1 00:00:00,000 --> 00:00:04,560 Hello everyone and welcome to another episode of Microsoft Knowledge Nuggets here on M365, 2 00:00:04,560 --> 00:00:06,840 FM, I'm Mirko Peters. 3 00:00:06,840 --> 00:00:10,320 So Microsoft Defender for Cloud sounds like antivirus, right? 4 00:00:10,320 --> 00:00:14,460 That's a fair guess because the Defender name shows up on a lot of Microsoft security tools. 5 00:00:14,460 --> 00:00:18,360 But here's the thing, Defender for Cloud isn't there to scan your laptop for a bad file 6 00:00:18,360 --> 00:00:20,040 that watches your whole cloud setup. 7 00:00:20,040 --> 00:00:24,600 Think of it this way, Defender for Endpoint keeps security inside a single room. 8 00:00:24,600 --> 00:00:29,320 It watches one laptop or server for malware, strange programs, or signs someone is trying 9 00:00:29,320 --> 00:00:30,320 to take control. 10 00:00:30,320 --> 00:00:33,520 Defender for Cloud watches the entire office building around that room. 11 00:00:33,520 --> 00:00:37,600 It checks who can enter, it checks whether a side door faces the street, it looks at the 12 00:00:37,600 --> 00:00:42,640 locks, the alarms, the storage rooms, and the rules that decide who can reach sensitive 13 00:00:42,640 --> 00:00:43,640 areas. 14 00:00:43,640 --> 00:00:45,280 In plain English it helps you see three things. 15 00:00:45,280 --> 00:00:49,200 How safely your cloud resources are set up, whether something suspicious is happening, 16 00:00:49,200 --> 00:00:50,400 and what you should fix first. 17 00:00:50,400 --> 00:00:54,240 A warning might tell you a door is unlocked, an active threat alert tells you somebody may 18 00:00:54,240 --> 00:00:56,120 already be trying that door. 19 00:00:56,120 --> 00:00:57,120 That difference matters. 20 00:00:57,120 --> 00:01:00,640 Let's start with why cloud security becomes messy so quickly. 21 00:01:00,640 --> 00:01:02,800 Why cloud security breaks down so easily? 22 00:01:02,800 --> 00:01:08,320 Years ago, a company might have had a small server room, a few physical servers, and one 23 00:01:08,320 --> 00:01:10,160 team looking after most of it. 24 00:01:10,160 --> 00:01:11,440 The setup moved slowly. 25 00:01:11,440 --> 00:01:14,160 Today, a company can create a new virtual machine in minutes. 26 00:01:14,160 --> 00:01:18,000 A developer can add storage for a project, another team can create a database, someone else 27 00:01:18,000 --> 00:01:19,800 can run containers for an app. 28 00:01:19,800 --> 00:01:23,000 Each part may have its own team and its own security tool. 29 00:01:23,000 --> 00:01:27,320 You might have one tool for servers, another for databases, another for storage, and another 30 00:01:27,320 --> 00:01:28,320 for containers. 31 00:01:28,320 --> 00:01:31,640 Each tool shows part of the picture, but nobody sees the full building. 32 00:01:31,640 --> 00:01:32,640 That creates gaps. 33 00:01:32,640 --> 00:01:35,480 A storage account might allow public access by mistake. 34 00:01:35,480 --> 00:01:39,960 A virtual machine might leave remote desktop protocol RDP open to the internet. 35 00:01:39,960 --> 00:01:43,960 On Linux, it could be secure shell or SSH, an old admin account might still have access 36 00:01:43,960 --> 00:01:46,080 months after a contractor leaves. 37 00:01:46,080 --> 00:01:48,880 A server might miss security updates because it only ran as a short test. 38 00:01:48,880 --> 00:01:50,760 None of these mistakes need a clever attacker. 39 00:01:50,760 --> 00:01:52,680 They only need one unlock side door. 40 00:01:52,680 --> 00:01:54,440 The cloud environments change all the time. 41 00:01:54,440 --> 00:01:58,880 A resource that looked safe on Monday can become exposed on Tuesday because somebody changes 42 00:01:58,880 --> 00:02:03,920 one setting, creates a new network rule, or copies an old template with weak permissions, 43 00:02:03,920 --> 00:02:04,920 still inside. 44 00:02:04,920 --> 00:02:06,400 You've probably seen this in real life. 45 00:02:06,400 --> 00:02:08,400 A team needs a quick test server. 46 00:02:08,400 --> 00:02:11,920 They create a virtual machine, give it a public address so they can connect from home and 47 00:02:11,920 --> 00:02:14,360 open RDP or SSH because it's faster. 48 00:02:14,360 --> 00:02:15,360 The test works. 49 00:02:15,360 --> 00:02:18,880 Then the project ends, people move on, and that server stays online. 50 00:02:18,880 --> 00:02:20,200 It's public door remains open. 51 00:02:20,200 --> 00:02:22,640 Nobody means for that to happen, but it happens because cloud resources are easy to 52 00:02:22,640 --> 00:02:24,520 create and easy to forget. 53 00:02:24,520 --> 00:02:26,680 Now add the way many companies really work. 54 00:02:26,680 --> 00:02:28,480 You may have workloads in Azure. 55 00:02:28,480 --> 00:02:31,240 You may still run servers in your own office or data center. 56 00:02:31,240 --> 00:02:34,120 A supplier may use Amazon Web Services or AWS. 57 00:02:34,120 --> 00:02:36,240 Another team might use Google Cloud Platform. 58 00:02:36,240 --> 00:02:38,280 Security doesn't stay in one portal anymore. 59 00:02:38,280 --> 00:02:40,760 A long list of alerts doesn't solve that problem either. 60 00:02:40,760 --> 00:02:44,520 If you see hundreds of warnings without knowing which one exposes customer data, which 61 00:02:44,520 --> 00:02:48,760 one affects a test system, and which one creates a route towards something sensitive, you 62 00:02:48,760 --> 00:02:50,200 still don't know where to begin. 63 00:02:50,200 --> 00:02:51,200 You need context. 64 00:02:51,200 --> 00:02:55,080 You need to know what exists, what faces the internet, who can access it and which fix 65 00:02:55,080 --> 00:02:56,400 removes the most risk. 66 00:02:56,400 --> 00:02:57,800 That's where Defender for Cloud starts. 67 00:02:57,800 --> 00:03:00,880 It looks for the weak doors before somebody gets inside. 68 00:03:00,880 --> 00:03:02,560 Cloud security posture management. 69 00:03:02,560 --> 00:03:05,280 The first building block is Cloud security posture management. 70 00:03:05,280 --> 00:03:08,280 That name sounds heavy, so let me put it in plain English. 71 00:03:08,280 --> 00:03:11,080 It's a regular safety inspection for your cloud resources. 72 00:03:11,080 --> 00:03:14,200 Instead of walking around a real building with a clipboard, Defender for Cloud checks 73 00:03:14,200 --> 00:03:16,360 the settings around your cloud services. 74 00:03:16,360 --> 00:03:20,080 It looks for things that could leave a resource exposed, a weak network rule, missing 75 00:03:20,080 --> 00:03:25,160 encryption, too much access, or a setting that no longer matches your company's rules. 76 00:03:25,160 --> 00:03:27,800 And these checks keep running as your environment changes. 77 00:03:27,800 --> 00:03:31,040 That matters because Cloud security isn't something you set once and forget. 78 00:03:31,040 --> 00:03:34,080 A resource can be created, changed, copied, or moved at any time. 79 00:03:34,080 --> 00:03:38,160 Defender for Cloud keeps checking the current setup rather than relying on a review someone 80 00:03:38,160 --> 00:03:39,160 completed months ago. 81 00:03:39,160 --> 00:03:41,320 You'll often see something called Secure Score. 82 00:03:41,320 --> 00:03:43,880 Think of it like an inspection score for a large office site. 83 00:03:43,880 --> 00:03:47,800 It gives you a view of how many recommended safety controls are in place and where work 84 00:03:47,800 --> 00:03:49,840 remains. It isn't a pass or fail test. 85 00:03:49,840 --> 00:03:52,360 A score of 100 doesn't mean no risk exists. 86 00:03:52,360 --> 00:03:55,360 It means the checks included in that score look healthy. 87 00:03:55,360 --> 00:03:57,920 And a lower score doesn't mean your cloud has already been breached. 88 00:03:57,920 --> 00:04:00,880 It means Defender for Cloud found settings that deserve attention. 89 00:04:00,880 --> 00:04:02,160 The score gives you direction. 90 00:04:02,160 --> 00:04:05,520 But more useful than the number itself are the recommendations behind it. 91 00:04:05,520 --> 00:04:09,160 A recommendation tells you what needs attention, which resources face the risk and what 92 00:04:09,160 --> 00:04:10,160 change can reduce it. 93 00:04:10,160 --> 00:04:14,640 You might see that a particular storage account allows access wider than your policy permits. 94 00:04:14,640 --> 00:04:17,840 Or a virtual machine might not have a control your security baseline expects. 95 00:04:17,840 --> 00:04:19,320 You don't need to guess where to look. 96 00:04:19,320 --> 00:04:22,920 The recommendation points to the resource and explains the issue in a way the right team 97 00:04:22,920 --> 00:04:24,040 can act on. 98 00:04:24,040 --> 00:04:26,760 That turns a vague warning into a piece of work with a clear owner. 99 00:04:26,760 --> 00:04:29,120 But not every finding deserves the same response. 100 00:04:29,120 --> 00:04:30,400 Imagine you find two issues. 101 00:04:30,400 --> 00:04:31,760 One affects a small test resource. 102 00:04:31,760 --> 00:04:32,920 No one can reach from outside. 103 00:04:32,920 --> 00:04:37,640 The other affects a public facing resource that can reach customer data or a sensitive system. 104 00:04:37,640 --> 00:04:39,040 You fix the second one first. 105 00:04:39,040 --> 00:04:41,440 That's the thinking behind risk-based priority. 106 00:04:41,440 --> 00:04:44,600 Defender for Cloud tries to help you spend time where a weak setting could lead. 107 00:04:44,600 --> 00:04:48,680 To something more serious rather than treating every warning as equal. 108 00:04:48,680 --> 00:04:51,400 This leads to a term you may see called an attack path. 109 00:04:51,400 --> 00:04:54,560 An attack path is a possible route an attacker could use. 110 00:04:54,560 --> 00:04:57,200 Starting from a weak point and moving towards something important. 111 00:04:57,200 --> 00:04:59,160 Maybe a resource has public access. 112 00:04:59,160 --> 00:05:02,120 Maybe that resource connects to an identity with broad permissions. 113 00:05:02,120 --> 00:05:05,120 Maybe that identity can reach a database holding sensitive information. 114 00:05:05,120 --> 00:05:06,440 Defender for Cloud can show that chain. 115 00:05:06,440 --> 00:05:08,280 It doesn't mean an attacker has used the route. 116 00:05:08,280 --> 00:05:11,880 It means the route exists and you should decide whether to close it before somebody does. 117 00:05:11,880 --> 00:05:12,880 That's a big difference. 118 00:05:12,880 --> 00:05:18,480 Parts help you see why a small setting can matter far beyond the resource where it first appeared. 119 00:05:18,480 --> 00:05:21,400 A public endpoint on its own might look like one minor issue. 120 00:05:21,400 --> 00:05:26,160 Connected to a powerful identity and sensitive data it becomes a much higher priority. 121 00:05:26,160 --> 00:05:29,280 Sometimes several attack paths share the same weak point. 122 00:05:29,280 --> 00:05:30,880 Microsoft calls these choke points. 123 00:05:30,880 --> 00:05:34,520 A choke point is one place where fix can close several possible routes at once. 124 00:05:34,520 --> 00:05:39,480 For example, tightening access on one identity or removing one unnecessary public connection 125 00:05:39,480 --> 00:05:41,520 can reduce risk across multiple resources. 126 00:05:41,520 --> 00:05:42,520 That saves time. 127 00:05:42,520 --> 00:05:46,800 Instead of fixing 10 related symptoms one by one, your security and cloud teams can focus 128 00:05:46,800 --> 00:05:48,240 on the shared cause. 129 00:05:48,240 --> 00:05:50,960 Defender for Cloud also uses policies and compliance checks. 130 00:05:50,960 --> 00:05:54,680 The policy is a rule you apply across your Azure subscriptions and resources. 131 00:05:54,680 --> 00:05:59,200 You might set a rule that storage needs encryption that certain network ports can't remain open, 132 00:05:59,200 --> 00:06:03,320 or that resources need a specific security setting before people use them. 133 00:06:03,320 --> 00:06:04,800 Policies create consistency. 134 00:06:04,800 --> 00:06:08,880 Without them, each team can build resources in its own way and security becomes a manual 135 00:06:08,880 --> 00:06:10,480 check after the fact. 136 00:06:10,480 --> 00:06:15,680 As policies you can check whether resources follow the same rules as they are created and changed. 137 00:06:15,680 --> 00:06:17,040 But there's a common mistake here. 138 00:06:17,040 --> 00:06:21,400 Many teams leave policies in audit only mode and assume those policies will stop risky setups. 139 00:06:21,400 --> 00:06:22,920 Audit mode only reports the issue. 140 00:06:22,920 --> 00:06:26,560 It tells you someone created something outside the rule but it doesn't block the change. 141 00:06:26,560 --> 00:06:31,240 That can be a sensible starting point while you learn what existing resources might break. 142 00:06:31,240 --> 00:06:34,640 Once you understand the impact and fix the older issues, some high risk rules may need 143 00:06:34,640 --> 00:06:35,800 stronger enforcement. 144 00:06:35,800 --> 00:06:39,320 So the goal isn't to chase a perfect score or read every alert in every portal. 145 00:06:39,320 --> 00:06:43,800 To build a clear work list, you see which resources need attention, which risks connect to sensitive 146 00:06:43,800 --> 00:06:47,560 targets and which single fix removes several parts at once. 147 00:06:47,560 --> 00:06:50,960 That gives security teams and cloud teams a shared place to start. 148 00:06:50,960 --> 00:06:56,280 A safer setup reduces the easy opportunities but it can't stop every threat already in motion. 149 00:06:56,280 --> 00:07:00,760 Workload protection, post your management, checks the setup around your cloud services. 150 00:07:00,760 --> 00:07:03,360 Workload protection looks at the things actually running there. 151 00:07:03,360 --> 00:07:05,640 Think about everything your company puts to work in the cloud. 152 00:07:05,640 --> 00:07:09,320 A virtual machine runs an old business app. A database holds customer records, a storage 153 00:07:09,320 --> 00:07:13,600 account keeps uploaded files, containers run parts of a modern app, a web app handles customer 154 00:07:13,600 --> 00:07:14,600 requests. 155 00:07:14,600 --> 00:07:17,840 Those are workloads, Defender for cloud ads protection based on the workload you need to 156 00:07:17,840 --> 00:07:18,840 protect. 157 00:07:18,840 --> 00:07:22,960 It doesn't treat a database, a server and a container as though they all face the same 158 00:07:22,960 --> 00:07:23,960 risks. 159 00:07:23,960 --> 00:07:24,960 That's the point. 160 00:07:24,960 --> 00:07:25,960 It's work happens in two parts. 161 00:07:25,960 --> 00:07:30,600 First, it looks for weak spots before trouble starts, known software weaknesses or missing 162 00:07:30,600 --> 00:07:31,600 security settings. 163 00:07:31,600 --> 00:07:36,200 Then it watches for signs of suspicious activity while the workload runs so it can help you 164 00:07:36,200 --> 00:07:39,120 find a weakness on a server before an attacker finds it. 165 00:07:39,120 --> 00:07:43,440 It can also alert you if activity on that server looks wrong, such as malware signals, unusual 166 00:07:43,440 --> 00:07:46,680 changes, or an attempt to use a known attack method. 167 00:07:46,680 --> 00:07:49,120 Microsoft groups these protections into Defender plans. 168 00:07:49,120 --> 00:07:51,520 You choose plans based on what you run. 169 00:07:51,520 --> 00:07:54,480 If you have virtual machines, you look at Defender for servers. 170 00:07:54,480 --> 00:07:58,200 If your business stores files in Azure Storage, you look at Defender for Storage. 171 00:07:58,200 --> 00:08:02,280 If you run containers or databases, there are plans and checks designed for those workloads. 172 00:08:02,280 --> 00:08:05,800 There isn't one large switch that gives every resource the same protection. 173 00:08:05,800 --> 00:08:08,440 That would create cost and noise where you may not need it. 174 00:08:08,440 --> 00:08:12,920 Instead, you decide which workloads hold important data, support important services, or face 175 00:08:12,920 --> 00:08:15,520 more exposure than turn on the right protection for them. 176 00:08:15,520 --> 00:08:17,040 Let's use a server as an example. 177 00:08:17,040 --> 00:08:21,200 Defender for servers can help find software weaknesses on Windows and Linux servers. 178 00:08:21,200 --> 00:08:24,720 It can report missing updates and show where a known weakness affects a machine. 179 00:08:24,720 --> 00:08:29,100 It can also monitor file changes, which matters when a file or system setting changes in a 180 00:08:29,100 --> 00:08:32,360 way that needs investigation, malware signals matter too. 181 00:08:32,360 --> 00:08:36,200 A server can look healthy from the outside while something harmful runs inside its operating 182 00:08:36,200 --> 00:08:37,200 system. 183 00:08:37,200 --> 00:08:40,200 That's where Defender for Endpoint can connect with Defender for Cloud. 184 00:08:40,200 --> 00:08:42,640 The name sound close, but their jobs are different. 185 00:08:42,640 --> 00:08:44,640 Defender for Endpoint watches the device itself. 186 00:08:44,640 --> 00:08:48,200 It sees activity inside the operating system, processes, files, and behavior on a laptop 187 00:08:48,200 --> 00:08:49,200 or server. 188 00:08:49,200 --> 00:08:52,080 Defender for Cloud looks at the Cloud resource around that device. 189 00:08:52,080 --> 00:08:56,240 It sees the server's cloud setting, its network exposure, the workload protection plan, 190 00:08:56,240 --> 00:08:58,440 and the broader risk connected to that resource. 191 00:08:58,440 --> 00:09:00,520 Together, they give you a fuller picture. 192 00:09:00,520 --> 00:09:04,800 Imagine Defender for Endpoint detects suspicious activity on a virtual machine. 193 00:09:04,800 --> 00:09:08,320 On its own, that alert tells you something may be wrong inside the server. 194 00:09:08,320 --> 00:09:12,400 Defender for Cloud adds context around it, is the virtual machine open to the internet. 195 00:09:12,400 --> 00:09:13,400 Which team owns it? 196 00:09:13,400 --> 00:09:15,360 Does it connect to a sensitive database? 197 00:09:15,360 --> 00:09:17,280 Is there a known weakness on the same machine? 198 00:09:17,280 --> 00:09:21,560 What should the Cloud or Infrastructure team fix while the security team investigates? 199 00:09:21,560 --> 00:09:27,080 It changes the conversation from "We have an alert" to "This server has suspicious activity, 200 00:09:27,080 --> 00:09:30,800 it has public exposure, and this is the person who needs to act." 201 00:09:30,800 --> 00:09:34,080 One practical feature for virtual machines is just in time access. 202 00:09:34,080 --> 00:09:38,040 Many administrators need RDP for Windows servers or SSH for Linux servers. 203 00:09:38,040 --> 00:09:41,480 The risky approach is to leave those management ports open all the time because somebody may 204 00:09:41,480 --> 00:09:42,480 need them later. 205 00:09:42,480 --> 00:09:44,280 Just in time access takes a different approach. 206 00:09:44,280 --> 00:09:48,440 It keeps the management door closed, then opens it for a shorter proof period when an administrator 207 00:09:48,440 --> 00:09:49,680 needs to connect. 208 00:09:49,680 --> 00:09:51,840 After that time expires the door closes again. 209 00:09:51,840 --> 00:09:55,800 You don't leave access available every day just because you might need it next week. 210 00:09:55,800 --> 00:09:57,640 Storage needs its own type of protection. 211 00:09:57,640 --> 00:10:02,840 A storage account may hold documents, backups, reports or files uploaded by customers. 212 00:10:02,840 --> 00:10:07,440 Defender for storage can scan uploaded files for malware and raise alerts around suspicious 213 00:10:07,440 --> 00:10:08,440 access. 214 00:10:08,440 --> 00:10:13,040 It can also help you understand when sensitive data may sit in a place that needs more attention. 215 00:10:13,040 --> 00:10:17,320 That matters because a harmful file in storage may not cause trouble until somebody downloads 216 00:10:17,320 --> 00:10:19,480 it or another service starts processing it. 217 00:10:19,480 --> 00:10:22,640 Containers and databases need different checks again. 218 00:10:22,640 --> 00:10:26,720 Containers often run quickly and in large numbers so their protection focuses on the images, 219 00:10:26,720 --> 00:10:29,720 settings and behavior connected to container workloads. 220 00:10:29,720 --> 00:10:35,840 Databases need attention around suspicious queries, log in activity and data related threats. 221 00:10:35,840 --> 00:10:38,080 The goal isn't to use one generic scan for everything. 222 00:10:38,080 --> 00:10:41,320 It's to apply protection that matches the job each workload performs. 223 00:10:41,320 --> 00:10:45,120 Still, every one of these protections depends on something very basic. 224 00:10:45,120 --> 00:10:48,880 Defender for cloud can only protect and report on resources it can see. 225 00:10:48,880 --> 00:10:53,680 And once you look beyond a single Azure subscription, that becomes a much bigger question. 226 00:10:53,680 --> 00:10:56,880 One view across Azure on premises and other clouds. 227 00:10:56,880 --> 00:10:59,600 Most companies don't keep every workload in one place. 228 00:10:59,600 --> 00:11:04,200 You might run most of your services in Azure while an older server still runs in your office. 229 00:11:04,200 --> 00:11:08,200 A business unit may use Amazon Web Services, often called AWS. 230 00:11:08,200 --> 00:11:12,560 Another team may have services in Google Cloud Platform or GCP that leaves you with separate 231 00:11:12,560 --> 00:11:15,560 portal, separate lists and separate ways to find problems. 232 00:11:15,560 --> 00:11:18,760 It's like having three different security guards who don't talk to each other. 233 00:11:18,760 --> 00:11:22,880 Defender for cloud can bring connected Azure on premises, AWS and GCP environments into 234 00:11:22,880 --> 00:11:23,920 one security view. 235 00:11:23,920 --> 00:11:25,240 The aim is simple. 236 00:11:25,240 --> 00:11:29,800 Instead of opening one dashboard to check Azure virtual machines, another for AWS accounts, 237 00:11:29,800 --> 00:11:33,440 and a third system for servers in your own building, you can view the security state of 238 00:11:33,440 --> 00:11:35,880 those connected environments in one place. 239 00:11:35,880 --> 00:11:38,840 That one view saves you from jumping between screens and losing context. 240 00:11:38,840 --> 00:11:41,840 Now that doesn't mean every cloud works exactly the same way. 241 00:11:41,840 --> 00:11:47,280 Azure, AWS, GCP and on premises systems each have their own services, access rules and 242 00:11:47,280 --> 00:11:48,520 connection methods. 243 00:11:48,520 --> 00:11:52,640 And Defender for cloud can collect security information from the environments you connect, 244 00:11:52,640 --> 00:11:56,480 then show the findings in a common view that reduces the chance of missing context. 245 00:11:56,480 --> 00:12:01,440 For example, an alert on a server means more when you can also see whether that server belongs 246 00:12:01,440 --> 00:12:08,080 to a cloud subscription sits in an AWS account or runs as part of an older on premises service. 247 00:12:08,080 --> 00:12:12,960 The security team can spend less time asking where is this resource and more time deciding 248 00:12:12,960 --> 00:12:14,360 what needs attention. 249 00:12:14,360 --> 00:12:17,680 Before you can protect something, you need to know it exists. 250 00:12:17,680 --> 00:12:19,360 This is where asset inventory matters. 251 00:12:19,360 --> 00:12:23,480 An asset inventory is simply a list of the things your company owns or runs in the cloud. 252 00:12:23,480 --> 00:12:28,320 That can include virtual machines, databases, storage accounts, container clusters and other 253 00:12:28,320 --> 00:12:29,320 services. 254 00:12:29,320 --> 00:12:31,600 It sounds obvious, but cloud resources appear fast. 255 00:12:31,600 --> 00:12:36,400 A project team may create a test environment, a supplier may create resources in another cloud 256 00:12:36,400 --> 00:12:37,400 account. 257 00:12:37,400 --> 00:12:41,480 An old workload may keep running after the person who built it has moved to another role. 258 00:12:41,480 --> 00:12:45,160 If it isn't in your inventory, it can easily fall outside your security work. 259 00:12:45,160 --> 00:12:47,160 Defender for cloud helps you see the resources. 260 00:12:47,160 --> 00:12:51,840 It knows about, along with their security coverage, you can see whether a resource has protection, 261 00:12:51,840 --> 00:12:55,320 has only part of the protection you expect or has no protection at all. 262 00:12:55,320 --> 00:12:56,720 That last group needs attention. 263 00:12:56,720 --> 00:13:01,520 An unprotected resource isn't always unsafe by itself, but if a production database or internet 264 00:13:01,520 --> 00:13:05,600 facing server has no planned coverage, that's a gap you need to understand. 265 00:13:05,600 --> 00:13:09,200 A coverage view turns vague assumptions into a list you can check. 266 00:13:09,200 --> 00:13:10,800 Are all our servers protected? 267 00:13:10,800 --> 00:13:12,600 Becomes a real question with a real answer. 268 00:13:12,600 --> 00:13:14,600 Permissions matter too. 269 00:13:14,600 --> 00:13:19,200 A large company doesn't want every person in the security portal to see and manage every resource. 270 00:13:19,200 --> 00:13:21,920 The infrastructure team may need to work with server findings. 271 00:13:21,920 --> 00:13:24,080 The database team may need to see database findings. 272 00:13:24,080 --> 00:13:29,240 A team responsible for one business area may only need access to that area's cloud resources. 273 00:13:29,240 --> 00:13:31,840 Cloud scopes and permissions help create those boundaries. 274 00:13:31,840 --> 00:13:35,040 Think of a cloud scope as a defined area someone can work with. 275 00:13:35,040 --> 00:13:39,640 You can connect a role to specific environments, subscriptions or resource groups, so people 276 00:13:39,640 --> 00:13:43,400 see what they are responsible for without gaining access to everything else. 277 00:13:43,400 --> 00:13:45,320 That keeps responsibility clear. 278 00:13:45,320 --> 00:13:48,440 The infrastructure team can focus on servers and their related findings. 279 00:13:48,440 --> 00:13:51,840 At the same time, the database team can review database findings and deal with the systems 280 00:13:51,840 --> 00:13:52,840 they own. 281 00:13:52,840 --> 00:13:56,400 Both teams work from the same connected security picture, but neither team needs to manage 282 00:13:56,400 --> 00:13:57,640 the other team's services. 283 00:13:57,640 --> 00:13:59,800 There is one limit you should always remember. 284 00:13:59,800 --> 00:14:03,680 Defender for cloud can only report on environments that you have connected and unborted. 285 00:14:03,680 --> 00:14:07,040 If an Azure subscription isn't included, it can become a blind spot. 286 00:14:07,040 --> 00:14:10,880 If an AWS account has not been connected, Defender for cloud can't report on the resources 287 00:14:10,880 --> 00:14:11,880 inside it. 288 00:14:11,880 --> 00:14:16,840 The same applies to GCP and on-premises servers that haven't been brought into the service. 289 00:14:16,840 --> 00:14:19,000 No dashboard can show what it doesn't know about. 290 00:14:19,000 --> 00:14:21,080 Incomplete onboarding causes a common problem. 291 00:14:21,080 --> 00:14:24,880 A company sees a need security dashboard assumes it covers the whole business and later finds 292 00:14:24,880 --> 00:14:28,600 a forgotten subscription or separate cloud account that never appeared in the view. 293 00:14:28,600 --> 00:14:31,520 So review your coverage before you trust the results. 294 00:14:31,520 --> 00:14:32,920 Ask which subscriptions exist. 295 00:14:32,920 --> 00:14:35,400 Ask who owns AWS and GCP accounts. 296 00:14:35,400 --> 00:14:37,480 Ask whether older servers are still in use. 297 00:14:37,480 --> 00:14:40,840 Then compare that list with what Defender for cloud can actually see. 298 00:14:40,840 --> 00:14:44,320 Once the view is connected, compliance becomes much more useful than a spreadsheet full of 299 00:14:44,320 --> 00:14:45,640 old checks. 300 00:14:45,640 --> 00:14:47,960 Compliance without the spreadsheet chase. 301 00:14:47,960 --> 00:14:51,240 Compliance means checking whether your cloud settings meet rules your company has agreed to 302 00:14:51,240 --> 00:14:52,240 follow. 303 00:14:52,240 --> 00:14:56,520 Those rules may come from a customer contract, a legal requirement, an industry standard, 304 00:14:56,520 --> 00:14:58,440 or your own internal security policy. 305 00:14:58,440 --> 00:15:01,800 In the past, this often meant someone collecting screenshots before an audit. 306 00:15:01,800 --> 00:15:06,000 They would ask whether encryption was enabled, whether logging was turned on or whether access 307 00:15:06,000 --> 00:15:07,880 rules matched company policy. 308 00:15:07,880 --> 00:15:12,520 By the time the spreadsheet reached the auditor, parts of the environment may already have changed. 309 00:15:12,520 --> 00:15:14,360 Cloud services don't wait for annual reviews. 310 00:15:14,360 --> 00:15:17,920 Defender for cloud gives you a way to check cloud resources against built in standards on 311 00:15:17,920 --> 00:15:19,080 an ongoing basis. 312 00:15:19,080 --> 00:15:24,800 You may see standards such as CIS, NIST, ISO 27001, HIPAA, PCI DSS, and the Microsoft Cloud 313 00:15:24,800 --> 00:15:26,160 Security benchmark. 314 00:15:26,160 --> 00:15:29,240 You don't need to memorize every standard to understand the basic idea. 315 00:15:29,240 --> 00:15:30,680 Each one contains controls. 316 00:15:30,680 --> 00:15:32,840 A control is a rule or expected safeguard. 317 00:15:32,840 --> 00:15:37,480 It might check whether a setting is enabled, whether access is restricted or whether a 318 00:15:37,480 --> 00:15:40,000 resource follows a required configuration. 319 00:15:40,000 --> 00:15:43,720 The compliance view shows which checks passed, which checks failed, and which resources cause 320 00:15:43,720 --> 00:15:44,800 the failed result. 321 00:15:44,800 --> 00:15:47,120 That makes a large standard easier to work with. 322 00:15:47,120 --> 00:15:51,040 Rather than seeing a line that says control failed, you can look deeper and see the affected 323 00:15:51,040 --> 00:15:52,040 resources. 324 00:15:52,040 --> 00:15:55,200 You can also see suggested repairs tied to the findings, so the person responsible for 325 00:15:55,200 --> 00:15:56,920 the resource has a starting point. 326 00:15:56,920 --> 00:16:00,280 Imagine an auditor asks whether your cloud storage follows a particular rule. 327 00:16:00,280 --> 00:16:05,040 Instead of searching through old notes, you can review the current control status, see 328 00:16:05,040 --> 00:16:08,760 the resources included in the check and identify any open issues. 329 00:16:08,760 --> 00:16:12,280 Your security team gets a work list, your auditor gets evidence based on the environment 330 00:16:12,280 --> 00:16:13,440 as it looks now. 331 00:16:13,440 --> 00:16:15,800 The checks keep updating as resources change. 332 00:16:15,800 --> 00:16:20,080 If someone changes a cloud setting after the last audit, that change can appear in the 333 00:16:20,080 --> 00:16:21,080 compliance view. 334 00:16:21,080 --> 00:16:25,840 This turns compliance from a once a year scramble into a regular part of managing cloud resources. 335 00:16:25,840 --> 00:16:28,240 That saves time, but it also creates accountability. 336 00:16:28,240 --> 00:16:31,480 A failed control shows that a rule needs attention. 337 00:16:31,480 --> 00:16:35,920 The team that owns the affected resource can fix it, document an accepted exception, or explain 338 00:16:35,920 --> 00:16:37,120 why the setting doesn't apply. 339 00:16:37,120 --> 00:16:41,440 The result becomes clearer than a spreadsheet where nobody knows who last updated a cell. 340 00:16:41,440 --> 00:16:45,600 Still, a high compliance score doesn't guarantee safety from every attack. 341 00:16:45,600 --> 00:16:48,080 Compliance checks whether you meet a defined set of rules. 342 00:16:48,080 --> 00:16:49,920 Attackers don't limit themselves to a checklist. 343 00:16:49,920 --> 00:16:54,000 A resource can meet a standard and still face a new software weakness, a stolen password, 344 00:16:54,000 --> 00:16:56,080 or suspicious activity that needs investigation. 345 00:16:56,080 --> 00:17:00,360 So use compliance as a way to check your agreed rules and keep evidence current. 346 00:17:00,360 --> 00:17:03,120 Use it to find gaps, assign work and show progress. 347 00:17:03,120 --> 00:17:06,560 All of this can feel large when you first open the portal, which is why the best next move 348 00:17:06,560 --> 00:17:08,160 is a simple first week plan. 349 00:17:08,160 --> 00:17:10,160 How to start without turning on everything. 350 00:17:10,160 --> 00:17:11,160 So how do you begin? 351 00:17:11,160 --> 00:17:13,960 First, make a simple map of what you actually run. 352 00:17:13,960 --> 00:17:19,000 List your Azure subscriptions, then your servers, storage accounts, databases, container services, 353 00:17:19,000 --> 00:17:22,600 and any workloads in AWS, Google Cloud, or your own data center. 354 00:17:22,600 --> 00:17:23,600 Keep it practical. 355 00:17:23,600 --> 00:17:25,480 You're trying to answer one question. 356 00:17:25,480 --> 00:17:27,880 What needs protection and where does it live? 357 00:17:27,880 --> 00:17:31,760 Once you have that map, connect the environments you want to fend off for Cloud to monitor. 358 00:17:31,760 --> 00:17:35,640 But before you dive into hundreds of recommendations, check the coverage view first. 359 00:17:35,640 --> 00:17:39,000 Findings only help when you know whether the right resources are showing up. 360 00:17:39,000 --> 00:17:40,480 Begin with Posture Management. 361 00:17:40,480 --> 00:17:43,760 Review your secure score, then look at the highest risk findings behind it. 362 00:17:43,760 --> 00:17:45,720 Don't try to clear every warning on day one. 363 00:17:45,720 --> 00:17:49,240 Instead look for problems that keep appearing across your environment. 364 00:17:49,240 --> 00:17:54,280 Public exposure, weak identity controls, open management ports, and missing patches. 365 00:17:54,280 --> 00:17:56,520 Those are often the fastest places to reduce risk. 366 00:17:56,520 --> 00:18:01,120 Next, choose Workload Protection Plans based on the services you really use and the risk they carry. 367 00:18:01,120 --> 00:18:05,040 A production server, holding business data, deserves different attention than a short-lived 368 00:18:05,040 --> 00:18:07,280 test system with no sensitive information. 369 00:18:07,280 --> 00:18:11,800 So turn on protection with a reason for servers that need deeper device level detection, 370 00:18:11,800 --> 00:18:14,240 connect Microsoft Defender for Endpoint. 371 00:18:14,240 --> 00:18:18,400 That gives you a better view of activity inside the operating system, while Defender for Cloud 372 00:18:18,400 --> 00:18:20,960 keeps the Cloud resource and its exposure in view. 373 00:18:20,960 --> 00:18:23,640 Then assign an owner to every finding that needs action. 374 00:18:23,640 --> 00:18:27,280 A recommendation without an owner becomes a reminder that nobody handles. 375 00:18:27,280 --> 00:18:31,920 Your infrastructure team may own server fixes, your app team may own a database setting, and 376 00:18:31,920 --> 00:18:35,760 your security team may track the work and review whether it was completed. 377 00:18:35,760 --> 00:18:37,160 Set a regular review time. 378 00:18:37,160 --> 00:18:40,640 Weekly may suit a busy environment, while monthly may suit a smaller one. 379 00:18:40,640 --> 00:18:43,040 The schedule matters less than making it routine. 380 00:18:43,040 --> 00:18:44,880 You aren't trying to reach a perfect score. 381 00:18:44,880 --> 00:18:48,920 You're removing the easy paths into your Cloud, one clear fix at a time. 382 00:18:48,920 --> 00:18:52,760 Think of Defender for Cloud as a security guard who checks how your Cloud is set up, protects 383 00:18:52,760 --> 00:18:57,280 the important rooms and points your teams towards the risks that deserve attention first. 384 00:18:57,280 --> 00:19:00,440 For a simple challenge, connect one Azure subscription this week. 385 00:19:00,440 --> 00:19:04,560 Check which resources appear in coverage, find the most exposed resource, and assign someone 386 00:19:04,560 --> 00:19:05,560 to fix it. 387 00:19:05,560 --> 00:19:09,000 That gives you a real starting point, not another security dashboard to ignore. 388 00:19:09,000 --> 00:19:13,360 The next, knowledge nugget to explore is Microsoft Defender for Endpoint versus Defender 389 00:19:13,360 --> 00:19:14,520 for Cloud. 390 00:19:14,520 --> 00:19:18,000 One watches what happens on devices, the other watches the Cloud resources around them, 391 00:19:18,000 --> 00:19:20,880 and together they help you see both sides of the same security problem.