How Azure subscriptions land in Defender for Cloud on their own, how to turn plans on at management group scope with Azure Policy, and how the AWS and GCP connectors work, what they create in the other cloud, and what breaks.
Defender for Cloud as a CNAPP, the free foundational CSPM layer, the paid Defender CSPM plan, the per-workload Defender plans, how plans are switched on per subscription or connector, multicloud connectors, how alerts reach Defender XDR and Sentinel, pricing shape and roles.
How the classic secure score is weighted per control and subscription, how the risk-based Cloud Secure Score differs, what recommendations, exemptions and governance rules do to the number, how the regulatory compliance dashboard and its standards work, and how to pull all of it out with Resource Graph, REST, workbooks and Power BI for a client posture engagement.
How Defender for Cloud alerts are built, scored and retired, what suppression and email notifications do, how workflow automation and continuous export move alerts out of the portal, and how the Sentinel connector and the Defender XDR integration fit together without creating duplicate incidents.
The Defender for Cloud workload plans other than Servers and SQL. What each one detects, what it needs, how it is billed, how to switch it on from the portal, CLI and REST, and how to prove it fires.