Defender for Cloud: CSPM, Compliance, Workload Protection Plans

Defender for Cloud, the executive overview

Defender CSPM

Defender CSPM (paid tier) extends the free CSPM with:

Defender CSPM (paid) capabilities — what you get over free CSPM

Defender CSPM capability	What it gives you
Agentless disk scanning	Snapshots VM/EBS/PD disks, scans for vulnerabilities, secrets, malware in a Defender-controlled environment — no in-guest agent
Attack-path analysis	Graph that traces 'an attacker who compromises X can reach Y' — combines posture findings, network reachability, identity, and data sensitivity
Cloud Security Explorer	Ad-hoc graph queries across your multi-cloud environment ('show me all internet-facing VMs that have a critical CVE and access a Key Vault')
Secret scanning	Plaintext secrets in VMs, storage, code repos (via Defender for DevOps) — discoverable in the recommendations + Security Explorer
Malware scanning of disks	Agentless detection of known malware on disk via the snapshot mechanism
Permissions Management integration	Surfaces overprivileged identities in the recommendations and attack paths
Governance rules	Assigns owners, deadlines, and notifications to recommendations; tracks SLA
Regulatory compliance enrichments	Additional compliance content beyond the free tier

Attack-path analysis

Attack paths are the single most-explained Defender CSPM capability in production reviews. Each path connects an entry point (e.g. an internet-facing VM) to a sensitive asset (e.g. a Key Vault holding production secrets) via the intermediate steps an attacker would take (compromise the VM, use the VM’s managed identity to read Key Vault). The path is rated by:

• Risk level — informed by data sensitivity, exposure, and the criticality of the route.
• Insights — what makes this path particularly bad (e.g. “VM has critical CVE”, “VM’s managed identity is overprivileged”, “Key Vault holds production-tagged secrets”).

Remediating an attack path typically only requires breaking one step in the chain (patch the VM, scope down the managed identity’s RBAC, lock down the Key Vault firewall). The path turns a list of disjointed recommendations into prioritised, motivated action.

Regulatory compliance

The Regulatory compliance view in Defender for Cloud maps your environment against compliance frameworks. Microsoft Cloud Security Benchmark (MCSB) is on by default. Additional standards can be added:

• ISO/IEC 27001:2022
• PCI DSS v4.0
• NIST SP 800-53 Rev. 5
• SOC 2 (Type 2)
• CIS Microsoft Azure Foundations Benchmark
• HIPAA HITRUST
• FedRAMP High / Moderate
• Country-specific frameworks (Australian PSPF, UK Cyber Essentials, NZISM-aligned standards, SWIFT CSCF, etc.)

For each standard, Defender for Cloud evaluates the in-scope subscriptions/connectors against the standard’s controls, marks each as Healthy / Unhealthy / Not applicable, and aggregates to a per-standard compliance percentage.

Attestations and exemptions

• Manual attestation — for controls Microsoft cannot automatically evaluate (process controls, documented procedures), an admin attests with a justification. Counts toward compliance.
• Exemptions — controls that genuinely don’t apply can be exempted with a reason and expiry. Doesn’t count as compliant — but doesn’t count as non-compliant either, and the exemption is auditable.

Workload protection plans

Each plan adds threat protection specific to its workload class:

Defender for Cloud workload protection plans — one column per workload class

Plan	Protects	Examples of detection
Defender for Servers (P1/P2)	Azure VMs + Arc-enabled servers	MDE EDR, JIT, agentless scanning, vulnerability assessment (covered Module 20)
Defender for SQL	Azure SQL DB, Managed Instance, SQL on VM/Arc, OSS DBs	Anomalous queries, SQL injection patterns, brute-force attempts
Defender for Storage	Storage accounts (blob, file, queue, table)	Anomalous access, suspicious uploads, malware scanning on upload (next-gen plan)
Defender for Key Vault	Key Vault data plane	Anomalous secret/key access patterns (covered Module 5)
Defender for Containers	AKS, ACR, Container Apps, ACI	Runtime threats, image vulns, K8s admission (covered Module 21)
Defender for App Service	App Service, Functions, Logic Apps Standard	Web shell upload, suspicious POST patterns, runtime threats
Defender for Resource Manager	Azure Resource Manager control plane	Suspicious resource operations, abnormal admin behaviour
Defender for DNS	Azure DNS resolution from Azure resources	DNS exfiltration patterns, communication with known-malicious domains
Defender for APIs	APIs published in Azure API Management	Sensitive data exposure in responses, unusual API consumption patterns
Defender for AI Service	Microsoft Foundry AI workloads	Prompt injection, jailbreak, data exfiltration via model (covered Module 18)

How plans are enabled

Per-subscription in Defender for Cloud > Environment settings > [subscription] > Defender plans. Some plans (Containers, Servers, SQL) have sub-options for things like agentless scanning enablement, MDE auto-onboarding, file integrity monitoring. The exam expects you to know that enabling is per-subscription and billing is per protected resource (per-VM, per-database, per-storage-account, etc.).

💡 Free CSPM vs Defender CSPM — when is the paid tier needed?

Free CSPM gives you Secure Score and MCSB recommendations across all enabled subscriptions, always — no charge. It’s the default safety net.

Defender CSPM (paid) is the right answer on SC-500 when the scenario mentions any of:

• Attack-path analysis or “show me how an attacker could reach X”
• Agentless disk scanning for vulnerabilities, secrets, or malware
• Cloud Security Explorer queries across the environment
• Governance rules for recommendations (owners, deadlines, SLAs)
• Integration with Permissions Management for overprivileged identity attack paths
• DevOps repository scanning via Defender for DevOps

If the scenario is “show me my Secure Score” or “list MCSB recommendations”, free CSPM is sufficient. If it goes deeper (attack paths, secret scanning, explorer queries), the answer is Defender CSPM.

Scenario: Asha enables the CNAPP across Aurora’s estate

Asha at Aurora Health Service is standing up Microsoft Defender for Cloud across 47 subscriptions (Azure + AWS + GCP):

1. Free CSPM is on by default. Asha reviews Secure Score by subscription and assigns the worst-scoring subscriptions to their resource owners.
2. Defender CSPM (paid) enabled across all 47 subscriptions. Why: attack-path analysis is the executive view her CISO wants (“walk me through how an attacker could exfiltrate patient data”), and agentless secret + malware scanning closes posture gaps that MDE-only doesn’t reach.
3. Workload plans enabled selectively:
   • Defender for Servers Plan 2 — all subscriptions (including AWS + GCP via the multicloud connectors).
   • Defender for SQL — all subscriptions with Azure SQL.
   • Defender for Storage — all subscriptions.
   • Defender for Key Vault — all subscriptions.
   • Defender for Containers — subscriptions hosting AKS clusters.
   • Defender for App Service — subscriptions with App Service workloads.
   • Defender for Resource Manager — root management group.
   • Defender for APIs — subscriptions with APIM.
   • Defender for AI Service — subscriptions hosting Foundry workloads.
4. Regulatory compliance: MCSB always on; add ISO/IEC 27001:2022 + NIST SP 800-53 Rev. 5 (US-facing partnerships) + HIPAA HITRUST (US-facing); quarterly review by the compliance team.
5. Governance rules assign recommendation ownership: storage-related recommendations route to the Data Platform team with a 14-day SLA; identity-related to the Identity Engineering team with a 7-day SLA.
6. Cloud Security Explorer — Asha builds a saved query: “All internet-facing resources that hold customer-sensitive data and have an attack path of length ≤ 3” — reviewed weekly.

The Defender for Cloud overview becomes Aurora’s monthly board-level security report. Attack paths drive sprint prioritisation. Compliance percentages roll up to the audit committee.

Key terms

Question

What is Defender Cloud Security Posture Management (Defender CSPM)?

Click or press Enter to reveal answer

Answer

The paid CSPM tier in Microsoft Defender for Cloud. Adds agentless disk scanning (vulnerabilities, secrets, malware), attack-path analysis, Cloud Security Explorer (graph queries), governance rules, regulatory compliance enrichments, and integration with Defender for DevOps and Permissions Management. Per-billable-resource pricing. The default SC-500 answer when scenarios mention attack paths, secret scanning, or cross-environment graph queries.

Click to flip back

Question

What is an attack path in Defender for Cloud?

Click or press Enter to reveal answer

Answer

A graph that traces how an attacker compromising an entry point (e.g. internet-facing VM) could reach a sensitive asset (e.g. Key Vault holding production secrets) via intermediate steps (use VM's managed identity to read KV). Rated by risk and annotated with insights (CVE, overprivileged identity, data sensitivity). Breaking one step in the chain remediates the path.

Click to flip back

Question

Which Defender for Cloud workload protection plan would you enable for protecting Azure SQL Database threats?

Click or press Enter to reveal answer

Answer

Defender for SQL — covers Azure SQL DB, Managed Instance, SQL on VM/Arc, and open-source databases (PostgreSQL, MySQL). Detects anomalous queries, SQL injection patterns, brute-force authentication, and abnormal data access. Enabled per-subscription, billed per protected database.

Click to flip back

Question

What is the Microsoft Cloud Security Benchmark (MCSB)?

Click or press Enter to reveal answer

Answer

Microsoft's prescriptive security control set for Azure (and increasingly AWS/GCP) — the default regulatory standard assigned in Defender for Cloud. Built-in policy definitions, recommendations, and compliance view assess your environment against MCSB. Other standards (PCI DSS, ISO 27001, NIST 800-53, SOC 2, HIPAA, country-specific) can be added alongside.

Click to flip back

Question

What's the difference between manual attestation and exemption in Defender for Cloud regulatory compliance?

Click or press Enter to reveal answer

Answer

Manual attestation: admin attests that a control is satisfied via process or documentation that Microsoft cannot automatically evaluate — counts toward compliance with a captured justification. Exemption: an admin marks a control as not applicable with a reason and expiry — doesn't count compliant or non-compliant, but is auditable and lapses on expiry for re-review.

Click to flip back

Knowledge check

Knowledge Check

Asha at Aurora Health Service wants to see — for a specific patient-data SQL database — exactly how an attacker who compromised any internet-facing VM could reach it. She wants a graph showing the steps, the CVEs, and the identity chain. Which Defender for Cloud capability fits?

AFree CSPM Secure ScoreBDefender CSPM attack-path analysisCMicrosoft Sentinel hunting queryDAzure Policy compliance assessment

Check Answer

Knowledge Check

Esme at Northwind Bank needs to enable threat protection for the bank's Azure SQL databases and the underlying storage accounts. Which workload protection plans should she enable?

ADefender CSPMBDefender for SQL + Defender for StorageCDefender for Resource Manager + Defender for DNSDMicrosoft Sentinel with the SQL data connector

Check Answer

Knowledge Check

Ravi at Maple Genomics is adding HIPAA HITRUST as a compliance standard to monitor in Defender for Cloud. One specific control requires a documented incident response procedure that Defender cannot automatically evaluate. How should Ravi handle this control?

AExempt the control with a 'not applicable' reasonBManually attest the control with a justification linking to the documented procedureCIgnore the control — it won't affect compliance percentageDAdd a custom Azure Policy that audits the procedure

Check Answer

What’s next

Next: Multicloud + EASM + Vulnerability Management — Defender for Cloud connectors for AWS and GCP, Microsoft Defender External Attack Surface Management (EASM) for shadow IT discovery, and Microsoft Defender Vulnerability Management settings for Azure VMs.