Install the mdatp package on supported Linux distros with the installer script, the package repo or the Defender for Cloud MDE.Linux extension, onboard it, set proxy and AV policy through mdatp_managed.json or security settings management, and tune the eBPF sensor.
Let Defender for Servers push the MDE.Windows and MDE.Linux extension to Azure VMs and Azure Arc machines, with the Endpoint protection setting, direct onboarding, multicloud connectors, verification and offboarding.
What you only get by running servers through Defender for Cloud on Plan 2, how each piece works, where the toggles are, and how to prove it is doing something.
Every action on a Defender portal device page, what it does, what it needs, OS support and how to undo it, then Live Response in depth with the command set, library, limits and the API.