Forum Widgets
Latest Discussions
How are you presenting CSPM and CNAPP insights to your executive leadership?
Hi everyone, I'm a Cloud Security Specialist at Microsoft, working closely with Microsoft Defender for Cloud, and I wanted to start a conversation with the community — partly out of curiosity, but also to learn from your real-world experiences. When it comes to reporting cloud security posture to your executive leadership (CISO, CTO, or broader security/tech leadership), how are you presenting insights from CSPM, CNAPP, or Defender for Containers? Specifically, how do you communicate findings such as: Misconfigurations Vulnerabilities Risk exposure across your cloud environments? Are you using: Power BI dashboards to centralize and visualize the data? Manual Excel reports? The native Defender for Cloud portal? Or even exploring Microsoft Fabric for more advanced reporting scenarios? I’d love to hear how you’re turning technical insights into executive-level narratives. Do you follow a particular structure, reporting cadence, or set of best practices? Looking forward to hearing how others in the community are approaching this challenge — and how you're bridging the gap between cloud security and business strategy.
Defender for Servers
Defender for servers is part of Defender for Cloud CWP. We do not use this product, however we have interest in logging Servers both on-premise and multi cloud tenants to Sentinel workspace. Couple of ways to accomplish: Defender for Servers in passive - Since we're currently not subscribed can we get data in with ARC + AMA + Defender extension across multi cloud tenant? Objective is to NOT pay for Defender for Servers p1/p2 instead log Events for detections Azure Monitor Agent and Data Collection Rule with logging level (Common, Minimal, Custom) I've ideas on both but I'm leaning towards Defender for Servers in passive with Defender Extension and AMA. Will this automatically get charge as part of Defender for Server CWP or it flat out won't work if not enabled? I can't get straight answer on this from anyone and I don't have full blown tenant owner permission to test this. When asked there is wait time to get response from other teams. I'm interested getting data in via Defender in Passive relying and relaying partner as Defender Extension and ARC+AMA. Let me know your thoughts!
DevOps Security: MDC-ADO integration through Service account
Hi All, Is it possible to integrate MDC-ADO Integration with Service Account? When I attempted to authorize ADO in MDC during the integration process, it appears to only accept individual accounts. Does anyone have insights on how to utilize a Service Account for this integration?Cost Calculator for Defender for Cloud (Public Preview)
Did you know Microsoft Defender for Cloud has a built-in cost calculator to easily calculate the costs of protected resources in your cloud environment? No? Well, I didn’t either until I stumbled upon the button in the MDC portal myself. Apparently, Microsoft announced the preview for the MDC cost calculator last month, on February 19, 2025. With this post, I’m sharing my experience with this new cost calculator for Microsoft Defender for Cloud, providing guidance and comparing available options to calculate the costs. https://myronhelgering.com/cost-calculator-for-defender-for-cloud/Sensitivity Data Flag will not be deleted after Settings are changed
We have a lot of storage accounts which are flaged with risk factor "Sensitive Data" which also means all storage Accounts which have this label have risklevel critical. We deactivated Sensitive Data Scan but nothing happens As I got it correct once a resource is flagged with "Sensitive Data" the flag will not delete anymore What we did so far: turn off/on/off… the data scanning turn off/on/off Data sensitivity deselect all of different data sensitivity categories like Finance, PII, and Credentials turn off/on/off threshold for sensitive data labels turn off/on complete Defender There is also a support ticket where the support can the recommendation was to open a discussion here to have the product team look at this error (#2502031420002278)
Alert FineTuning(Sev:Low): Vulnerability Scanner Detection
Hi, we are seeing a high number of "Vulnerability Scanner Detection" alerts and facing challenges during analysis: The alerts often show Microsoft IP addresses, and some of them appear malicious. Can we fine-tune this to capture the actual IP scanning the environment? How can we determine whether the scan was successful or failed, for example, by using status codes like 200 or 404? Is there a way to identify if the app service is using platforms like Joomla, Drupal, WordPress, or others? Looking forward to your support on this.
Enable Bring Your Own License (BYOL)
A customer uses Bring your own license (BYOL) capability, which is being deprecated, to deploy Qualys extension in their VMs. They are questioning about the deprecation, this deprecation implicates the deploy won't be more available, but what happen with the machines already has deployed the Qualys extension? Will the extension be removed from machines, since it was deployed via BYOL? Or after deprecated the extension continues working for the already deployed machines?Defender for Servers plans
Article: defender-for-servers This article states the plan names as Defender for Servers Plan 1 and 2. Neither of these show up in the licensing marketplace. I do see "Microsoft Defender for Business servers", but there are no level 1 or 2 options. The article above was last updated 12/2024. Not sure where to go from here.
Defender for Database - SQL Server on Machine Pricing
Hi Folks , while we enable defender on Databases ( enable SQL server on machine ) do we also need to enable on Server ( which is running SQL Server). Also defender for Server cost - 15$ /server/month and SQL Server on Machine cost -15$/Server/month, Separate cost for both will be applicable ? apart from enabling toggle do we need any addition configuration for enabling defender for Databases ?what is recommended setting of workspace for AMA configuration ( default or custom ) can we choose sentinel workspace ?
How to programmatically assign security standards on Defender for Cloud
Hi all, i would like to know if there is a way to programmatically (REST API, Terraform,...) activate custom secutity Standards on Defender for Cloud. Basically the step 6 on this guide https://learn.microsoft.com/en-us/azure/defender-for-cloud/update-regulatory-compliance-packages. I didn't found any way to do that. I have a policySet that i would like to activate in an automated way. Any ideas? Thank you in advance!
