In short: Microsoft Defender for Cloud is Microsoft's cloud-native application protection platform (CNAPP). It combines free Foundational CSPM, the paid Defender CSPM plan, DevOps security and workload protection plans for servers, containers, storage, databases and more. It covers Azure, AWS, Google Cloud and on-premises machines, with alerts flowing into Microsoft Defender XDR.
What Defender for Cloud does
Microsoft describes Defender for Cloud as a CNAPP with three core parts:
- Cloud security posture management (CSPM): checks the configuration of your cloud resources against the Microsoft cloud security benchmark and other standards, gives you a secure score and recommendations, and in the paid plan maps attack paths.
- DevOps security: connects to GitHub, Azure DevOps and GitLab to find infrastructure-as-code misconfigurations and exposed secrets in code, and links them to the cloud resources they create.
- Cloud workload protection (CWPP): plans that detect threats against servers, containers, storage, databases, App Service, Key Vault, APIs, Resource Manager and AI services.
Alongside those, Defender for Cloud covers AI workloads in two ways: AI security posture management in the Defender CSPM plan, which builds an inventory of your generative AI applications and models and checks how they are configured, and a separate AI threat protection plan that detects attacks against them at runtime.
It is not only for Azure. Connectors bring in AWS accounts and Google Cloud projects, and Azure Arc extends coverage to servers in your own data centre. Microsoft is also bringing Defender for Cloud into the Microsoft Defender portal, so cloud posture and alerts sit alongside the rest of Microsoft Defender XDR.
Foundational CSPM vs Defender CSPM
| Foundational CSPM | Defender CSPM | |
|---|---|---|
| Cost | Free once Defender for Cloud is enabled on a subscription | Paid, billed on specific resource types |
| Inventory, recommendations, secure score | Yes | Yes |
| AWS and Google Cloud connectors | Yes | Yes |
| Basic DevOps recommendations | Yes | Yes, plus pull request annotations and code-to-cloud mapping |
| Attack path analysis and cloud security explorer | No | Yes |
| Agentless VM vulnerability and secrets scanning | No | Yes |
| Agentless Kubernetes discovery and container image assessment | No | Yes |
| Data security posture management | No | Yes |
| Regulatory compliance assessments | No | Yes |
| AI and API security posture | No | Yes |
| Governance rules and risk prioritisation | No | Yes |
Defender CSPM bills on specific resource types, including virtual machines, storage accounts, SQL and open-source database servers, and, where you enable them, serverless functions and serverless containers. Our CSPM guide explains posture management more generally.
Workload protection plans
Each plan is switched on per subscription (or per resource for some) and billed separately, so you protect what matters rather than everything:
| Plan | Protects |
|---|---|
| Defender for Servers (Plan 1 and Plan 2) | Windows and Linux machines in Azure, AWS, Google Cloud and on-premises, using Microsoft Defender for Endpoint; Plan 2 adds agentless scanning, file integrity monitoring and just-in-time access |
| Defender for Containers | Kubernetes clusters and nodes, container registries and images in Azure, AWS, Google Cloud and Arc-connected clusters |
| Defender for Storage | Storage accounts: malware scanning of uploads, sensitive data threats and misuse of access tokens |
| Defender for Databases | Azure SQL, SQL servers on machines, open-source relational databases and Azure Cosmos DB |
| Defender for App Service | Web apps and APIs hosted on Azure App Service |
| Defender for Key Vault | Unusual attempts to access or exploit key vaults |
| Defender for Resource Manager | Suspicious management operations across your subscriptions |
| Defender for APIs | Inventory, posture and threat detection for published APIs |
| AI Services (AI threat protection) | Real-time threats against generative AI applications built on Azure AI services |
The servers plan matters most for most organisations: see cloud workload protection for the Plan 1 vs Plan 2 comparison and how it relates to Microsoft Defender for Endpoint.
Who it suits, and when to look elsewhere
Defender for Cloud is a strong default when:
- Most of your infrastructure is in Azure
- You already use Microsoft Defender XDR, Microsoft Sentinel or Defender for Endpoint, so alerts land in tools your team knows
- You want to start for free and add paid plans one workload at a time
Consider other CNAPP options if your estate is mainly AWS or Google Cloud and Azure is incidental, if your servers already run another vendor's EDR that you intend to keep, or if you need features such as deep Kubernetes runtime controls that you have tested better elsewhere. It is quite normal to run Foundational CSPM for Azure alongside another vendor's CNAPP.
Getting started
- Open Defender for Cloud and review the free recommendations and secure score for each subscription. Fix anything rated high on internet-exposed resources first.
- Connect your AWS accounts and Google Cloud projects so posture is measured in one place.
- Enable Defender for Servers on production subscriptions, confirm Defender for Endpoint is onboarded, and decide between Plan 1 and Plan 2.
- Add Defender CSPM if you need attack paths, agentless scanning or compliance reporting, and the workload plans that match what you run (storage, databases, containers).
- Connect your code repositories, then route alerts to Defender XDR, Sentinel or your MDR provider and agree who responds.
Plans are billed through your Azure subscription. Licensing questions for the wider Microsoft estate are covered on our Microsoft Defender Suite page and by Forever Group's Microsoft licensing team. Ask us for a quote for deployment and ongoing management.
How we help
We review what Defender for Cloud already shows you, prioritise the fixes, estimate the cost of the paid plans against your real resource counts and switch on only what earns its keep. We then tune recommendations, set up governance so findings reach resource owners, and integrate alerts with your security operations. Contact us to review your Defender for Cloud set-up.
How Forever Systems helps with cloud security
We are an independent UK IT and cyber security provider. We supply and support a wide range of security platforms, so we recommend what fits your organisation rather than one vendor's answer to everything.
- Assess first: we review what you already own, especially your Microsoft 365 licences, before suggesting anything new
- Vendor-aware advice across secure access, email, identity, data protection, endpoint, MDR, cloud infrastructure, browser, AI and backup, including Cisco Secure, Check Point Harmony and Sophos
- Deployment and migration from a UK team, from tenant hardening to replacing a VPN or an endpoint product
- Ongoing support: policy tuning, alert handling, renewals and regular reviews
- People and certification too: security awareness training and Cyber Essentials
We work with businesses, schools, charities and public sector organisations.
Want an independent view of your cloud security?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Is Microsoft Defender for Cloud free?
Partly. Foundational CSPM costs nothing once Defender for Cloud is enabled on a subscription, giving recommendations, secure score and the Microsoft cloud security benchmark. Defender CSPM and the workload protection plans, such as Defender for Servers, are paid and billed per protected resource, and most paid plans start with a 30-day trial.
What is the difference between Defender for Cloud and Defender for Cloud Apps?
Defender for Cloud protects cloud infrastructure: virtual machines, containers, storage and databases in Azure, AWS and Google Cloud. Microsoft Defender for Cloud Apps is a CASB that protects SaaS applications and how people use them.
Does Defender for Cloud work with AWS and Google Cloud?
Yes. You connect AWS accounts and Google Cloud projects with agentless connectors for posture management, and Defender for Servers and Defender for Containers can protect workloads there too.
Is Defender for Servers included in Microsoft 365 E5?
No. Microsoft 365 licences cover users and their devices, not servers. Servers need their own licensing: usually Defender for Servers (billed through Azure and covering Azure, AWS, Google Cloud and Arc-connected machines), or, for small businesses on Defender for Business or Microsoft 365 Business Premium, the Defender for Business servers add-on.
What is Defender CSPM attack path analysis?
It models how an attacker could chain weaknesses, such as an internet-exposed virtual machine with a vulnerability and a privileged identity, to reach sensitive resources. It is part of the paid Defender CSPM plan and helps you fix the combinations that matter first.