Combines security posture management with workload protection: a free foundational CSPM tier, paid Defender plans, Secure Score and recommendations. Its regulatory compliance dashboard shows status only and blocks nothing.
Also called formerly Azure Security Center, Azure Security Center.
Read more: Microsoft Learn
In the Ultra Transcenders books
AZ-305AZ-700SC-500AZ-900SC-900SC-200AZ-400ALZ
Each book explains Microsoft Defender for Cloud in context, with comparison tables and the common traps.
Terms in this definition
- Workload
Also called an experience: a Fabric toolset aimed at one job role, e.g. Data Factory, Data Engineering, Data Warehouse, Real-Time Intelligence or Power BI. Each keeps its data in OneLake.
- Foundational CSPM
The no-cost posture tier of Defender for Cloud, which supplies Secure Score, recommendations and the Microsoft cloud security benchmark. Attack paths, AI-SPM and threat protection are not part of it.
- Archive
Offline access tier for blobs, cheapest to store yet dearest to access. Reading a blob means rehydrating it first, which can take as long as 15 hours.
- Defender plans
Microsoft Defender for Cloud protection is bought per kind of resource, for example servers, storage, containers, key vaults or Resource Manager, and each of these plans is switched on subscription by subscription.
- Secure score
A single number from Microsoft Defender for Cloud that sums up your security posture. A higher figure means lower risk, and acting on recommendations pushes it up.
- Regulatory compliance dashboard
Page in Microsoft Defender for Cloud showing how resources measure up against standards like PCI DSS and ISO 27001. It is purely a report and enforces nothing.
Related terms
- AWS
Short for Amazon Web Services, Amazon's public cloud. Linking AWS accounts to Microsoft Defender for Cloud brings them under its recommendations and protections.
- CloudAuditEvents
Fed by Microsoft Defender for Cloud, this advanced hunting table captures control-plane activity in the cloud, for example Azure Resource Manager operations or Kubernetes audit records.
- CloudProcessEvents
An advanced hunting table, fed by Microsoft Defender for Cloud, that records process activity across multicloud Kubernetes environments including AKS, EKS and GKE.
- CNAPP
Short for Cloud Native Application Protection Platform, a type of security product bringing DevOps security, workload protection (CWPP) and posture management (CSPM) together. Microsoft's offering here is Microsoft Defender for Cloud.
- CSPM
Short for Cloud Security Posture Management: spotting and fixing weak configuration across cloud resources, guided by recommendations, a secure score and checks against compliance standards. Everyone using Microsoft Defender for Cloud gets the Foundational level at no charge, while the fuller Defender CSPM is a paid option.
- Digital Operational Resilience Act
An EU law setting digital resilience requirements for financial organisations; Microsoft Defender for Cloud offers it as a compliance standard. Not to be confused with the DevOps Research and Assessment metrics that share its acronym.
- Enhanced security features
Microsoft Defender for Cloud's paid plans, turned on separately for servers, storage, databases and other resource types. They provide workload protection beyond what the free foundational CSPM offers.
- GCP
Google Cloud Platform. Organisations can onboard its projects to Microsoft Defender for Cloud, which then assesses their posture and protects them alongside Azure resources.