The two Defender for SQL plans in Defender for Cloud, what vulnerability assessment and Advanced Threat Protection give you on Azure SQL and on SQL Server on VMs or Arc, how the enhanced agent collects data, and how to enable, verify and troubleshoot both plans.
Every documented product-to-product link in the Defender family, where each switch lives, what it needs, what it unlocks, and how to prove it is working.
Every way a server can be licensed for Defender for Endpoint - Defender for Servers Plan 1 and Plan 2 through Defender for Cloud, the standalone Defender for Endpoint for Servers licence, and the Defender for Business servers add-on - with the billing model, OS support and how to enable the plan by portal, CLI and ARM.
How Azure subscriptions land in Defender for Cloud on their own, how to turn plans on at management group scope with Azure Policy, and how the AWS and GCP connectors work, what they create in the other cloud, and what breaks.
Let Defender for Servers push the MDE.Windows and MDE.Linux extension to Azure VMs and Azure Arc machines, with the Endpoint protection setting, direct onboarding, multicloud connectors, verification and offboarding.
Defender for Cloud as a CNAPP, the free foundational CSPM layer, the paid Defender CSPM plan, the per-workload Defender plans, how plans are switched on per subscription or connector, multicloud connectors, how alerts reach Defender XDR and Sentinel, pricing shape and roles.
How Defender for Endpoint protects servers in two models, standalone MDE onboarding with a per-device server licence or Defender for Servers through Defender for Cloud billed per server-hour, what each gives up, how direct onboarding bridges them, and a decision tree.
What you only get by running servers through Defender for Cloud on Plan 2, how each piece works, where the toggles are, and how to prove it is doing something.
How the classic secure score is weighted per control and subscription, how the risk-based Cloud Secure Score differs, what recommendations, exemptions and governance rules do to the number, how the regulatory compliance dashboard and its standards work, and how to pull all of it out with Resource Graph, REST, workbooks and Power BI for a client posture engagement.
How Defender for Cloud alerts are built, scored and retired, what suppression and email notifications do, how workflow automation and continuous export move alerts out of the portal, and how the Sentinel connector and the Defender XDR integration fit together without creating duplicate incidents.
The Defender for Cloud workload plans other than Servers and SQL. What each one detects, what it needs, how it is billed, how to switch it on from the portal, CLI and REST, and how to prove it fires.