Purview & Defender for Cloud Threats
Not all threats come from endpoints. Learn how to investigate compromised entities flagged by Microsoft Purview and security alerts from Microsoft Defender for Cloud workload protections.
Threats beyond the endpoint
Not every security incident starts with a virus on a laptop. Sometimes it is an employee downloading thousands of confidential files before their resignation (Purview detects this). Sometimes it is an attacker exploiting a misconfigured Azure VM (Defender for Cloud detects this).
Microsoft Purview watches for data-related threats — insider risk, DLP violations, and compromised entities that leak or abuse sensitive data. Defender for Cloud watches your Azure (and multi-cloud) workloads — VMs, databases, storage accounts, containers — for security threats and misconfigurations.
Both send alerts into the unified Defender XDR incident queue, and as a SOC analyst, you investigate them alongside endpoint and identity threats.
Microsoft Purview threat investigation
What Purview detects
| Signal | Example | Investigation Focus |
|---|---|---|
| Insider risk alerts | Employee downloading sensitive files to USB before resignation | User activity timeline, file access patterns, HR context |
| DLP policy violations | Credit card numbers sent via external email | Email content, sender intent, policy match details |
| Data classification anomalies | Sudden spike in access to files labelled “Highly Confidential” | Who accessed what, when, and from where |
| Compromised entity | User account accessing data from unusual location after credential theft | Account compromise indicators, session analysis |
Investigation workflow
- Review the Purview alert in Defender XDR — what entity is flagged? What data was involved?
- Check the user’s risk profile — is this person flagged in Insider Risk Management?
- Examine data access — Content Explorer and Activity Explorer show exactly what the user accessed
- Correlate with identity signals — did the user also trigger Entra ID or Defender for Identity alerts?
- Determine intent — accidental (training issue), policy gap (oversharing), or malicious (insider threat)
- Remediate — block further access, revoke sessions, escalate to HR/Legal if needed
Scenario: James investigates a Purview alert
James at Pacific Meridian receives an alert: “High-risk user activity — bulk file download.”
A departing employee downloaded 2,300 files labelled “Confidential — HR” from SharePoint to a personal USB drive over two days.
Investigation:
- Insider Risk Management shows the user was flagged 3 weeks ago (resignation notice submitted)
- Activity Explorer shows the downloads happened outside business hours
- DLP logs show no external email or cloud upload — the data is on the USB
Response:
- James escalates to HR and Legal (potential IP theft)
- Disables the user’s account
- Works with the facilities team to retrieve the USB before the employee’s last day
- Creates a Purview alert policy to detect similar patterns for future departures
Classification: True Positive — Data theft/insider risk
Defender for Cloud workload protection
What Defender for Cloud protects
| Protection Plan | What It Covers | Example Alerts |
|---|---|---|
| Defender for Servers | Azure/on-prem/AWS VMs | Suspicious process execution, cryptomining, reverse shell |
| Defender for SQL | Azure SQL, SQL on VMs | SQL injection, brute force, anomalous query patterns |
| Defender for Storage | Azure Blob, Files, Data Lake | Malware upload, unusual access patterns, anonymous access |
| Defender for Containers | AKS, container registries | Vulnerable images, runtime threats, privileged container escape |
| Defender for Key Vault | Azure Key Vault | Unusual secret access, suspicious IP accessing keys |
| Defender for App Service | Azure App Service | Web shell detection, suspicious outbound traffic |
Investigation workflow
- Review the alert — what resource is affected? What was the suspicious activity?
- Check resource context — who owns it? What does it run? Is it internet-facing?
- Examine the timeline — when did the activity start? What happened before and after?
- Check for lateral movement — did the attacker pivot from this resource to others?
- Remediate — patch the vulnerability, isolate the resource, rotate credentials, review network security groups
Scenario: Elena investigates a cloud alert
Elena at Atlas Bank receives: “Defender for SQL — Potential SQL injection on prod-payments-db.”
Investigation:
- The alert shows a series of SQL queries with
UNION SELECTandDROP TABLEpatterns from an external IP - The application is a payment processing API exposed via Azure App Service
- Defender for App Service also shows suspicious outbound connections from the same App Service instance
Response:
- Elena adds the attacker’s IP to App Service access restrictions to block it immediately
- Reviews SQL audit logs — the injection attempts failed (parameterised queries blocked them)
- Checks for data exfiltration — no unauthorised data access confirmed
- Recommends the dev team add a WAF (Web Application Firewall) in front of the API
- Files the incident as True Positive — attempted SQL injection (blocked)
| Feature | Purview Threats | Defender for Cloud Threats |
|---|---|---|
| Focus | Data and user behaviour | Cloud infrastructure and workloads |
| Threat type | Insider risk, DLP violations, data exfiltration | External attacks, misconfigurations, malware on cloud resources |
| Key data | User activity, file access, email content, risk scores | Resource logs, network flows, process execution, vulnerability scans |
| Investigation tools | Activity Explorer, Content Explorer, Insider Risk dashboard | Alert timeline, resource map, security recommendations |
| Remediation | Block user, revoke sessions, escalate to HR/Legal | Patch, isolate resource, rotate credentials, update NSGs |
James sees a Purview alert: a user flagged for insider risk has downloaded 500 HR files to a USB drive outside business hours. The user submitted a resignation last week. What should James do first?
Elena sees a Defender for Cloud alert: 'Potential SQL injection on prod-payments-db.' SQL audit logs show the injection attempts were blocked by parameterised queries. How should she classify this?
Next up: Data and cloud threats are covered. Now let’s tackle identity — compromised accounts from Entra ID and Defender for Identity alerts.