The AZ-900 skills outline bundles three ideas into one bullet: “Describe Zero Trust, defense in depth, and Microsoft Defender for Cloud.” Most study material spends its energy on the first two, because they are models you can draw as a diagram, and then dismisses Defender for Cloud with a single sentence like “it protects your resources.” That sentence is true and almost useless. It does not help you when a question asks which tool recommends enabling disk encryption, which tool detects a brute-force attack on a virtual machine, which tool reports how compliant a subscription is with PCI DSS, and which part of all that is free.
This guide covers Microsoft Defender for Cloud at the altitude the AZ-900 expects: what it is, what its two halves (posture management and workload protection) actually do, how the secure score is built, what the paid Defender plans add, how the regulatory compliance dashboard works, how it reaches AWS, Google Cloud and on-premises machines, and, most importantly for exam day, how to tell it apart from the half-dozen Azure services that sound similar. Zero Trust and defense in depth are deliberately not re-taught here; they are covered in depth in the sibling guide on Azure identity, access and security for AZ-900. This article is about the product that puts those models into practice.
What Microsoft Defender for Cloud Is
Microsoft describes Defender for Cloud as a Cloud-Native Application Protection Platform (CNAPP). That acronym is new to most AZ-900 candidates, so it is worth unpacking, because the exam’s phrasing of Defender for Cloud scenarios maps directly onto its parts. A CNAPP combines three security disciplines into one product:
| Capability | What it answers | Typical output |
|---|---|---|
| Cloud Security Posture Management (CSPM) | “Is my environment configured securely?” | Recommendations, secure score, compliance reports |
| Cloud Workload Protection (CWPP) | “Is something attacking my workloads right now?” | Security alerts, threat detection, malware findings |
| DevSecOps | ”Is the code and pipeline that produces my cloud resources secure?” | Findings on repositories and CI/CD pipelines |
The exam concentrates on the first two. The one-line summary that survives any question is: Defender for Cloud assesses your security posture and gives you recommendations (CSPM), and it detects and alerts on threats against your workloads (CWPP). Posture is about configuration before an attack; workload protection is about behaviour during an attack. If a scenario says “recommend”, “secure score”, “misconfiguration”, “compliance” or “hardening”, it is pointing at CSPM. If it says “alert”, “detect”, “suspicious”, “malware”, “brute force” or “threat”, it is pointing at workload protection.
Defender for Cloud is enabled on an Azure subscription. Once enabled, it starts collecting configuration and security data from the resources in that subscription (and, through connectors, from other clouds) and turns it into insights, recommendations and alerts. It integrates with the wider Microsoft Defender XDR portal and the rest of the Microsoft security ecosystem, which is why some newer documentation shows Defender for Cloud data inside the Defender portal rather than only inside the Azure portal.
Posture Management: Foundational CSPM vs Defender CSPM
The single most testable fact about Defender for Cloud is that part of it is free. Microsoft splits posture management into two tiers:
| Foundational CSPM | Defender CSPM | |
|---|---|---|
| Price | Free, included with every subscription | Paid, billed per protected resource |
| Security recommendations | Yes, based on the Microsoft cloud security benchmark | Yes, broader coverage |
| Secure score | Yes | Yes |
| Asset inventory | Yes | Yes |
| Regulatory compliance dashboard | Default standard (MCSB) only | Additional standards (NIST, PCI DSS, ISO, CIS and more) |
| Attack path analysis | No | Yes |
| Cloud security explorer | No | Yes |
| Agentless scanning of VMs, containers and Kubernetes for vulnerabilities and secrets | No | Yes |
| Risk prioritisation and AI security posture | No | Yes |
| Advanced DevOps posture (pull-request annotations, code-to-cloud mapping) | No | Yes |
Foundational CSPM is what you get the moment Defender for Cloud is switched on for a subscription. It continuously evaluates your resources against the Microsoft cloud security benchmark (MCSB), Microsoft’s built-in standard of security principles and technical controls for Azure, AWS and Google Cloud, and produces recommendations: “Storage accounts should restrict network access”, “Virtual machines should have disk encryption enabled”, “MFA should be enabled for accounts with owner permissions”, and so on. Each recommendation names the unhealthy resources, explains the risk and usually offers a one-click “Fix” or a link to the setting that needs changing.
Defender CSPM is the paid upgrade for organisations that need more than a to-do list. Attack path analysis stitches individual findings together into chains an attacker could actually walk, for example “internet-exposed VM with a known vulnerability, holding a managed identity that can read a storage account containing sensitive data”. Cloud security explorer lets you query the whole estate with questions like “show me every internet-facing resource with a high-severity vulnerability”. Agentless scanning inspects VM disks, container images and Kubernetes clusters for vulnerabilities and embedded secrets without installing anything on the machines. The AZ-900 does not expect you to configure any of this, but it does expect you to know the shape: the free tier tells you what is wrong; the paid tier tells you what matters most and why.
Secure Score: The Number Everybody Quotes
Every Defender for Cloud overview dashboard shows a secure score, a single percentage that summarises your posture across every connected subscription and cloud account. The higher the score, the lower the identified risk. The score is the most likely Defender for Cloud detail to appear in a question, so here is how it actually works, in enough depth to reason about edge cases.
- Only MCSB recommendations count. The MCSB is organised into security controls, each a logical group of related recommendations covering one attack surface (“Enable MFA”, “Secure management ports”, “Remediate vulnerabilities”, “Encrypt data in transit”, and so on). Only built-in recommendations that belong to the MCSB affect the score; custom recommendations and recommendations marked Preview do not, even though you should still fix them.
- Each control has a fixed maximum score that reflects how important Microsoft judges that attack surface to be. “Enable MFA” carries far more weight than a cosmetic recommendation. The maximum is the same for every environment, which is what makes scores comparable across organisations.
- Your current score for a control depends on the proportion of healthy resources within it. The potential score increase shown for a control is the score per resource multiplied by the number of unhealthy resources. Crucially, a control’s points are only fully earned when all of its recommendations are remediated for all relevant resources; fixing nine of ten VMs gets you most of the way, but the control is not “complete”.
- The combined score across subscriptions is weighted by the number of resources in each one, so a large production subscription moves the overall number far more than a small sandbox.
- Controls are recalculated roughly every eight hours per subscription or cloud connector. If you remediate something and the score has not moved, the cause is usually that the recalculation has not run yet, not that the fix failed.
- Since mid-2026, multicloud recommendations for connected AWS and Google Cloud accounts also contribute to the score, so connecting a new cloud account can lower your percentage simply because the evaluated estate got larger.
The exam-level takeaway: secure score is a posture (CSPM) feature, it is driven by MCSB recommendations, and the way to raise it is to remediate recommendations, not to buy a plan. A question that says “the organisation wants a single metric to track how its security configuration improves over time” is describing secure score.
Workload Protection: The Defender Plans
Posture management tells you a storage account is misconfigured. It does not tell you that someone just uploaded ransomware to it. That is the job of the Defender plans, Defender for Cloud’s workload protection half. Each plan is a separately enabled, separately billed layer of threat detection for one resource type:
| Defender plan | What it protects | Examples of what it detects or adds |
|---|---|---|
| Defender for Servers | Azure VMs, Azure Arc-enabled servers (on-premises, AWS, GCP) | Endpoint detection and response via Microsoft Defender for Endpoint integration (Plan 1); Plan 2 adds agentless scanning, vulnerability assessment, just-in-time VM access, file integrity monitoring, and a free daily data-ingestion allowance |
| Defender for Storage | Storage accounts | Malware scanning on upload, sensitive-data threat detection, unusual access patterns |
| Defender for Containers | AKS and other Kubernetes clusters, container registries | Runtime threat detection for clusters, image vulnerability assessment |
| Defender for Databases (SQL on Azure and on machines, open-source relational DBs, Azure Cosmos DB) | Database engines | SQL injection attempts, anomalous queries, brute-force logins |
| Defender for App Service | Web apps and functions on App Service | Attacks against web applications and the App Service infrastructure |
| Defender for Key Vault | Key vaults | Unusual or suspicious access to secrets, keys and certificates |
| Defender for Resource Manager | The Azure control plane itself | Suspicious management operations, such as attempts to disable security tooling |
| Defender for APIs | APIs published through Azure API Management | API posture findings and threat detection |
When one of these plans sees something suspicious it raises a security alert with a severity, a description of the activity, the affected resource, MITRE ATT&CK tactics and recommended remediation steps. Related alerts are grouped into security incidents. Alerts can be exported to Microsoft Sentinel or any SIEM, and can trigger automated responses through Logic Apps.
Two Defender for Servers Plan 2 features show up in fundamentals-level questions often enough to deserve a sentence each. Just-in-time (JIT) VM access keeps management ports like RDP 3389 and SSH 22 closed by default and opens them only on request, for a limited time, from an approved source IP, which shrinks the attack surface of a brute-force attempt to nearly zero. File integrity monitoring watches operating-system and application files and registry keys for changes that indicate tampering. Both are workload protection features; neither has anything to do with secure score mechanics.
Regulatory Compliance Dashboard
Defender for Cloud represents industry and regulatory standards as security standards and shows how your resources measure up on the Regulatory compliance dashboard. Each standard is a set of controls; each control is backed by one or more automated assessments, and a control that cannot be assessed automatically is shown greyed out rather than reported as passing.
The facts the exam can reasonably ask:
- The Microsoft cloud security benchmark is assigned by default to every Azure subscription when Defender for Cloud is enabled. For connected AWS accounts the AWS Foundational Security Best Practices standard is also assigned by default; for Google Cloud, a GCP default standard.
- Additional standards such as NIST SP 800-53, NIST CSF, PCI DSS, ISO/IEC 27001, SOC 2, HIPAA, CIS Foundations benchmarks and national baselines can be added, but assigning them requires a paid plan (Defender CSPM or Defender for Servers Plan 2 or another paid Defender plan). On the free tier you see MCSB only.
- The dashboard is a compliance posture view: it tells you which controls are passing or failing, lets you download reports, and is useful evidence for auditors. It is not a certification and it does not make you compliant on its own.
Note the relationship to the service covered in the management-and-governance guide: Microsoft Purview governs data (discover, classify, catalogue), while Defender for Cloud’s compliance dashboard reports on resource configuration against standards. They complement each other and are easy to confuse under time pressure.
Multicloud and Hybrid: Where Azure Arc Comes In
Defender for Cloud is not limited to Azure. You can connect AWS accounts and Google Cloud projects through native connectors, after which their resources appear in inventory, receive MCSB-based recommendations, contribute to secure score, and (if the corresponding Defender plans are enabled) get workload protection. Much of this is agentless, using the cloud providers’ own APIs.
For on-premises servers and machines in other clouds, the bridge is Azure Arc. Arc projects a non-Azure machine into Azure Resource Manager as an “Arc-enabled server”, and once it exists as an Azure resource Defender for Servers can protect it exactly like a native VM. This is the practical answer to the AZ-900 pairing of Arc and Defender: Arc extends Azure management to outside resources; Defender for Cloud then extends Azure security to them.
Defender for Cloud vs Everything That Sounds Like It
The AZ-900 rarely tests Defender for Cloud in isolation. It tests whether you can pick it out of a list of plausible-sounding Azure security and governance services. These are the distinctions that matter:
| Scenario phrase | Correct service | Why not Defender for Cloud (or why yes) |
|---|---|---|
| “Assess security posture and get recommendations to harden resources” | Microsoft Defender for Cloud | This is CSPM |
| ”Detect a brute-force attack on a VM and raise an alert” | Microsoft Defender for Cloud (Defender for Servers) | This is workload protection |
| ”Track a single score showing security configuration improvement” | Microsoft Defender for Cloud (secure score) | Posture metric |
| ”Prevent resources that violate a rule from being created, or audit them” | Azure Policy | Policy enforces and audits configuration rules; Defender for Cloud recommends and detects (and, in fact, uses Policy initiatives behind the scenes to run its assessments) |
| “Collect security logs from many sources, correlate them, hunt threats, orchestrate response (SIEM/SOAR)“ | Microsoft Sentinel | Sentinel is the SIEM; Defender for Cloud is one of its data sources |
| ”Protect user identities: MFA, Conditional Access, risky sign-ins” | Microsoft Entra ID (and Entra ID Protection) | Identity layer, not resource posture |
| ”Filter network traffic between subnets or to the internet” | Network security groups / Azure Firewall | Network controls; Defender for Cloud may recommend you configure them |
| ”Protect a web app from SQL injection at the edge” | Web Application Firewall on Application Gateway or Front Door | A control, not a posture tool; Defender for App Service detects attacks instead |
| ”Discover, classify and govern sensitive data across the estate” | Microsoft Purview | Data governance |
| ”Centralised dashboard of resource health and metrics, with alert rules” | Azure Monitor | Operational monitoring, not security assessment |
| ”Prevent accidental deletion of a resource” | Resource locks | Governance control |
| ”Protect endpoints (laptops, servers) with EDR” | Microsoft Defender for Endpoint | The endpoint agent; Defender for Servers integrates it for VMs |
Two of these trip people up most. Azure Policy vs Defender for Cloud: Policy is the enforcement engine (“deny storage accounts that allow public access”); Defender for Cloud is the assessment and threat-detection layer that, among other things, reads Policy compliance results to generate recommendations. If the scenario is about stopping a deployment, pick Policy. If it is about seeing what is weak or catching an attack, pick Defender for Cloud. Microsoft Sentinel vs Defender for Cloud: Sentinel is a cloud-native SIEM that ingests logs from Azure, Microsoft 365, other clouds and on-premises appliances to correlate, hunt and respond at scale; Defender for Cloud produces security alerts and recommendations for cloud workloads and feeds them into Sentinel. If the scenario says “security operations centre”, “correlate across sources” or “SIEM”, pick Sentinel.
A Worked Exam Scenario
A company runs 40 virtual machines, several storage accounts and an AKS cluster in Azure, plus 20 servers in an on-premises data centre. The security team wants to (1) see a prioritised list of configuration weaknesses across all of it, (2) be alerted when malware is uploaded to any storage account, and (3) report compliance against PCI DSS to an auditor. They want to spend as little as possible. What do you recommend?
Walk it through the way the exam wants:
- Enable Defender for Cloud on the subscription. Foundational CSPM is free and immediately gives recommendations, secure score and asset inventory for the Azure resources. That covers most of requirement (1) for Azure.
- Onboard the on-premises servers with Azure Arc. That makes them Azure resources that Defender for Cloud can assess and protect, completing requirement (1) across the hybrid estate.
- Enable Defender for Storage on the subscription for requirement (2). Malware scanning on upload is a Defender for Storage feature, and it is a paid plan billed per storage account, so you enable only that plan rather than everything.
- For PCI DSS reporting, add the PCI DSS standard on the Regulatory compliance dashboard. That requires a paid plan, so either Defender CSPM or (since you already have Defender for Servers in scope for the Arc machines) Defender for Servers Plan 2 unlocks it. If budget is the overriding concern and you only need Azure-native compliance evidence, Defender CSPM is the targeted choice.
The pattern of the answer, “free Foundational CSPM for recommendations, Arc for hybrid reach, specific Defender plans for specific threat detection, a paid plan to unlock additional compliance standards”, is exactly the tiered structure the exam is checking that you understand.
Common AZ-900 Mistakes With Defender for Cloud
| Mistake | Reality |
|---|---|
| ”Defender for Cloud is entirely a paid product” | Foundational CSPM (recommendations, secure score, inventory, MCSB compliance) is free; Defender plans and Defender CSPM are paid |
| ”Secure score goes up if I buy more Defender plans” | Score moves only when MCSB recommendations are remediated |
| ”Defender for Cloud blocks non-compliant deployments” | That is Azure Policy; Defender for Cloud recommends, detects and alerts |
| ”Defender for Cloud is a SIEM” | Microsoft Sentinel is the SIEM; Defender for Cloud is a data source for it |
| ”Defender for Cloud only works for Azure resources” | AWS and Google Cloud via connectors; on-premises and other-cloud servers via Azure Arc |
| ”Just-in-time VM access is a networking feature of NSGs” | JIT is a Defender for Servers Plan 2 feature that manages NSG and Firewall rules for you |
| ”Microsoft Defender for Cloud and Microsoft Defender for Endpoint are the same thing” | Defender for Endpoint is the EDR agent; Defender for Servers integrates it |
| ”Compliance standards other than MCSB are free” | Adding standards to the compliance dashboard requires a paid plan |
Where This Fits in Your AZ-900 Prep
Defender for Cloud is a small slice of the “Describe Azure architecture and services” domain, but it is a slice with a lot of sound-alike distractors around it, which is precisely why it is worth the extra half hour. If you can answer “recommend or detect?”, “free or paid?”, and “Defender for Cloud, Policy or Sentinel?” for any scenario, you have the whole bullet covered.
The most reliable way to make those distinctions automatic is scenario-based practice under time pressure. Sailor.sh’s AZ-900: Azure Fundamentals Mock Exam Bundle includes full-length timed mock exams that mirror the real exam’s format, with a detailed explanation on every question, so a Defender-for-Cloud-versus-Policy question you miss becomes a distinction you keep. Use this guide to build the model; use the mocks to find out where it still leaks.
To complete the security side of the exam, read this alongside the sibling guide on Azure identity, access and security for AZ-900, which owns Zero Trust, defense in depth, Entra ID, Conditional Access and RBAC, and the guide on Azure management, governance and cost management, which covers Azure Policy, resource locks, Microsoft Purview, Azure Arc and Azure Monitor in depth. For the full blueprint and logistics start with the AZ-900 exam guide for 2026, schedule your prep with the 30-day AZ-900 study plan, and test yourself with the AZ-900 practice questions. If this topic is the part of Azure you enjoyed most, the AZ-500 exam guide describes the security-engineer certification where Defender for Cloud, Sentinel and Policy become hands-on, day-to-day tools.
Frequently Asked Questions
What is Microsoft Defender for Cloud in simple terms?
It is Azure’s cloud security service that does two jobs: it continuously assesses how securely your cloud resources are configured and gives you prioritised recommendations and a secure score (posture management), and it detects and alerts on threats against your workloads such as VMs, storage, databases and containers (workload protection). Microsoft classes it as a Cloud-Native Application Protection Platform (CNAPP).
Is Microsoft Defender for Cloud free?
Partly. The Foundational CSPM tier, which includes security recommendations, secure score, asset inventory and the default Microsoft cloud security benchmark compliance view, is free for every Azure subscription. Threat detection (the Defender plans such as Defender for Servers or Defender for Storage) and the advanced Defender CSPM plan are paid and billed per protected resource.
How is the secure score in Defender for Cloud calculated?
Recommendations from the Microsoft cloud security benchmark are grouped into security controls, each with a fixed maximum score reflecting its importance. Your score for a control rises as you remediate its recommendations across your resources, and the overall score aggregates all controls, weighted by subscription size. Preview and custom recommendations do not count, and controls are recalculated roughly every eight hours.
What is the difference between Microsoft Defender for Cloud and Azure Policy?
Azure Policy enforces and audits configuration rules, for example denying the creation of a public storage account. Defender for Cloud assesses posture, recommends fixes and detects threats; it actually uses Azure Policy initiatives under the hood to run many of its assessments. Choose Policy when the scenario is about preventing or auditing deployments, and Defender for Cloud when it is about recommendations, secure score or threat alerts.
What is the difference between Microsoft Defender for Cloud and Microsoft Sentinel?
Microsoft Sentinel is a cloud-native SIEM and SOAR: it collects and correlates security data from many sources, supports threat hunting and orchestrates response. Defender for Cloud focuses on cloud workload posture and threat detection, and its alerts can be sent to Sentinel as one of many data sources. Scenarios that mention a security operations centre, correlation across sources or SIEM point at Sentinel.
Can Defender for Cloud protect on-premises servers and other clouds?
Yes. AWS accounts and Google Cloud projects connect through native connectors and receive recommendations, secure score contributions and, with Defender plans enabled, threat protection. On-premises servers and servers in other clouds are onboarded with Azure Arc, which makes them Azure resources that Defender for Servers can then protect.
What is just-in-time VM access?
A Defender for Servers Plan 2 feature that keeps management ports such as RDP and SSH closed by default and opens them only on request, for a limited time window and from approved source addresses, dramatically reducing exposure to brute-force attacks.
Conclusion
Microsoft Defender for Cloud is the product that turns the AZ-900’s abstract security models into something that runs. Its two halves map cleanly onto the two kinds of question the exam asks: posture management (recommendations, secure score, compliance, free at the foundational tier) answers “how securely is this configured?”, while workload protection (the paid Defender plans) answers “is this under attack right now?”. Around those halves sit a handful of facts worth memorising: secure score comes from the Microsoft cloud security benchmark and moves only when you remediate; additional compliance standards need a paid plan; Azure Arc extends coverage to on-premises and other clouds; and Azure Policy enforces, Sentinel correlates, Entra ID authenticates, while Defender for Cloud assesses and detects. Hold that map, practise picking the right service out of a crowded answer list, and this bullet becomes one of the easier points on the exam.