implementing-azure-defender-for-cloud

# Implementing Azure Defender for Cloud ## When to Use - When enabling comprehensive security monitoring across Azure subscriptions - When implementing cloud workload protection for VMs, containers, SQL, storage, and Key Vault - When compliance requirements demand continuous assessment against regulatory frameworks - When building adaptive security controls that respond to detected threats - When centralizing security findings from Azure-native and hybrid workloads **Do not use** for non-Azure workload protection exclusively (use AWS Security Hub or GCP SCC), for application-level security testing (use Azure DevOps DAST/SAST), or for identity-specific protection (use Microsoft Defender for Identity). ## Prerequisites - Azure subscription with Contributor or Security Admin role - Azure Policy enabled for compliance assessment - Log Analytics workspace for diagnostic data collection - Azure Arc connected machines for hybrid server protection - Pricing tier set to Standard for Defender plans (free tier provides CSPM only) ## Workflow ### Step 1: Enable Defender for Cloud Plans Enable the appropriate Defender plans for each workload type requiring protection. ```bash # Enable Defender for Cloud CSPM (foundational posture management) az security pricing create --name CloudPosture --tier standard # Enable Defender for Servers az security pricing create --name VirtualMachines --tier standard \ --subplan P2 # Enable Defender for Containers az security pricing create --na...