06 - Defender for Cloud and Endpoint¶

Microsoft Defender for Cloud (MDfC)¶

Microsoft Defender for Cloud is Microsoft's CNAPP (Cloud-Native Application Protection Platform) covering CSPM (Cloud Security Posture Management) and CWPP (Cloud Workload Protection Platform). It protects multi-cloud (Azure, AWS, GCP) and hybrid environments.

Two pillars¶

CSPM answers: What am I deploying that is misconfigured? - Continuous assessment against security baselines - Secure Score - Regulatory compliance dashboards - Recommendations with remediation guidance

CWPP answers: What threats are happening to my running workloads? - Per-workload threat detection plans (Servers, Storage, SQL, etc.) - Runtime alerts forwarded to Sentinel/XDR

CSPM Tiers¶

Defender Plans (CWPP)¶

Multi-Cloud Onboarding¶

AWS connector: - Created via Defender for Cloud > Environment Settings > Add environment > AWS - Deploys CloudFormation stack to AWS account creating IAM roles - Optional auto-provisioning of Arc agents for VM coverage - Discovers EC2, EKS, RDS, S3, Lambda, etc.

GCP connector: - Workload identity federation - Service account in GCP project - Cloud Build trigger for deploying agents

On-prem and other clouds: - Azure Arc enables management of non-Azure servers and Kubernetes - Once Arc-onboarded, Defender plans apply

Secure Score¶

Numeric score (0-100%) representing security posture: - Each recommendation worth a point value - Implementing recommendations or marking exemptions improves score - Group score = aggregated across subscriptions or management groups - Used as KPI for security teams; not a compliance proxy

Recommendations¶

Each recommendation has: - Severity (High/Medium/Low) - Affected resources - Remediation steps - Quick-fix automation (where supported) - Mapping to compliance frameworks

Status options: Healthy, Unhealthy, Not Applicable, Exempt.

Governance rules assign owners and due dates to recommendations to drive remediation accountability.

Regulatory Compliance¶

Built-in initiatives for: - Microsoft Cloud Security Benchmark (MCSB) - default - PCI-DSS v4 - HIPAA HITRUST - ISO 27001:2013/2022 - SOC 2 Type 2 - NIST SP 800-53, SP 800-171, CSF - CIS Microsoft Azure Foundations Benchmark - FedRAMP H/M - CMMC Level 3 - UK NHS, Australian PSPF, regional standards

Custom initiatives via Azure Policy. Compliance dashboard exports findings to PDF, supports continuous export to Sentinel and Event Hub.

Cloud Security Graph (Defender CSPM)¶

Graph database of all discovered cloud resources, identities, workloads, exposures, and relationships. Enables:

• Attack path analysis - Visualizes chains of misconfigurations that attackers could exploit (e.g., public VM with high-sev vuln + identity with admin role + access to KV with secrets)
• Cloud security explorer - Custom queries against the graph (e.g., "Internet-exposed VMs with critical CVEs and managed identities with subscription-owner role")
• Risk-prioritized recommendations based on actual exposure

Microsoft Defender for Endpoint (MDE)¶

Endpoint detection and response (EDR), antivirus (Microsoft Defender Antivirus), attack surface reduction, vulnerability management, and threat & vulnerability management.

Plans¶

Onboarding methods¶

• Group Policy - on-prem Windows
• Microsoft Intune (MEM) - cloud-managed Windows, macOS, iOS, Android, Linux
• System Center Configuration Manager (SCCM) - hybrid
• Local script - pilot/manual
• VDI - non-persistent VMs with VDI onboarding
• Server via Defender for Cloud - automatic for Azure Arc / Defender for Servers
• macOS, Linux - shell scripts and config profiles

Attack Surface Reduction (ASR) Rules¶

15+ rules to block common attack vectors: - Block credential stealing from LSASS - Block Office apps from creating child processes - Block Office apps from creating executable content - Block executable content from email/webmail - Block JavaScript or VBScript from launching downloaded executable content - Block process creations from PsExec and WMI - Block persistence through WMI event subscription - Block untrusted/unsigned processes from USB - Use advanced protection against ransomware

Modes: Audit, Block, Warn (limited), Disabled. Pilot in Audit, then enforce.

Endpoint security policies (in Intune/MEM)¶

• Antivirus
• Disk encryption
• Firewall
• Endpoint detection and response (telemetry, isolation tag)
• Attack surface reduction
• Account protection
• Device compliance

Threat and Vulnerability Management (TVM)¶

Built-in risk-based vuln management: - Continuous discovery of CVEs across installed software - Exposure score (lower is better, opposite of secure score) - Recommendations prioritized by exploit availability, breach status, asset criticality - Browser extension assessment - Network share configuration assessment - Authenticated scan for Windows and network devices - Integration with Intune to push remediation

Live Response¶

Remote shell to investigate or remediate endpoints: - Browse file system - Get/put files - Run scripts (curated library) - Run binaries from approved library - View running processes, services, scheduled tasks, persistence locations - Logged in DeviceEvents table

Permissions: - Live response basic - browse, copy files, run commands - Live response advanced - run unsigned scripts, run executable

Web Content Filtering¶

Category-based blocking (Adult, Gambling, Liability, etc.) at network egress on managed endpoints. Reports surface in MDE > Reports > Web protection.

Device Control¶

USB removable storage policies, printer redirection control, Bluetooth control. Defined via Intune or local Group Policy.

Indicators (IOCs)¶

Block hashes, IPs, URLs, domains, certificates organization-wide. Limits: 15,000 indicators per type per tenant. Set via portal, MDE API, or via Defender XDR Threat Intelligence integration.

Defender for Cloud + Defender for Endpoint Integration¶

Defender for Servers Plan 1 includes MDE deployment to Azure VMs and Arc-enabled servers automatically. The MDE agent provides:

• EDR telemetry to Defender XDR (advanced hunting)
• Vulnerability assessment to Defender for Cloud
• Behavioral analytics to both surfaces
• Live response capability
• ASR rules

Plan 2 adds JIT VM access, adaptive application controls (machine learning allowlist), network hardening (suggested NSG tightening), and 500MB/day Sentinel ingestion of selected MDC tables.

Microsoft Defender for Identity (MDI)¶

Detects identity-based attacks against on-prem AD, AD FS, AD CS, and Entra Connect:

• Sensors installed on Domain Controllers, AD FS, AD CS servers (lightweight)
• Detects: DCSync, DCShadow, Golden Ticket, Silver Ticket, Pass-the-Hash, Pass-the-Ticket, Skeleton Key, AS-REP roasting, Kerberoasting, NTLM relay, suspicious LDAP/SAMR queries
• ITDR (Identity Threat Detection and Response) capability set
• Integration with Entra ID Protection for hybrid identity risk scoring
• Action accounts for response (disable user, force password reset on-prem)
• Honeytoken accounts to flag adversary recon

Microsoft Defender for Office 365 (MDO)¶

Email and collaboration security:

• Safe Links (URL rewriting and time-of-click protection)
• Safe Attachments (sandbox detonation)
• Anti-phishing policies (impersonation protection, spoof intelligence, mailbox intelligence)
• Anti-spam, anti-malware policies
• Threat Explorer / Real-time Detections for hunting and remediation
• Attack Simulation Training for end-user phishing exercises
• Quarantine management

P1: Safe Links, Safe Attachments, anti-phish basic. P2: Adds Threat Explorer, AIR, Attack Simulation, campaign views.

Microsoft Defender for Cloud Apps (MDA, formerly MCAS)¶

Cloud Access Security Broker (CASB):

• App discovery (analyzes proxy/firewall logs to find shadow IT)
• Cloud app catalog with risk scoring
• Connected apps via APIs (M365, Salesforce, Workday, GitHub, AWS, Azure, GCP) for monitoring and governance
• Conditional Access App Control for inline session monitoring (block download, block paste, etc.)
• Activity policies, file policies, anomaly policies, OAuth app policies
• App governance add-on for OAuth app risk management

Common Exam Pitfalls¶

• Confusing Defender for Cloud (workloads) with Defender for Cloud Apps (SaaS apps)
• Mixing MDI (on-prem AD) with Entra ID Protection (cloud identity)
• Selecting Servers P1 when JIT/adaptive controls (P2) are required
• Forgetting that Defender CSPM is a separate paid plan beyond foundational CSPM
• Not knowing that ASR rules have Audit mode for piloting
• Picking AV settings via SCCM when Intune endpoint security is the modern path
• Misidentifying the right Defender plan for a workload (Storage vs Cosmos vs SQL)

Quick Reference: Plan to Workload¶