Microsoft Defender for Cloud: secure score, recommendations and workload protection

What Defender for Cloud is

Microsoft Defender for Cloud is a cloud-native application protection platform (CNAPP). That term simply means one tool that covers several jobs that used to be separate: checking configuration, protecting running workloads, and securing the code and pipelines that build them.

CSPM stands for cloud security posture management; workload protection was traditionally called CWPP (cloud workload protection platform). See CSPM explained for the general concept.

Secure score and recommendations

Defender for Cloud assesses resources against the Microsoft cloud security benchmark, which is applied by default. Each failed check becomes a recommendation, such as "Storage accounts should restrict network access" or "Machines should have vulnerability findings resolved". Recommendations are grouped, and fixing them raises your secure score, a percentage that shows posture at a glance.

• Many recommendations include a Fix button or a script.
• Use Enforce to create an Azure Policy deny rule so the problem cannot come back.
• Use exemptions with a documented reason when a recommendation genuinely does not apply.
• Add regulatory standards such as ISO/IEC 27001:2022, PCI DSS or the CIS benchmarks to the regulatory compliance dashboard.

Alerts and response

When a Defender plan detects suspicious activity, such as a brute-force attempt on a VM, unusual access to a storage account or a known malicious file, it raises a security alert with a severity, affected resources and suggested steps. Related alerts can be combined into an incident.

1. Stream alerts to Microsoft Sentinel or your SIEM so they are triaged with other signals.
2. Set email notifications to the security team for high-severity alerts.
3. Use workflow automation (Logic Apps) for repeatable responses, such as opening a ticket.
4. Review the alert, contain the resource, investigate root cause and fix the weakness.

Getting started sensibly

1. Check foundational CSPM is active on every subscription (it is on by default).
2. Connect AWS accounts and Google Cloud projects if you use them.
3. Turn on Defender plans for the workloads that matter most, starting with servers and storage.
4. Work through high-severity recommendations first, then enforce them.
5. Track secure score monthly and assign owners per subscription.

Tip: secure score measures configuration, not whether you have been breached. A high score with nobody watching alerts still leaves you blind.