The two Defender for SQL plans in Defender for Cloud, what vulnerability assessment and Advanced Threat Protection give you on Azure SQL and on SQL Server on VMs or Arc, how the enhanced agent collects data, and how to enable, verify and troubleshoot both plans.
How Azure subscriptions land in Defender for Cloud on their own, how to turn plans on at management group scope with Azure Policy, and how the AWS and GCP connectors work, what they create in the other cloud, and what breaks.
Defender for Cloud as a CNAPP, the free foundational CSPM layer, the paid Defender CSPM plan, the per-workload Defender plans, how plans are switched on per subscription or connector, multicloud connectors, how alerts reach Defender XDR and Sentinel, pricing shape and roles.
Microsoft Sentinel as SIEM and SOAR on a Log Analytics workspace, its components, the analytics and data lake tiers, pricing and the E5 data grant, the Defender portal as the only home after March 2027, and how to decide on one workspace or many.
What you only get by running servers through Defender for Cloud on Plan 2, how each piece works, where the toggles are, and how to prove it is doing something.
How the classic secure score is weighted per control and subscription, how the risk-based Cloud Secure Score differs, what recommendations, exemptions and governance rules do to the number, how the regulatory compliance dashboard and its standards work, and how to pull all of it out with Resource Graph, REST, workbooks and Power BI for a client posture engagement.
How Defender for Cloud alerts are built, scored and retired, what suppression and email notifications do, how workflow automation and continuous export move alerts out of the portal, and how the Sentinel connector and the Defender XDR integration fit together without creating duplicate incidents.
The Defender for Cloud workload plans other than Servers and SQL. What each one detects, what it needs, how it is billed, how to switch it on from the portal, CLI and REST, and how to prove it fires.