Securing Azure with Defender for Cloud and Sentinel
Defender for Cloud
Defender for Cloud combines cloud security posture management with workload protection. The free foundational CSPM gives Secure Score, recommendations, and Azure Policy-based assessments; Defender plans (Servers, Storage, SQL, Containers, App Service, Key Vault, DNS, Resource Manager, APIs) add threat detection, vulnerability assessment, and advanced posture features such as attack path analysis. Secure score is a weighted percentage of healthy resources - you raise it by remediating recommendations, not by dismissing them. Regulatory compliance dashboards map assessments to standards such as PCI DSS, ISO 27001, and NIST. Remediation options are fix, quick fix (DeployIfNotExists), exemption, or disabling the policy. Alerts can flow outward via continuous export to Log Analytics or Event Hubs, and workflow automation can trigger Logic Apps.
Microsoft Sentinel
Sentinel is a cloud-native SIEM/SOAR built on a Log Analytics workspace. Data connectors ingest; analytics rules (Scheduled, NRT, Fusion for multistage attacks, ML behavior analytics) create incidents; automation rules and playbooks (Logic Apps) respond; workbooks visualize; hunting queries with bookmarks support proactive search; watchlists enrich detections. Entity mapping decides which fields become accounts, hosts, and IPs on an incident, which drives investigation graphs.
Rule of thumb. "Posture and per-resource protection → Defender for Cloud; detection, correlation, and response → Sentinel." Traps: Fusion rules are on by default and cannot be edited, only enabled or disabled; automation rules run independently of playbooks; Sentinel roles (Reader, Responder, Contributor) are separate from Log Analytics Workspace Contributor; retention beyond the included period is billable; suppression rules hide alerts without remediating the underlying issue.