Defender for Cloud.
Secure Cloud Applications, and we use it to protect Cloud Workloads. We also use it in a DLP capacity to protect cloud workspaces.
Microsoft Defender for CloudFormerly Azure Security Center
Overview
What is Microsoft Defender for Cloud?
Microsoft Defender for Cloud is a Cloud Security Posture Management (CSPM) and Cloud Workload Protection Platform (CWPP) for Azure, on-premises, and multicloud (Amazon AWS and Google GCP) resources.
Recent Reviews
Awards
Products that are considered exceptional by their customers based on a variety of criteria win TrustRadius awards. Learn more about the types of TrustRadius awards to make the best purchase decision. More about TrustRadius Awards
Reviewer Pros & Cons
Product Demos
Getting Started with Microsoft Defender for Cloud
YouTube
Product Details
- About
- Competitors
- Tech Details
- FAQs
What is Microsoft Defender for Cloud?
Microsoft Defender for Cloud is a Cloud Security Posture Management (CSPM) and Cloud Workload Protection Platform (CWPP) for Azure, on-premises, and multicloud (Amazon AWS and Google GCP) resources.
- Defender for Cloud secure score continually assesses security posture so as to enable users to track new security opportunities and precisely report on the progress of security efforts.
- Defender for Cloud recommendations secures workloads with step-by-step actions that protect workloads from known security risks.
- Defender for Cloud alerts defends workloads in real-time so users can react immediately and prevent security events from developing.
Microsoft Defender for Cloud Features
- Supported: Reduces risk with contextual security posture management
- Supported: Helps prevent, detect, and respond quickly to threats
- Supported: Unifies security management for DevOps
- Supported: Offers comprehensive cloud-native security in Microsoft Defender for Cloud with Defender for APIs security capabilities, now in public preview.
Microsoft Defender for Cloud Screenshots
Microsoft Defender for Cloud Video
Microsoft Defender for Cloud - Secure multicloud and hybrid environments
Microsoft Defender for Cloud Competitors
Microsoft Defender for Cloud Technical Details
| Deployment Types | On-premise, Software as a Service (SaaS), Cloud, or Web-Based |
|---|---|
| Operating Systems | Windows |
| Mobile Application | No |
Frequently Asked Questions
Microsoft Defender for Cloud is a Cloud Security Posture Management (CSPM) and Cloud Workload Protection Platform (CWPP) for Azure, on-premises, and multicloud (Amazon AWS and Google GCP) resources.
Amazon Web Services, Google Cloud Platform, and Palo Alto Networks Prisma Cloud are common alternatives for Microsoft Defender for Cloud.
The most common users of Microsoft Defender for Cloud are from Mid-sized Companies (51-1,000 employees).
Comparisons
Compare with
Reviews and Ratings
(72)Attribute Ratings
Reviews
(1-5 of 5)Companies can't remove reviews or game the system. Here's why
June 08, 2024
Defender for Cloud.
Secure Cloud Applications, and we use it to protect Cloud Workloads. We also use it in a DLP capacity to protect cloud workspaces.
- Protect Cloud Servers.
- Identifies threats to storage resources.
- Protects Cloud Databases.
- Security Alerts.
- Infrastructure Service Insights.
- Reduced Log Analytics.
- Adaptive application controls.
- Missing OS patches.
- Threat Detection (Positive).
- Security Monitoring and Analytics (Positive).
- Limited Azure Usage (Negative).
Currently our environment is only Cloud, and it is a combination of Azure and AWS.
The platform's threat detection capabilities are strong, making it suitable for organizations needing advanced threat intelligence and incident response. I'm not sure of the exact percentage, but it was helpful.
It does help in a sense, but we still have lots of other third-party products that can do some similar capabilities.
10
Systems admins and analysts primarily
10
Cloud Engineers and Systems Admins and Directors of Infrastructure
- Anti-Virus protection
- Endpoint management
- Security posture enhancement
- Antivirus software
- Offline scanning
- Security Center
- Malware protection
- web protection
- real-time security notifications
No
- Cloud Solutions
- Scalability
- Integration with Other Systems
- Ease of Use
Scalability with not just windows applications and equipment but will work on MacOS
Nothing to change, I would consistently stick with Microsoft Defender
The only term that answers all the three questions above is assessing the security posture of a cloud environment. A typical cloud environment can have a wide variety of resources which needs to go through an assessment process to make sure that the configurations of the resources are well tuned to be not vulnerable and weak enough for a cyberattack. Microsoft Defender for Cloud (MDC) makes our job easier by automating this task and generating security recommendations. It excels further by providing the associated remediations and impacts for the security recommendations.
- The CSPM functionality and feature of MDC provides thorough recommendations along with their remediation steps. Some recommendations also have a 'Quick Fix' functionality that makes it a one-click fix for the resource.
- The easy to use and intuitive UI of MDC is another that sets it apart from other CSPMs. It is not only the case for Azure based resources but also for AWS resources as well.
- The wide array of Cloud Workload Protection Plan features provides a variety of preventative features with an exceptionally detailed logging mechanism.
- The 'Attack Path Analysis' makes it very easy to find possible attack paths and vulnerable resources within the environment.
- 'Regulatory Compliance' is definitely an area of improvement for MDC. The complex and high number of controls within a specific framework should allow a more helpful and detailed guidelines in order to tackle them.
- The limitation of options in the incident management menu of MDC has proven to be a hassle while managing security alerts. For example, an analyst cannot even provide a comment about the actions taken on an incident.
- There is a missing functionality of connecting other EDR or XDR solutions to MDC which I think should be there for a CSPM tool.
- Thye most positive impact is that due to the recurring nature of security recommendations in MDC, organizations are now encouraged to do a more frequent security review of their environment which used to be yearly or quarterly earlier.
- The detailed categorization of the vulnerabilities and alerts provides organizations with more context and objectives to do a security-based investment.
- When going for all the MDC plans most organizations have seen a surge on their expenditures which has been a very negative impact.
We do have an on-premises presence with a few servers especially a DC with a firewall appliance in place. When it comes to cloud, we are only on Azure but with a wide variety of IaaS and PaaS resources including but not limited to VMs, API Management instances, WAFs, SQL and non-SQL DBs, Storage accounts etc.
Yes, it has. The number of security alerts are directly proportional to the number of insecure configurations of resources within the environment. By flagging those misconfigurations in great detail along with the required remediation steps, we were able to make our resources more secure and less prone to cyberattacks as before. Wildly speaking, we were able to cut down almost 40% security alerts in the past 6 months.
MDC has helped us in 3 specific category of tools - CSPM, CWPP and incident management platform. If not for MDC, we would have to acquire these products separately from different vendors giving us an economical and operational overhead. Not to forget, we are also utilizing it as an DevOps security tool replacing an IaC tool. If I were to make an assumption, it is nearly saving us about approximately 15000$/year.
9999
The people who use the Defender for Cloud portal are usually from the below teams or business units:
Infrastructure and Security
IT Administration
Regulatory Compliance
Customer Service and Support
There are also teams that uses the portal to create proof of concepts for on-boarding, migration or simply consultation projects for various clients.
Infrastructure and Security
IT Administration
Regulatory Compliance
Customer Service and Support
There are also teams that uses the portal to create proof of concepts for on-boarding, migration or simply consultation projects for various clients.
999
There will be a dedicated 'Customer Service & Support' (CSS) team to provide support and troubleshooting assistance for any technical or non - technical issues related to Microsoft Defender for Cloud. These people have skills ranging from agent management, vulnerability assessment, incident management, event analysis, and governance management to name a few.
- Most important use case will be to conduct preliminary compliance audits against a variety of compliance standards in an automated fashion for the various cloud resources.
- Another one will be to get to know the vulnerabilities across the critical asses across the organization to remediate or at least prevent them from being exploited.
- Improve the security of servers with the advanced workload protection features like file integrity monitoring, adaptive application control and just in time access.
- Conduct weekly and monthly security assessments for organizations to assess their cloud security posture over time.
- We have been able to leverage Defender for Cloud as an effective security reporting tool for the various cloud workloads using Azure Resource Graph queries.
- We have been able to leverage Defender for Cloud as a reliable security monitoring tool using the governance and recommendations feature.
- We have been able to leverage Defender for Cloud as a reliable code integrity testing tool for our Infrastructure as Code repositories.
- A part time vulnerability assessment tool
- A tool for hardening container security
- A tool to analyze and implement entitlement management across the cloud infrastructure
It is the best cloud security solutions offered by Microsoft which we are using in our organization to protects cloud environment which hosted on Microsoft Azure.
Scope : To protect cloud resources hosted on Microsoft Azure including Azure VM, databases, storage account and web applications.
Business Problems Addressed as below:
Threat Detection and response : It helps in detecting the attack such as malware infections, unauthorized access and provides alerts and then automated responses to mitigate the risks.
Identity and Access management : Helps in protecting user identities and access to azure resources.
Security Configuration management : Identify the misconfiguration that might exposes the vulnerabilities and provides recommendation.
Scope : To protect cloud resources hosted on Microsoft Azure including Azure VM, databases, storage account and web applications.
Business Problems Addressed as below:
Threat Detection and response : It helps in detecting the attack such as malware infections, unauthorized access and provides alerts and then automated responses to mitigate the risks.
Identity and Access management : Helps in protecting user identities and access to azure resources.
Security Configuration management : Identify the misconfiguration that might exposes the vulnerabilities and provides recommendation.
- Scalibility
- Identity and access management
- Automated remediation
- Real Time monitoring and alerts
- Integration with Non-Microsoft environments
- Streamline the UI and provide user-friendly guidance
- Need more customization and reporting.
- Positive : Enhanced Security and reducing the risk of data breaches and cyberattack
- Positive : Resource optimization
- Negative : Licensing Costs
We feels our organization resources on Microsoft Azure is safe and secure with the helps of Microsoft Defender for Cloud which protects and provide the security against latest cyberattack and malwares. We only have Azure environment running with windows machine.
Yes, Microsoft Defender for Cloud helps us a lot in reducing the number of threat alerts.
It helps in reducing the threat alerts via automate response actions for certain types of threats, such as isolating a compromised virtual machine or blocking a malicious IP address. This reduces the need for manual intervention and minimizes alert fatigue.
Almost it helps us in cut down the threat alerts related to critical and vulnerable to outside attacks.
It helps in reducing the threat alerts via automate response actions for certain types of threats, such as isolating a compromised virtual machine or blocking a malicious IP address. This reduces the need for manual intervention and minimizes alert fatigue.
Almost it helps us in cut down the threat alerts related to critical and vulnerable to outside attacks.
Yes, its help in reduce the number of third party products to protect our infrastructure.
Our organization resources mostly hosted on Azure and Office365 so Microsoft Defender for Cloud is best for us and cover many of security needs within Azure environment. It saves us lots of time for us in searching of 3rd party products which provide the security and cover the security needs what we are looking for. By using Microsoft Defender for Cloud which well suited for us in windows environment which cover the security needs what we require.
Our organization resources mostly hosted on Azure and Office365 so Microsoft Defender for Cloud is best for us and cover many of security needs within Azure environment. It saves us lots of time for us in searching of 3rd party products which provide the security and cover the security needs what we are looking for. By using Microsoft Defender for Cloud which well suited for us in windows environment which cover the security needs what we require.
10
Most important it will Protects our organization’s IT infrastructure and data from cyber threats. We are using this for Monitor alerts, investigate incidents, and respond to threats. It provide protection to our end points devices and respond to the threats.
10
It need ability or skills of analyze security alerts, identify potential threats, and understand their implications. Experience in responding to and managing security incidents. Also it need Strong troubleshooting skills to resolve security-related issues and support end-users.
- Threat Detection and response which helps our organization to quickly detect and mitigate threats, reducing the risk of data breaches.
- Vulnerability Management which helps us in preventing exploitation by attackers and maintain secure environment.
- Incident response and automation this is most important and helps when ever any threats or incidents report then immediate response to the threats and reduce the response times.
- Proactively threat analysis which helps in analyze the deep dives into logs and identify the unusual activities and login times or suspicious IP addresses.
- With helps of defender and integrate to the business intelligence tools for visualization of data like overall security scores, risk assessments and different metric which helps in taking strategic decisions.
- By analysis past incident data and security trends, identify the patterns which indicates increase of risk of upcoming attacks and take preventive action.
- With help of Defender to monitor and enforce strict access controls, so that only authenticated and authorized entities can access sensitive resources.
- Automation of incident response so it will helps in swift and response to secutity threats.
- With the help of Behavior Analysis which helps in detecting insider threats.
June 04, 2024
Microsoft Defender for Cloud review
Score 8 out of 10
Vetted Review
Verified User
Defender for Cloud is being used as a tool on one side to give insights in the security posture (CSPM) of all the workloads, have inventory of all resource, be able to query very quickly for specific resources and the specifics of those. On the other hand it is used a protection tool (CWPP) to protect the workloads in the Azure platform. It is capable to detect malicious behavior on the resources that are protected and actively alert on that.
- The integration with Azure workloads is very good and easy to configure
- It gives good insights in the security posture, compliancy, and active threats on a broad scale
- It even integrates as a CSPM in multi-cloud scenarios (GWC/AWS)
- The licensing structure could be better by providing possibilities for partial deployment in a subscription
- The information in the dashboards are sometimes scattered, there should be a better overall view
- Some parts of Defender for Cloud are expensive, some features should be moved to the standard capabilities of Azure
- It creates a great insight in all assets that are available
- The CSPM makes sure that certain risk that might have been missed are addressed
- Being able to query across the data gives great insights in threats and possible vulernabilties for CVEs
At this moment it is a single-cloud , cloud-only platform. Azure is the main platform for all our workloads, we protect this with all the Defender products, including Defender for Cloud. All alerts an incidents are forwarded to Sentinel for security monitoring. The environment consists of multiple subscriptions, ranging from dev/test to acceptance, production and customer facing subscriptions
The CSPM feature really lowers the number of alerts and incidents in Sentinel. Often misconfigurations make that certain incidents will happen and have to looked in to. Now we look at the posture beforehand and try to mitigate a risk before an incident will happne. We do not have exact numbers, but a bad configured azure portal can create quite some noise in the SOC, we can easily lower the number of incidents by 10%
Yes, Defender for Cloud does do this for us. We now have a vulnerability scanner for example that would otherwise be a 3rd party solution. Things like asset management and attack surface management can now be done from one tool. I do not know what exactly the licensing costs will save us .. but we incorpate 4-5 tools in a single solution now (cloud asset management, vulnerability scanner, security posture, workload protection and ci/cd protection)
10
security staff that will monitor and act upon incidents
platform management that will perform the configuration and installation task
compliancy staff who will monitor and configure the compliancy related items. Often the tasks will blend a little between the three defined roles
platform management that will perform the configuration and installation task
compliancy staff who will monitor and configure the compliancy related items. Often the tasks will blend a little between the three defined roles
2
the security consultant / architect will mostly oversee the functionality and capabilities of the defender for cloud solution.
They are security focussed, but know what the platform does, how it works and what de desired configuration should be. They have and understanding of the Azure platform, both from an infrastructural as a security perspective
They are security focussed, but know what the platform does, how it works and what de desired configuration should be. They have and understanding of the Azure platform, both from an infrastructural as a security perspective
- Security posture monitoring
- Cloud workload protection
- EDR deployment
- cloud asset management > cmdb
- Darktrace enrichment
- DevSecOps > Github
- Integration with EASM
Score 8 out of 10
Vetted Review
Verified User
Microsoft Defender for Cloud is a very powerful security solution that provides protection for all of your devices and cloud servers and as a result we saw a significant decline in spam, phishing attempts and other online attacks after implementing it. And my personal favorite is the vault feature which gives me a totally isolated space to keep my documents which can't be accessed by others unless they have a pin and a passphrase which is given by me. Also from time to time, it runs a full system scan on our devices and provides us with security recommendations if needed.
- Quite easy to set it up and start monitoring all your devices and cloud servers.
- Automatically scans your devices at a fixed time interval that you can easily set within the app.
- Again, my personal favorite, the vault feature is a fantastic way to protect your important files.
- Just like any other security solution, it also has false positives but they are very few and occur rarely.
- Had some issues while integrating it with google cloud.
- Again, integrating with devices or systems that are not from microsoft may cause some issues.
- Easily integrated with our existing Azure servers.
- Consumes less resources and runs a full system scan on fixed intervals.
- Much cheaper and more powerful than other similar solutions.
20
20
The people who use Microsoft Defender for Cloud are mostly security analysts and people who have a good amount of experience in handling online cloud providers like Microsoft Azure.
- 24/7 protection as it runs silently in the background.
- Has a secret vault feature to protect important files and documents.
- Provides detailed logs for further analysis by our security analysts.
- Even though other similar security solutions could detect and provide logs about that threat, none of them provided such detailed logs as Microsoft Defender for Cloud does.