Skip to main content
Microsoft Defender for Cloud is a cloud-native security solution that strengthens your Azure environment by combining proactive recommendations with reactive incident management. In this guide, we’ll cover its two primary use cases—Incident Management and Security Optimization—along with core components that power these scenarios.

​
Key Use Cases

  • Incident Management: A structured response cycle to detect, assess, and remediate threats.
  • Security Optimization: Continuous policy enforcement and actionable recommendations to harden your environment.

​
1. Incident Management

Microsoft Defender for Cloud provides a repeatable cycle to handle security incidents from detection to closure.

​
1.1 Detect

Verify that a high-severity security alert has been generated in the Azure portal or exported to your SIEM.

​
1.2 Assess

Collect detailed information about the alert, including affected resources, timeline, and potential impact.

​
1.3 Diagnose

Follow the remediation steps recommended by the alert. Common actions include isolating compromised resources, rotating credentials, and applying patches.

​
1.4 Stabilize and Close

Confirm that the threat has been neutralized, apply any remaining mitigations, then officially close the incident.
Enable continuous export of security alerts to integrate Defender for Cloud with your SIEM or ITSM workflows.

​
2. Security Optimization

Security Optimization in Defender for Cloud helps you establish a strong security baseline and continuously reinforce it:
  1. Configure Security Policies
    Define your desired security posture by assigning built-in or custom policies at subscription or resource group scope.
  2. Review Recommendations
    Defender for Cloud analyzes your configuration and generates prioritized recommendations.
  3. Remediate
    Accept or automate fixes using Azure Policy, Azure Blueprints, or your favorite IaC tool.
The image outlines two use cases for Microsoft Defender for Cloud: incident management and security optimization. Scenario 1 focuses on a cycle of detection, diagnosis, stabilization, and closure, while Scenario 2 emphasizes establishing and acting on security policies and recommendations.
This diagram illustrates how Defender for Cloud continuously monitors Azure resources, collects security telemetry, and surfaces actionable insights to maintain a strong cloud security posture.

​
Continuous Monitoring & Analysis

Defender for Cloud uses built-in sensors and services to collect logs, network traffic data, and threat intelligence. It then correlates events to detect sophisticated attacks, compromised accounts, and lateral movement.
The image is an informational graphic about Microsoft Defender for Cloud, highlighting its use cases such as monitoring, traffic analysis, and security insights. It emphasizes its role in detecting sophisticated threats and potential security breaches.

​
Core Components of Microsoft Defender for Cloud

ComponentDescriptionDeployment Regions
PortalCentral console for managing alerts, policies, and recommendations.Global
SensorMonitors domain controller traffic and resource logs for anomalous activity.Global
ServiceLeverages the Microsoft Intelligent Security Graph for threat intelligence and advanced analytics.US, Europe, Asia
Enabling all recommendations at once may increase your operational costs. Review priority and impact before remediation.
By combining these components, Defender for Cloud helps you:
  • Detect and investigate advanced threats
  • Respond rapidly with guided remediation
  • Continuously enforce security best practices

​
References

Watch Video