Microsoft Defender for Cloud: Cloud Security Posture Management and Workload Protection

Refreshed for 2026: Azure Security Center is now Microsoft Defender for Cloud. The service has evolved from Azure security recommendations into a broader cloud security platform for posture management, workload protection, vulnerability assessment, compliance, and multicloud threat detection.

Editor’s note: Azure Security Center has a new name and a broader role

Microsoft renamed Azure Security Center to Microsoft Defender for Cloud. The core idea remains the same: help organizations find security gaps, prioritize remediation, and protect cloud workloads. What changed is the scope. Defender for Cloud now covers cloud security posture management, paid workload protection plans, container and DevOps security, agentless discovery, attack path analysis, and multicloud environments including Azure, AWS, and Google Cloud.

What Microsoft Defender for Cloud does

Microsoft Defender for Cloud helps security and IT teams answer three practical questions: What cloud assets do we have, how exposed are they, and which risks should we fix first? It continuously evaluates resources against security best practices, highlights misconfigurations, and provides recommendations for Azure subscriptions and connected multicloud environments. For hybrid servers, Azure Arc can extend coverage to machines running outside Azure.

CSPM, Defender CSPM, and workload protection

Defender for Cloud includes cloud security posture management capabilities that assess resources, generate recommendations, and contribute to secure score. Organizations that need deeper risk prioritization can use Defender Cloud Security Posture Management, often referred to as Defender CSPM, which adds capabilities such as attack path analysis, cloud security explorer, governance workflows, agentless scanning, data-aware security posture, and identity and permission risk insights. Separately, Microsoft Defender plans provide cloud workload protection for specific resource types such as servers, containers, storage, databases, App Service, APIs, and DevOps environments. These plans are typically enabled and billed through Azure subscriptions, not through Microsoft 365 NCE licensing, although related Microsoft security products may have their own licensing models.

Secure score and risk-based recommendations

Secure score in Defender for Cloud helps teams measure and improve security posture over time. Instead of treating every finding equally, modern Defender for Cloud experiences help prioritize issues by severity, affected assets, business context, internet exposure, sensitive data, identity permissions, and attack paths. Recommendations may include hardening network access, enforcing encryption, enabling endpoint protection, improving identity controls, fixing vulnerable software, protecting management ports, or enabling the right Defender plan for a workload.

Attack path analysis and security explorer

A major improvement since the Azure Security Center era is the ability to visualize how multiple risks can combine into a real attack path. For example, a publicly exposed workload, excessive permissions, and a known vulnerability may create a more urgent risk than any single issue alone. Security explorer lets teams query cloud assets and relationships to investigate exposure, sensitive data paths, identity permissions, and resource configuration at scale. This helps security teams move from long lists of findings to prioritized remediation.

Vulnerability management for servers and cloud assets

Defender for Cloud can help identify vulnerable software and misconfigured workloads across supported environments. Current capabilities may include agentless scanning, integration with Microsoft Defender Vulnerability Management, and supported vulnerability assessment options for machines and databases. This is a more modern approach than relying only on older Qualys-based wording. The right configuration depends on the workload, operating system, subscription, Defender plan, and whether assets are in Azure, on-premises, or another cloud.

Container and Kubernetes security

For containerized environments, Microsoft Defender for Containers protects services such as Azure Kubernetes Service and, through supported connectors, Kubernetes environments in other clouds or Arc-enabled clusters. Current container security focuses on Kubernetes posture management, control plane and workload hardening recommendations, image vulnerability assessment, container registry visibility, and runtime threat detection. For organizations using AKS, Defender for Cloud should be part of a broader Kubernetes security approach that also includes network policy, private cluster design, Microsoft Entra ID integration, workload identity, secrets management, and CI/CD pipeline controls.

Regulatory compliance and security benchmarks

The regulatory compliance dashboard in Defender for Cloud helps map recommendations to supported compliance standards and benchmarks. Microsoft Cloud Security Benchmark is commonly used as a Microsoft-aligned baseline for securing Azure and multicloud resources. Compliance dashboards are useful for tracking control status and evidence, but they do not replace a formal compliance program. They work best when combined with ownership, remediation deadlines, exception handling, and periodic review.

Multicloud protection for AWS and Google Cloud

Modern cloud estates are rarely Azure-only. Defender for Cloud can connect to AWS and Google Cloud environments to assess posture, discover resources, and apply security recommendations across platforms. Depending on configuration and enabled plans, organizations can extend workload protection and posture management to servers, containers, databases, and other supported services. This gives security teams a more consistent view of risk across cloud providers instead of managing separate security backlogs in each platform.

Identity, permissions, and Microsoft Entra ID

Cloud risk is closely tied to identity. Defender for Cloud posture findings should be reviewed alongside Microsoft Entra ID controls such as multifactor authentication, Conditional Access, privileged role management, workload identities, and least-privilege access. Excessive permissions, stale identities, unmanaged service principals, and risky administrative paths can turn a configuration issue into a serious exposure. Security teams should treat identity posture as part of cloud posture, not as a separate project.

Automation, workflow, and response

Workflow automation in Defender for Cloud can trigger actions based on alerts or recommendations. Common patterns include opening tickets, notifying resource owners, routing alerts to security operations, or starting approved remediation workflows through Azure Logic Apps. Automation should be designed carefully: low-risk actions can often be automated, while high-impact remediations should include approval, change management, and rollback planning.

Microsoft Sentinel integration

Microsoft Sentinel is the current name for the SIEM and SOAR platform formerly known as Azure Sentinel. Defender for Cloud alerts and security data can be connected to Microsoft Sentinel so SecOps teams can correlate cloud findings with identity, endpoint, network, and application signals. In mature environments, Sentinel analytics, automation rules, playbooks, and incident workflows help transform Defender for Cloud findings into an operational detection and response process.

How to start with Defender for Cloud

A practical rollout usually starts with visibility: enable Defender for Cloud, review secure score, identify critical recommendations, and assign owners. Next, decide which paid Defender plans are required for high-value workloads such as servers, databases, storage, containers, APIs, and DevOps pipelines. Finally, connect Microsoft Sentinel where centralized monitoring is needed, integrate identity controls with Microsoft Entra ID, and establish a recurring governance process so recommendations are not ignored after the initial deployment.

Key takeaways

• Azure Security Center is now Microsoft Defender for Cloud, and Azure Sentinel is now Microsoft Sentinel.
• Defender for Cloud combines cloud security posture management, workload protection, compliance visibility, vulnerability management, and threat detection.
• Modern prioritization uses secure score, risk context, attack paths, identity permissions, and exposure data rather than simple checklists.
• Paid Defender plans should be selected based on the workloads that need protection, such as servers, containers, storage, databases, App Service, APIs, and DevOps.
• For best results, connect Defender for Cloud with Microsoft Sentinel, Microsoft Entra ID governance, and a clear remediation workflow.

Need help modernizing your cloud security program? IT Partner can assess your Azure, AWS, and Google Cloud posture, configure Microsoft Defender for Cloud, connect Microsoft Sentinel, and build a prioritized remediation roadmap that fits your environment and licensing model.