SECURITY ATLAS / EVALUATION BRIEF
Microsoft Defender for Cloud
Research reviewed: 2026-10-18
https://atlasofsecurity.com/landscape/vendors/microsoft-defender-for-cloud/

THE ATLAS TAKE
Defender for Cloud is most persuasive when the team already operates Azure permissions, subscriptions, and Microsoft security workflows, but it should still earn its place on non-Azure workloads. Foundational posture, paid Defender CSPM, and workload-specific plans are different purchases and deployment paths. Agentless scanning is a valuable assessment route, not a substitute for every runtime control. Atlas would start with a plan-to-resource matrix and one cross-cloud investigation. The operational question is whether engineers can explain the required connector permissions, scan coverage, workload instrumentation, and resulting bill without relying on the platform name as an answer.

SCOPE
Foundational posture, paid Defender CSPM and workload-specific Defender plans have different coverage and billing. Some workload protections need Azure Arc or sensors; other service protections use cloud integrations. Map dependencies separately for each selected plan.

WORTH A LOOK WHEN
Azure-oriented cloud teams that can connect workload owners, posture remediation, and Microsoft security operations across defined subscriptions and external accounts.

THINK TWICE WHEN
The proposed rollout assumes every workload protection is included in basic posture or that agentless scanning observes every runtime action.

IMPLEMENTATION
1. Map protections to resources
Select required controls for a representative server, container workload, database, and storage service; record the associated plan.

2. Review connector authority
Have the cloud owner inspect each role and encryption dependency before onboarding a small nonproduction environment.

3. Establish coverage health
Track scan completion, sensor health where applicable, and a remediation owner for each resource class.

OPERATING REALITY
Cloud platform teams maintain subscription and external-cloud connectors; security teams choose plans, triage attack paths, and govern remediation. Workload owners still manage supported agents and service dependencies. Atlas would assign responsibility for encrypted disks, disconnected connectors, and newly created subscriptions before using the dashboard as an estate-wide coverage statement.

COMMERCIAL CONSIDERATIONS
Estimate each selected Defender plan against its actual protected population and usage. Include connector-side infrastructure and adjacent Azure services rather than assuming one flat CNAPP subscription.
- Enabled posture and workload plans
- Protected servers, databases, containers, storage, and other plan-specific meters
- Scan infrastructure, logging, retention, and administration

EVALUATION PLAN / PROPOSED TESTS, NOT COMPLETED RESULTS
1. Inspect an encrypted test machine
Acceptance evidence: Preserve the disk configuration, granted key permissions, actual scan result, and a deliberate unsupported or inaccessible case.
Owner: __________  Pass criterion: __________
Observed result: __________  Evidence location: __________

2. Close one posture-to-owner loop
Acceptance evidence: Trace an exposed nonproduction resource from finding to owner-approved change and fresh reassessment.
Owner: __________  Pass criterion: __________
Observed result: __________  Evidence location: __________

3. Verify purchased scope
Acceptance evidence: For each required protection, capture its plan, enablement state, resource coverage, and observed billing meter.
Owner: __________  Pass criterion: __________
Observed result: __________  Evidence location: __________

QUESTIONS FOR THE VENDOR
- Which requested functions belong to foundational posture, Defender CSPM or a workload plan?
- What agent, Arc connection or service integration does each workload actually require?
- How will the team see a disconnected connector or missing sensor before assuming a workload is covered?

EVIDENCE GAPS
- No independent prevention, sensor-overhead, or analyst-productivity measurement was performed.
- Current region, operating-system, cloud-provider, and plan support must be checked against the proposed workload matrix.

SOURCES
Defender for Cloud architecture and capabilities (Documentation)
https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-cloud-introduction
Enable agentless machine scanning (Documentation)
https://learn.microsoft.com/en-us/azure/defender-for-cloud/enable-agentless-scanning-vms
Defender for Cloud pricing by plan (Pricing)
https://azure.microsoft.com/en-us/pricing/details/defender-for-cloud/

Use synthetic fixtures in an authorized environment. Agree rollback and acceptance criteria before enforcement.
Documentation research and Atlas analysis. Independent hands-on effectiveness, effort, and complete price remain unassessed.