Azure Security Center (Defender for Cloud) Inside-Out

Microsoft renamed security center to Defender for Cloud, with workload protections replacing Azure Defender and environment settings renamed, while all other options stay the same.

Enable Azure security center from the dashboard, use the free tier, and ensure you have a subscription and a subscription contributor or security admin role to activate defender for cloud.

Enable Azure Defender to activate Defender plan in Azure Security Center, compare free plan and Defender modes, and enable plan per subscription or resource type with pricing and trial options.

Explore the Azure Defender dashboard to monitor resource security, view upgrade options, and see insights on top alerts, exposed ports, and features like just-in-time access and adaptive network hardening.

Enable subscription-level log analytics agent deployment to auto-install on all current and future VMs for full security center functionality; reuse an existing workspace to avoid multiple workspaces.

Learn how cloud connectors extend Azure Security Center to VMs in other clouds, enabling multi-cloud security with unified monitoring by connecting enterprise accounts, selecting subscriptions, and providing credentials.

Enable the Defender plan on the Log Analytics workspace to avoid misconfiguration and reduced functionality, ensuring full protection and visibility of all features in Security Center and pricing settings.

Auto provisioning enables security center data agents to improve recommendations, including the log agent, vulnerability assessment, Microsoft vulnerability management, dependency and policy agents, and VM insight, with preview testing advised.

Review security alerts in defendable cloud, shown on the security alerts tab with severity and investigation details. Use take action to block the source, trigger automation, or set suppression rules.

Learn to create rules to suppress alerts for a period or permanently, set expiration dates, and simulate dismissal to reduce non-genuine alerts in Defender for Cloud.

Discover how the security alerts map identifies origins and target regions of attacks, helping you pinpoint hostile states or countries driving threats.

Explore how Azure Security Center uses secure score to quantify your security posture across resources and subscriptions. Track progress over time on the overview page to communicate readiness to stakeholders.

Explore how the Azure Security Center groups recommendations into controls, each a logical set of related actions, with MFA themes and secure management ports, and learn how scores are calculated.

Begin with a top-down approach; each control has a maximum score by importance, and points come from fully remediating all items across affected resources, with points divided per resource.

Discover autofix in Azure Security Center (Defender for Cloud) that automatically deploys fixes on affected resources, earns compliance points, and delivers full compliance within 24 hours after deployment.

Learn to create exemptions, waivers, or mitigated categories for systems where you cannot implement recommendations, ensuring those resources are not penalized or counted against your score.

Calculate the secure score for each subscription using a weighted function based on deployed resources. Track the overall score over time to demonstrate security posture and readiness to stakeholders.

Enforce deny mode in security center policies prevents creation of non-compliant resources, keeping your secure score high while ensuring correct configuration and remediation.

Enable continuous export of the secure score to a Log Analytics workspace to view its changes over time in the prebuilt workbook chart.

Explore how Security Center recommendations enable automated fixes, such as provisioning data collection agents on eligible machines and disabling blob public access across storage accounts, to quickly resolve issues.

Explore how deny and enforce options in Azure Security Center prevent creation of unhealthy resources, ensuring resources added after policy takes effect comply with security settings.

Explore the inventory dashboard in Azure Security Center to view resources and subscriptions with their security state and recommendations, using filters by source types, environment, and vulnerabilities.

Explore how Azure Security Center uses built-in initiatives to validate regulatory compliance against PCI and ISO standards and automatically assign the Microsoft security benchmark to the subscription.

Create exemptions for Azure Security Center controls at security, management group, subscription, and resource levels, with optional expiration and categorization, and observe impact on compliance scores.

Manage compliance policies by adding, disabling, or deleting security standards at the subscription level, create custom initiatives, and track compliance in the regulatory compliance dashboard.

Explore why some security controls remain unavailable for automated compliance in Azure Security Center, and how the compliance dashboard reflects non-automatable or process-driven controls, plus expected lag for CIA standards.

Track compliance over time using the regulatory compliance dashboard and the compliance over time workbook; export data to a log analytics workspace to view streaming updates and snapshots.

Track compliance over time by selecting a log analytics workspace and a subscription to view standard scores and show improvements from 20% to 80%, with dashboards for security operations monitoring.

Learn how file integrity monitoring works by using log analytics agents on each VM to collect data, upload it to a workspace, and detect file differences.

Show how inventory data is collected at specific frequencies—Windows registry every 15 minutes and files every 30 minutes—plus a per-machine limit of 500 files and daily snapshots.

Explore file integrity monitoring within the change tracking dashboard, view registry key changes, deletions, and before-and-after values, then filter events and demo an application installation with log analytics.

Configure file integrity monitoring by selecting registry keys, Windows and Linux files, folders, and services to monitor, with recursive options, and enable optional file contents tracking via a storage account.

Log into a system, introduce changes by installing apps, altering services, and modifying the host file, then observe how Security Center detects and reports these changes in the change-tracking demo.

Track file integrity monitoring changes in Azure Security Center by analyzing registry and file changes, using the log analytics workspace default query to verify configuration changes.

Learn to filter and query Windows service changes in Defender for Cloud to identify who changed a service and when, using change type filters, distinct services, and cake rule queries.

Examine how software changes are detected in change tracking, using queries and filters to reveal installed or updated apps, including non-microsoft software, for security alerts.

Lecture explains why a Feigenbaum change wasn't detected due to using the report name instead of the actual file name and demonstrates recursion in the directory with 30 minute wait.

Retake demonstrates detecting file content changes using blob links and two snapshots to compare pre and post states in the portal.

Click disable to turn off change tracking in the workspace, after which the related features will no longer work.

Discover how application control in Defender for Cloud reduces workload by building a baseline of running apps and creating allow lists to alert on unauthorized software, using app locker capabilities.

Explore the obligation control dashboard to view configured, recommended, and no recommendation vms groups, and see how adaptive application control groups vms by workload, agent presence, and data availability.

Create custom groups in Defender for Cloud, assign and move VMs between groups, and configure adaptive application control rules, including publisher and hash-based rules with auditing and allow lists.

Demonstrate adaptive application control by detecting unauthorized software like TeamViewer, triggering alerts for processes outside the allow list, and preparing for the AAC demo in Defender for Cloud.

Learn to navigate Azure Security Center alerts, review medium severity detections, inspect details such as hosts, users, and file hashes, and configure suppression rules for adaptive application control incidents.