Overview: CSPM, CWPP and how the plans fit
Defender for Cloud as a CNAPP, the free foundational CSPM layer, the paid Defender CSPM plan, the per-workload Defender plans, how plans are switched on per subscription or connector, multicloud connectors, how alerts reach Defender XDR and Sentinel, pricing shape and roles.
Onboarding Azure subscriptions, AWS accounts and GCP projects
How Azure subscriptions land in Defender for Cloud on their own, how to turn plans on at management group scope with Azure Policy, and how the AWS and GCP connectors work, what they create in the other cloud, and what breaks.
Secure Score, recommendations, governance and regulatory compliance
How the classic secure score is weighted per control and subscription, how the risk-based Cloud Secure Score differs, what recommendations, exemptions and governance rules do to the number, how the regulatory compliance dashboard and its standards work, and how to pull all of it out with Resource Graph, REST, workbooks and Power BI for a client posture engagement.
Workload plans: Storage, Containers, Key Vault, App Service, APIs, Resource Manager
The Defender for Cloud workload plans other than Servers and SQL. What each one detects, what it needs, how it is billed, how to switch it on from the portal, CLI and REST, and how to prove it fires.
Security alerts, workflow automation and the Sentinel/XDR integration
How Defender for Cloud alerts are built, scored and retired, what suppression and email notifications do, how workflow automation and continuous export move alerts out of the portal, and how the Sentinel connector and the Defender XDR integration fit together without creating duplicate incidents.