Microsoft Defender for Cloud Explained: Plans, Secure Score, Attack Paths and Connecting AWS and Google Cloud

For organisations that run mostly on Azure, Microsoft Defender for Cloud is often the first cloud security platform they have, because the free tier is already there. It also covers AWS and Google Cloud. The details changed significantly in 2026, when its home moved to the Microsoft Defender portal, so interview answers based on older documentation can sound dated.

What it is

Microsoft describes Defender for Cloud as a cloud-native application protection platform with three parts: posture management (CSPM), DevSecOps, and workload protection (CWPP).

On 5 May 2026 the integration of Defender for Cloud into the Microsoft Defender portal became generally available. Posture now appears through Microsoft Security Exposure Management, next to endpoint and identity signals. Plan management in the Defender portal entered preview in October 2026 with a new billing unit, Defender Workload Units. Some older standalone plans (for AKS, Container Registry, Key Vault, DNS and Resource Manager) were blocked for new enablement through the API from July 2026, with their capabilities moved into other plans.

How it works

Cloud connections. For AWS, you add an environment, onboard either the management account (which creates connectors for member accounts, including future ones) or a single account, choose a scan interval of 4, 6, 12 or 24 hours, select plans, and deploy with CloudFormation or Terraform. Authentication uses federated trust with short-lived credentials, and the default posture role is named CspmMonitorAws; its read-only calls appear in CloudTrail. Delegated administrator accounts are not supported for onboarding. Server protection on AWS also needs Azure Arc and the SSM Agent.

Agentless scanning snapshots root and data disks, analyses the copy in an isolated environment in the same region, and deletes it. On AWS it uses a dedicated VmScanner role. If many snapshots fail to delete, Microsoft suspends new scans and charges continue, which is worth monitoring.

The cloud security graph connects assets, network exposure, permissions and vulnerabilities. Attack path analysis shows paths from an external entry point to a critical target and lists the recommendations that break each path. Cloud security explorer is a query builder for your own graph questions.

How to use it

Day one: turn it on everywhere

1. Enable Defender for Cloud on every Azure subscription through policy at the management group level, so Foundational CSPM covers new subscriptions.
2. Connect AWS through the management account and Google Cloud at the organisation level.
3. Check connectivity status in environment settings; a broken connector looks like a clean environment.
4. Decide which paid plans you need: Defender CSPM for attack paths and agentless scanning, workload plans for detection on servers, containers, storage and databases.

Week one: from score to owners

1. Use the risk-based Cloud Secure Score and recommendations ordered by risk, not the raw recommendation count.
2. Open attack path analysis and fix the recommendation that breaks each critical path.
3. Ask the graph targeted questions in cloud security explorer, such as internet-exposed VMs with high-severity vulnerabilities and permission to read a storage account.
4. Create governance rules so each recommendation gets an owner and a due date automatically.

Every day: detect, export, prevent regressions

Triage alerts and incidents in the Defender portal alongside endpoint and identity incidents, export what your SIEM needs (Microsoft Sentinel or another tool), and use Azure Policy deny or enforce effects so fixed problems cannot come back.

Where it stops

• Two scores, two numbers. Reporting the classic score and the risk-based score as if they were one confuses everyone. Pick one and say which.
• Scores move on their own. Microsoft added more than 200 AWS and Google Cloud recommendations in June 2026, which can lower scores without the environment getting worse.
• Paid features behind the free tier. Attack paths, explorer and agentless scanning need Defender CSPM.
• Multicloud is not equal. Some features need extra components outside Azure, such as Azure Arc for servers on AWS.

How it comes up in interviews

• "Our secure score dropped 10 points overnight. Did we get worse?" Check which score, whether new recommendations were added, and whether connectors broke.
• "Design posture management for an Azure-first company that also runs AWS." Foundational CSPM everywhere, Defender CSPM where attack paths matter, governance rules, and policy to stop regressions.
• "How does agentless VM scanning work, and what permissions does it need?" Snapshots, regional isolation, scanner roles and deletion.

Sources

Checked on 13 November 2026: Microsoft Learn pages for the Defender for Cloud introduction, release notes, connecting AWS accounts, agentless machine scanning, secure score and security controls, and attack path analysis and cloud security explorer.