations, check the coverage view first.
359
00:17:35,640 --> 00:17:39,000
Findings only help when you know whether the right resources are showing up.
360
00:17:39,000 --> 00:17:40,480
Begin with Posture Management.
361
00:17:40,480 --> 00:17:43,760
Review your secure score, then look at the highest risk findings behind it.
362
00:17:43,760 --> 00:17:45,720
Don't try to clear every warning on day one.
363
00:17:45,720 --> 00:17:49,240
Instead look for problems that keep appearing across your environment.
364
00:17:49,240 --> 00:17:54,280
Public exposure, weak identity controls, open management ports, and missing patches.
365
00:17:54,280 --> 00:17:56,520
Those are often the fastest places to reduce risk.
366
00:17:56,520 --> 00:18:01,120
Next, choose Workload Protection Plans based on the services you really use and the risk they carry.
367
00:18:01,120 --> 00:18:05,040
A production server, holding business data, deserves different attention than a short-lived
368
00:18:05,040 --> 00:18:07,280
test system with no sensitive information.
369
00:18:07,280 --> 00:18:11,800
So turn on protection with a reason for servers that need deeper device level detection,
370
00:18:11,800 --> 00:18:14,240
connect Microsoft Defender for Endpoint.
371
00:18:14,240 --> 00:18:18,400
That gives you a better view of activity inside the operating system, while Defender for Cloud
372
00:18:18,400 --> 00:18:20,960
keeps the Cloud resource and its exposure in view.
373
00:18:20,960 --> 00:18:23,640
Then assign an owner to every finding that needs action.
374
00:18:23,640 --> 00:18:27,280
A recommendation without an owner becomes a reminder that nobody handles.
375
00:18:27,280 --> 00:18:31,920
Your infrastructure team may own server fixes, your app team may own a database setting, and
376
00:18:31,920 --> 00:18:35,760
your security team may track the work and review whether it was completed.
377
00:18:35,760 --> 00:18:37,160
Set a regular review time.
378
00:18:37,160 --> 00:18:40,640
Weekly may suit a busy environment, while monthly may suit a smaller one.
379
00:18:40,640 --> 00:18:43,040
The schedule matters less than making it routine.
380
00:18:43,040 --> 00:18:44,880
You aren't trying to reach a perfect score.
381
00:18:44,880 --> 00:18:48,920
You're removing the easy paths into your Cloud, one clear fix at a time.
382
00:18:48,920 --> 00:18:52,760
Think of Defender for Cloud as a security guard who checks how your Cloud is set up, protects
383
00:18:52,760 --> 00:18:57,280
the important rooms and points your teams towards the risks that deserve attention first.
384
00:18:57,280 --> 00:19:00,440
For a simple challenge, connect one Azure subscription this week.
385
00:19:00,440 --> 00:19:04,560
Check which resources appear in coverage, find the most exposed resource, and assign someone
386
00:19:04,560 --> 00:19:05,560
to fix it.
387
00:19:05,560 --> 00:19:09,000
That gives you a real starting point, not another security dashboard to ignore.
388
00:19:09,000 --> 00:19:13,360
The next, knowledge nugget to explore is Microsoft Defender for Endpoint versus Defender
389
00:19:13,360 --> 00:19:14,520
for Cloud.
390
00:19:14,520 --> 00:19:18,000
One watches what happens on devices, the other watches the Cloud resources around them,
391
00:19:18,000 --> 00:19:20,880
and together they help you see both sides of the same security problem.
