Defender for Cloud: what to enable, what to ignore and why secure score is not the goal

Microsoft Defender for Cloud does two different jobs and prices them differently. The free tier is posture management: recommendations, secure score, compliance dashboards. The paid plans are workload protection: actual detection on servers, containers, databases, storage and key vaults.

Teams routinely enable everything, get a bill they did not expect, and then disable everything including the parts that were worth paying for. The useful approach is to treat them as separate decisions.

The free posture layer: turn it on everywhere, then ignore the score

Enable Defender for Cloud across every subscription via Azure Policy (DeployIfNotExists), so new subscriptions are covered automatically. Recommendations and secure score cost nothing.

Then do not manage to the score. Secure score weights recommendations by an internal model that does not know which of your resources are internet-facing, which hold customer data or which are in a test subscription that gets deleted on Friday. A team can move the score ten points by remediating a low-risk recommendation across two hundred dev resources while the one public database sits untouched.

Triage on two axes instead: reachable from the internet and holds or grants access to data. Anything in the intersection is this week. That is the same triage as the SCC piece for GCP, and it is cloud-independent because the risk model is.

Use the compliance dashboard for what it is good at: answering an auditor. The ISO 27001, PCI DSS and CIS mappings are genuinely useful evidence and genuinely poor prioritisation.

The paid plans, in order of what we usually recommend

Defender for Servers — worth it in production. It brings vulnerability assessment, file integrity monitoring, just-in-time VM access and endpoint detection integration. Plan 2 includes more; Plan 1 is the endpoint detection core. If you already run an EDR product, check the overlap before paying twice.

Defender for Containers — worth it if you run AKS in production. Registry image scanning, runtime detection and Kubernetes-aware alerts. This is the plan with the clearest value per euro on a container estate.

Defender for Storage — worth it for accounts holding customer uploads. Malware scanning on upload and sensitive data discovery. Price it carefully: it charges per storage transaction volume, and a chatty analytics account can be expensive.

Defender for SQL and for open-source relational databases — worth it where the database holds regulated data. It catches SQL injection patterns and anomalous access.

Defender for Key Vault — cheap and high signal. Unusual access to a key vault is one of the strongest single indicators of a compromised identity.

Defender for Resource Manager — cheap, catches suspicious control-plane activity like a sudden permission grant or a disabled diagnostic setting.

Defender CSPM (the paid tier) — the attack path analysis is genuinely good. It chains findings into "this internet-facing VM has a managed identity with Contributor on the subscription containing your database", which is the kind of reasoning a flat findings list will never do for you. Whether it earns its cost depends on how complex your estate is; on a small one, the paths are short enough to see by hand.

Defender for APIs and for DevOps — evaluate rather than assume. Both are useful in specific shapes and neither is a default.

Enable plans per subscription, not tenant-wide by reflex. Non-production subscriptions rarely justify the full set.

Make the alerts go somewhere

The failure mode is the same on every cloud: detection enabled, response undefined. Export alerts through Azure Monitor or continuous export to your SIEM or ticketing system, page on the high-severity workload protection alerts, and write containment runbooks for the three cases you will actually see — a compromised VM, a compromised identity, an exposed storage account.

Test them quarterly. A runbook nobody has run is a document, not a control. The same argument, at more length, is in turning GuardDuty into a rota someone answers.

Prevention beats remediation, here as everywhere

Most Defender recommendations are one misconfiguration repeated. Fix the class with Azure Policy in Deny mode rather than remediating resources one at a time: no public blob access, no public network access on SQL, TLS 1.2 minimum, diagnostic settings deployed automatically. The policy set from the Azure landing zone piece closes most of the recurring recommendations permanently.

We work through both halves in a security engagement — the plans worth paying for and the policies that make the recommendations stop coming back.

What to do this week

Filter recommendations to high severity, production subscriptions, and internet-exposed resources only. That list is short enough to read and everything on it is real. Then check which Defender plans you are paying for and whether anyone is receiving their alerts.