Microsoft Defender for Cloud in Azure - Commands & Configuration

Introduction

Microsoft Defender for Cloud helps protect your cloud resources by finding security problems and giving you advice to fix them. It watches your Azure services and alerts you if something looks risky or unusual.

When you want to keep your Azure virtual machines safe from attacks.

When you need to monitor your Azure storage accounts for suspicious activity.

When you want to get security recommendations for your cloud resources automatically.

When you want to see a security score that shows how protected your cloud environment is.

When you want to enable automatic threat detection on your Azure subscriptions.

Commands

This command enables Microsoft Defender for Cloud protection on your Azure virtual machines by setting the pricing tier to Standard.

Terminal

az security pricing create --name VirtualMachines --tier Standard

Expected Output

{

  "name": "VirtualMachines",

  "pricingTier": "Standard",

  "resourceType": "VirtualMachines"

}

→

--name - Specifies the resource type to protect, here VirtualMachines.

→

--tier - Sets the protection level, Standard enables Defender features.

This command turns on automatic provisioning of security agents on supported resources, so Defender can monitor them without manual setup.

Terminal

az security auto-provisioning-setting create --name default --auto-provision On

Expected Output

{

  "autoProvision": "On",

  "name": "default"

}

→

--auto-provision - Enables or disables automatic agent installation.

This command lists all active security alerts detected by Microsoft Defender for Cloud in your subscription.

Terminal

az security alert list

Expected Output

[]

This command shows security assessments and recommendations for your Azure resources to improve their security posture.

Terminal

az security assessment list

Expected Output

[]

Key Concept

If you remember nothing else from this pattern, remember: enabling Microsoft Defender for Cloud with the right pricing tier and auto-provisioning lets you automatically protect and monitor your Azure resources.

Common Mistakes

Not setting the pricing tier to Standard for the resource type.

Without Standard tier, Defender features like threat detection are not enabled.

Always run 'az security pricing create' with '--tier Standard' for resources you want protected.

Forgetting to enable auto-provisioning of security agents.

Without auto-provisioning, Defender cannot install agents needed to monitor resources automatically.

Run 'az security auto-provisioning-setting create' with '--auto-provision On' to enable this.

Not checking security alerts regularly.

Alerts provide early warnings of threats; ignoring them can lead to unnoticed security issues.

Use 'az security alert list' frequently to review and respond to alerts.

Summary

Enable Microsoft Defender for Cloud protection by setting the pricing tier to Standard for your resources.

Turn on automatic provisioning to let Defender install monitoring agents without manual steps.

Use commands to list security alerts and assessments to stay informed about your cloud security.

Practice

1. What is the main purpose of Microsoft Defender for Cloud?

easy

A. To manage user access and permissions in Azure

B. To increase the storage capacity of your Azure subscription

C. To find and help fix security issues in your cloud resources

D. To monitor the cost and billing of your Azure services

Solution

1. Step 1: Understand the role of Microsoft Defender for Cloud

   It is designed to detect security vulnerabilities and threats in cloud resources.

2. Step 2: Compare with other options

   Options A, B, and D describe other Azure services or features unrelated to Defender for Cloud's main function.

3. Final Answer:

   To find and help fix security issues in your cloud resources -> Option C

4. Quick Check:

   Defender for Cloud = Security issue detection [OK]

Hint: Defender for Cloud = cloud security scanner [OK]

Common Mistakes:

• Confusing Defender for Cloud with cost management
• Thinking it manages user permissions
• Assuming it increases storage

2. Which pricing tier of Microsoft Defender for Cloud provides enhanced security features?

easy

A. Standard tier

B. Free tier

C. Basic tier

D. Premium tier

Solution

1. Step 1: Recall pricing tiers for Defender for Cloud

   Microsoft Defender for Cloud offers Free and Standard tiers, where Standard has more features.

2. Step 2: Identify the tier with enhanced features

   The Standard tier provides better protection than the Free tier; Basic and Premium are not valid tiers here.

3. Final Answer:

   Standard tier -> Option A

4. Quick Check:

   Standard tier = enhanced security [OK]

Hint: Standard tier > Free tier for security features [OK]

Common Mistakes:

• Choosing Free tier as it sounds good
• Selecting non-existent tiers like Basic or Premium
• Confusing pricing tiers with Azure subscription levels

3. If you enable Microsoft Defender for Cloud Standard tier on your Azure subscription, what will happen?

medium

A. Your resources will be scanned for security vulnerabilities automatically

B. Your subscription cost will decrease immediately

C. All users will be blocked from accessing resources

D. Your storage capacity will double

Solution

1. Step 1: Understand the effect of enabling Standard tier

   Enabling Standard tier activates automatic security scanning and threat detection on resources.

2. Step 2: Evaluate other options

   Cost does not decrease (usually it increases), users are not blocked, and storage is unaffected.

3. Final Answer:

   Your resources will be scanned for security vulnerabilities automatically -> Option A

4. Quick Check:

   Standard tier enables automatic security scans [OK]

Hint: Standard tier = auto security scans on resources [OK]

Common Mistakes:

• Expecting cost reduction after enabling Standard tier
• Thinking it blocks all user access
• Assuming it changes storage size

4. You tried to enable Microsoft Defender for Cloud Standard tier but received an error. Which of these is a likely cause?

medium

A. You set the storage account to read-only

B. You did not assign the correct pricing tier to the resource type

C. You disabled all network connectivity

D. You forgot to create a new Azure subscription

Solution

1. Step 1: Identify common configuration errors for enabling Defender

   Enabling Defender requires setting the correct pricing tier per resource type.

2. Step 2: Analyze other options

   Creating a new subscription is not required; network or storage settings unrelated to Defender tier cause different errors.

3. Final Answer:

   You did not assign the correct pricing tier to the resource type -> Option B

4. Quick Check:

   Correct pricing tier assignment needed [OK]

Hint: Set pricing tier correctly per resource type [OK]

Common Mistakes:

• Assuming new subscription is needed
• Blaming network or storage settings unrelated to Defender
• Ignoring pricing tier configuration

5. You want to protect your Azure virtual machines and storage accounts with Microsoft Defender for Cloud. How should you configure it to get the best protection?

hard

A. Enable Standard tier for virtual machines and Free tier for storage accounts

B. Enable Standard tier only for storage accounts

C. Enable Free tier for both virtual machines and storage accounts

D. Enable Standard tier for both virtual machines and storage accounts

Solution

1. Step 1: Understand tier benefits per resource type

   Standard tier provides better protection than Free tier for all resource types.

2. Step 2: Apply best practice for multiple resource types

   To maximize security, enable Standard tier on both virtual machines and storage accounts.

3. Final Answer:

   Enable Standard tier for both virtual machines and storage accounts -> Option D

4. Quick Check:

   Standard tier on all resources = best protection [OK]

Hint: Use Standard tier on all resource types for best security [OK]

Common Mistakes:

• Mixing tiers between resource types
• Using Free tier for critical resources
• Enabling Standard tier on only one resource type