[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M750Z95494G5JZA03C8E4T51":3,"skill-same:01M750Z95494G5JZA03C8E4T51":72},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":16,"sourceHtmlUrl":17,"categories":18,"keywords":19,"publishedAt":20,"linkOnly":21,"markdownContent":22,"markdownBody":23,"frontMatter":24,"refName":36,"commitSha":37,"skillDirectory":5,"forksCount":14,"repositoryHtmlUrl":38,"repositoryHomepageUrl":6,"ownerHtmlUrl":39,"ownerBlogUrl":40,"ownerDescription":6,"updatedAt":41,"install":42,"resources":55},"01M750Z95494G5JZA03C8E4T51","implementing-azure-defender-for-cloud",null,"Implementing Microsoft Defender for Cloud to enable cloud security posture management, workload protection across VMs, containers, databases, and storage, configure security recommendations, and set up adaptive security controls with automated remediation.","SamuelChien\u002Fmega-skills-collection","SamuelChien","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F4652114?v=4","01M74KK34WVHA0P5ZYSJRDDFMG","Samuel Chien","01M74KK35FQN1N9VZ9EPTH3P2S",0,"Apache-2.0","https:\u002F\u002Fgithub.com\u002FSamuelChien\u002Fmega-skills-collection\u002Fblob\u002Fmain\u002Fimplementing-azure-defender-for-cloud\u002FLICENSE","https:\u002F\u002Fgithub.com\u002FSamuelChien\u002Fmega-skills-collection\u002Fblob\u002Fmain\u002Fimplementing-azure-defender-for-cloud\u002FSKILL.md",[],[],"2026-11-12 13:55:43",false,"---\nname: implementing-azure-defender-for-cloud\ndescription: >\n  Implementing Microsoft Defender for Cloud to enable cloud security posture management,\n  workload protection across VMs, containers, databases, and storage, configure security\n  recommendations, and set up adaptive security controls with automated remediation.\ndomain: cybersecurity\nsubdomain: cloud-security\ntags: [cloud-security, azure, defender-for-cloud, cspm, cwpp, security-recommendations]\nversion: \"1.0\"\nauthor: mahipal\nlicense: Apache-2.0\n---\n\n# Implementing Azure Defender for Cloud\n\n## When to Use\n\n- When enabling comprehensive security monitoring across Azure subscriptions\n- When implementing cloud workload protection for VMs, containers, SQL, storage, and Key Vault\n- When compliance requirements demand continuous assessment against regulatory frameworks\n- When building adaptive security controls that respond to detected threats\n- When centralizing security findings from Azure-native and hybrid workloads\n\n**Do not use** for non-Azure workload protection exclusively (use AWS Security Hub or GCP SCC), for application-level security testing (use Azure DevOps DAST\u002FSAST), or for identity-specific protection (use Microsoft Defender for Identity).\n\n## Prerequisites\n\n- Azure subscription with Contributor or Security Admin role\n- Azure Policy enabled for compliance assessment\n- Log Analytics workspace for diagnostic data collection\n- Azure Arc connected machines for hybrid server protection\n- Pricing tier set to Standard for Defender plans (free tier provides CSPM only)\n\n## Workflow\n\n### Step 1: Enable Defender for Cloud Plans\n\nEnable the appropriate Defender plans for each workload type requiring protection.\n\n```bash\n# Enable Defender for Cloud CSPM (foundational posture management)\naz security pricing create --name CloudPosture --tier standard\n\n# Enable Defender for Servers\naz security pricing create --name VirtualMachines --tier standard \\\n  --subplan P2\n\n# Enable Defender for Containers\naz security pricing create --name Containers --tier standard\n\n# Enable Defender for Storage\naz security pricing create --name StorageAccounts --tier standard \\\n  --subplan PerStorageAccount\n\n# Enable Defender for SQL\naz security pricing create --name SqlServers --tier standard\n\n# Enable Defender for Key Vault\naz security pricing create --name KeyVaults --tier standard\n\n# Enable Defender for App Service\naz security pricing create --name AppServices --tier standard\n\n# Verify all enabled plans\naz security pricing list \\\n  --query \"[].{Plan:name, Tier:pricingTier, SubPlan:subPlan}\" -o table\n```\n\n### Step 2: Configure Auto-Provisioning of Security Agents\n\nEnable automatic deployment of monitoring agents to VMs and containers.\n\n```bash\n# Enable auto-provisioning of Log Analytics agent\naz security auto-provisioning-setting update \\\n  --name default --auto-provision on\n\n# Configure Log Analytics workspace for data collection\naz security workspace-setting create \\\n  --name default \\\n  --target-workspace \"\u002Fsubscriptions\u002FSUB_ID\u002FresourceGroups\u002FRG\u002Fproviders\u002FMicrosoft.OperationalInsights\u002Fworkspaces\u002FSecurityWorkspace\"\n\n# Enable Defender for Containers auto-provisioning components\naz security setting update \\\n  --name Sentinel \\\n  --setting-kind DataExportSettings\n\n# Verify auto-provisioning status\naz security auto-provisioning-setting list -o table\n```\n\n### Step 3: Review and Prioritize Security Recommendations\n\nRetrieve security recommendations and prioritize remediation based on secure score impact.\n\n```bash\n# Get the current secure score\naz security secure-score list \\\n  --query \"[].{Name:displayName, Current:current, Max:max, Percentage:percentage}\" -o table\n\n# List all active security recommendations\naz security assessment list \\\n  --query \"[?status.code=='Unhealthy'].{Name:displayName, Severity:metadata.severity, Category:metadata.category, ResourceCount:status.cause}\" \\\n  -o table\n\n# Get recommendations sorted by severity\naz security assessment list \\\n  --query \"[?status.code=='Unhealthy'] | sort_by(@, &metadata.severity)\" \\\n  -o table\n\n# Get detailed recommendation with remediation steps\naz security assessment show \\\n  --name ASSESSMENT_ID \\\n  --query \"{Name:displayName, Description:metadata.description, Severity:metadata.severity, Remediation:metadata.remediationDescription}\"\n\n# List recommendations by control\naz security secure-score-controls list \\\n  --query \"[].{Control:displayName, CurrentScore:current, MaxScore:max, NotHealthy:notHealthyResourceCount}\" \\\n  -o table\n```\n\n### Step 4: Configure Regulatory Compliance Dashboard\n\nEnable compliance standards and monitor adherence across subscriptions.\n\n```bash\n# List available regulatory compliance standards\naz security regulatory-compliance-standards list \\\n  --query \"[].{Standard:name, State:state}\" -o table\n\n# Enable specific compliance standards\naz security regulatory-compliance-standards update \\\n  --name \"CIS-Azure-2.0\" --state \"Enabled\"\n\naz security regulatory-compliance-standards update \\\n  --name \"PCI-DSS-4.0\" --state \"Enabled\"\n\naz security regulatory-compliance-standards update \\\n  --name \"NIST-SP-800-53-R5\" --state \"Enabled\"\n\n# Get compliance status for a specific standard\naz security regulatory-compliance-controls list \\\n  --standard-name \"CIS-Azure-2.0\" \\\n  --query \"[].{Control:id, Description:displayName, State:state, PassedResources:passedResources, FailedResources:failedResources}\" \\\n  -o table\n\n# Get failing assessments for a control\naz security regulatory-compliance-assessments list \\\n  --standard-name \"CIS-Azure-2.0\" \\\n  --control-name \"2.1\" \\\n  --query \"[?state=='Failed'].{Assessment:id, State:state}\" -o table\n```\n\n### Step 5: Set Up Security Alerts and Automation\n\nConfigure alert notifications and automated response workflows.\n\n```bash\n# Create security contact for alert notifications\naz security contact create \\\n  --name \"SecurityTeam\" \\\n  --email \"security-ops@company.com\" \\\n  --phone \"+1-555-0199\" \\\n  --alert-notifications on \\\n  --alerts-to-admins on\n\n# List active security alerts\naz security alert list \\\n  --query \"[?status=='Active'].{Name:alertDisplayName, Severity:severity, Time:timeGeneratedUtc, Status:status}\" \\\n  -o table\n\n# Create workflow automation for high-severity alerts (Logic App trigger)\naz security automation create \\\n  --name \"high-severity-alert-response\" \\\n  --resource-group \"security-rg\" \\\n  --scopes \"[{\\\"description\\\":\\\"Full subscription\\\",\\\"scopePath\\\":\\\"\u002Fsubscriptions\u002FSUB_ID\\\"}]\" \\\n  --sources \"[{\n    \\\"eventSource\\\":\\\"Alerts\\\",\n    \\\"ruleSets\\\":[{\n      \\\"rules\\\":[{\n        \\\"propertyJPath\\\":\\\"Severity\\\",\n        \\\"propertyType\\\":\\\"String\\\",\n        \\\"expectedValue\\\":\\\"High\\\",\n        \\\"operator\\\":\\\"Equals\\\"\n      }]\n    }]\n  }]\" \\\n  --actions \"[{\n    \\\"logicAppResourceId\\\":\\\"\u002Fsubscriptions\u002FSUB_ID\u002FresourceGroups\u002Fsecurity-rg\u002Fproviders\u002FMicrosoft.Logic\u002Fworkflows\u002Falert-response\\\",\n    \\\"actionType\\\":\\\"LogicApp\\\"\n  }]\"\n```\n\n### Step 6: Implement Adaptive Application Controls and JIT VM Access\n\nConfigure advanced workload protection features for runtime security.\n\n```bash\n# Enable Just-In-Time VM access\naz security jit-policy create \\\n  --resource-group \"production-rg\" \\\n  --name \"jit-policy\" \\\n  --virtual-machines \"[{\n    \\\"id\\\":\\\"\u002Fsubscriptions\u002FSUB_ID\u002FresourceGroups\u002Fproduction-rg\u002Fproviders\u002FMicrosoft.Compute\u002FvirtualMachines\u002Fweb-server-01\\\",\n    \\\"ports\\\":[\n      {\\\"number\\\":22,\\\"protocol\\\":\\\"TCP\\\",\\\"allowedSourceAddressPrefix\\\":\\\"*\\\",\\\"maxRequestAccessDuration\\\":\\\"PT3H\\\"},\n      {\\\"number\\\":3389,\\\"protocol\\\":\\\"TCP\\\",\\\"allowedSourceAddressPrefix\\\":\\\"*\\\",\\\"maxRequestAccessDuration\\\":\\\"PT3H\\\"}\n    ]\n  }]\"\n\n# Request JIT access when needed\naz security jit-policy initiate \\\n  --resource-group \"production-rg\" \\\n  --name \"jit-policy\" \\\n  --virtual-machines \"[{\n    \\\"id\\\":\\\"VM_ID\\\",\n    \\\"ports\\\":[{\\\"number\\\":22,\\\"endTimeUtc\\\":\\\"2026-02-23T15:00:00Z\\\",\\\"allowedSourceAddressPrefix\\\":\\\"10.0.1.50\\\"}]\n  }]\"\n\n# Review adaptive application control recommendations\naz security adaptive-application-controls list \\\n  --query \"[].{Group:displayName, Recommendation:recommendationAction, VMCount:vmRecommendations|length(@)}\" \\\n  -o table\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| Microsoft Defender for Cloud | Azure-native security platform providing CSPM and cloud workload protection (CWP) across Azure, hybrid, and multi-cloud environments |\n| Secure Score | Numerical measure of an organization's security posture based on the percentage of security recommendations that have been implemented |\n| Security Recommendation | Actionable guidance from Defender for Cloud to improve security posture, prioritized by severity and secure score impact |\n| Defender Plan | Workload-specific protection tier (Servers, Containers, SQL, Storage, etc.) that enables advanced threat detection for specific resource types |\n| Just-In-Time VM Access | Feature that reduces attack surface by blocking management ports (SSH\u002FRDP) by default and granting time-limited access on request |\n| Adaptive Application Controls | Machine-learning-based allowlisting that recommends which applications should be allowed to run on VMs |\n\n## Tools & Systems\n\n- **Microsoft Defender for Cloud**: Central security platform with CSPM, CWP, and regulatory compliance capabilities\n- **Azure Policy**: Governance service used by Defender for Cloud to evaluate and enforce security configurations\n- **Log Analytics Workspace**: Backend data store for security telemetry collected by Defender agents\n- **Azure Logic Apps**: Workflow automation for incident response triggered by Defender alerts\n- **Azure Arc**: Extends Defender for Cloud protection to hybrid and multi-cloud servers and Kubernetes clusters\n\n## Common Scenarios\n\n### Scenario: Rolling Out Defender for Cloud Across a Multi-Subscription Enterprise\n\n**Context**: An enterprise with 20 Azure subscriptions needs to enable Defender for Cloud with server, container, and SQL protection while establishing a compliance baseline against CIS Azure 2.0.\n\n**Approach**:\n1. Enable the CSPM plan (CloudPosture) across all subscriptions using Azure Policy initiative\n2. Enable Defender for Servers P2, Containers, and SQL on production subscriptions\n3. Configure auto-provisioning to deploy Log Analytics agents to all VMs\n4. Enable CIS Azure 2.0 and PCI DSS 4.0 compliance standards\n5. Create security contacts and configure alert notifications to the SOC team\n6. Set up workflow automation for High severity alerts via Logic Apps\n7. Enable JIT VM access for all production servers to eliminate persistent SSH\u002FRDP exposure\n8. Create a weekly Secure Score report for executive stakeholders\n\n**Pitfalls**: Defender for Servers P2 costs per server per hour. For environments with many VMs, costs can escalate quickly. Use Defender for Servers P1 for development subscriptions and P2 only for production. Auto-provisioning of agents may conflict with existing agent deployments managed by SCCM or other tools.\n\n## Output Format\n\n```\nMicrosoft Defender for Cloud Deployment Report\n=================================================\nOrganization: Acme Corp\nSubscriptions: 20 (12 production, 8 non-production)\nDeployment Date: 2026-02-23\n\nDEFENDER PLANS ENABLED:\n  CloudPosture (CSPM):     20 \u002F 20 subscriptions\n  Servers P2:              12 \u002F 20 (production only)\n  Containers:              12 \u002F 20 (production only)\n  SQL:                     12 \u002F 20 (production only)\n  Storage:                 20 \u002F 20 all subscriptions\n  Key Vault:               20 \u002F 20 all subscriptions\n\nSECURE SCORE:\n  Current: 62% (baseline)\n  Target: 80% within 90 days\n\nCOMPLIANCE STATUS (CIS Azure 2.0):\n  Compliant controls:        78 \u002F 142 (55%)\n  Non-compliant controls:    52 \u002F 142\n  Not applicable:            12 \u002F 142\n\nRECOMMENDATIONS:\n  Critical:    8 recommendations affecting 34 resources\n  High:       24 recommendations affecting 89 resources\n  Medium:     56 recommendations affecting 234 resources\n  Low:        34 recommendations affecting 112 resources\n\nSECURITY ALERTS (Last 7 Days):\n  High severity:    3\n  Medium severity:  12\n  Low severity:     28\n```\n","# Implementing Azure Defender for Cloud\n\n## When to Use\n\n- When enabling comprehensive security monitoring across Azure subscriptions\n- When implementing cloud workload protection for VMs, containers, SQL, storage, and Key Vault\n- When compliance requirements demand continuous assessment against regulatory frameworks\n- When building adaptive security controls that respond to detected threats\n- When centralizing security findings from Azure-native and hybrid workloads\n\n**Do not use** for non-Azure workload protection exclusively (use AWS Security Hub or GCP SCC), for application-level security testing (use Azure DevOps DAST\u002FSAST), or for identity-specific protection (use Microsoft Defender for Identity).\n\n## Prerequisites\n\n- Azure subscription with Contributor or Security Admin role\n- Azure Policy enabled for compliance assessment\n- Log Analytics workspace for diagnostic data collection\n- Azure Arc connected machines for hybrid server protection\n- Pricing tier set to Standard for Defender plans (free tier provides CSPM only)\n\n## Workflow\n\n### Step 1: Enable Defender for Cloud Plans\n\nEnable the appropriate Defender plans for each workload type requiring protection.\n\n```bash\n# Enable Defender for Cloud CSPM (foundational posture management)\naz security pricing create --name CloudPosture --tier standard\n\n# Enable Defender for Servers\naz security pricing create --name VirtualMachines --tier standard \\\n  --subplan P2\n\n# Enable Defender for Containers\naz security pricing create --name Containers --tier standard\n\n# Enable Defender for Storage\naz security pricing create --name StorageAccounts --tier standard \\\n  --subplan PerStorageAccount\n\n# Enable Defender for SQL\naz security pricing create --name SqlServers --tier standard\n\n# Enable Defender for Key Vault\naz security pricing create --name KeyVaults --tier standard\n\n# Enable Defender for App Service\naz security pricing create --name AppServices --tier standard\n\n# Verify all enabled plans\naz security pricing list \\\n  --query \"[].{Plan:name, Tier:pricingTier, SubPlan:subPlan}\" -o table\n```\n\n### Step 2: Configure Auto-Provisioning of Security Agents\n\nEnable automatic deployment of monitoring agents to VMs and containers.\n\n```bash\n# Enable auto-provisioning of Log Analytics agent\naz security auto-provisioning-setting update \\\n  --name default --auto-provision on\n\n# Configure Log Analytics workspace for data collection\naz security workspace-setting create \\\n  --name default \\\n  --target-workspace \"\u002Fsubscriptions\u002FSUB_ID\u002FresourceGroups\u002FRG\u002Fproviders\u002FMicrosoft.OperationalInsights\u002Fworkspaces\u002FSecurityWorkspace\"\n\n# Enable Defender for Containers auto-provisioning components\naz security setting update \\\n  --name Sentinel \\\n  --setting-kind DataExportSettings\n\n# Verify auto-provisioning status\naz security auto-provisioning-setting list -o table\n```\n\n### Step 3: Review and Prioritize Security Recommendations\n\nRetrieve security recommendations and prioritize remediation based on secure score impact.\n\n```bash\n# Get the current secure score\naz security secure-score list \\\n  --query \"[].{Name:displayName, Current:current, Max:max, Percentage:percentage}\" -o table\n\n# List all active security recommendations\naz security assessment list \\\n  --query \"[?status.code=='Unhealthy'].{Name:displayName, Severity:metadata.severity, Category:metadata.category, ResourceCount:status.cause}\" \\\n  -o table\n\n# Get recommendations sorted by severity\naz security assessment list \\\n  --query \"[?status.code=='Unhealthy'] | sort_by(@, &metadata.severity)\" \\\n  -o table\n\n# Get detailed recommendation with remediation steps\naz security assessment show \\\n  --name ASSESSMENT_ID \\\n  --query \"{Name:displayName, Description:metadata.description, Severity:metadata.severity, Remediation:metadata.remediationDescription}\"\n\n# List recommendations by control\naz security secure-score-controls list \\\n  --query \"[].{Control:displayName, CurrentScore:current, MaxScore:max, NotHealthy:notHealthyResourceCount}\" \\\n  -o table\n```\n\n### Step 4: Configure Regulatory Compliance Dashboard\n\nEnable compliance standards and monitor adherence across subscriptions.\n\n```bash\n# List available regulatory compliance standards\naz security regulatory-compliance-standards list \\\n  --query \"[].{Standard:name, State:state}\" -o table\n\n# Enable specific compliance standards\naz security regulatory-compliance-standards update \\\n  --name \"CIS-Azure-2.0\" --state \"Enabled\"\n\naz security regulatory-compliance-standards update \\\n  --name \"PCI-DSS-4.0\" --state \"Enabled\"\n\naz security regulatory-compliance-standards update \\\n  --name \"NIST-SP-800-53-R5\" --state \"Enabled\"\n\n# Get compliance status for a specific standard\naz security regulatory-compliance-controls list \\\n  --standard-name \"CIS-Azure-2.0\" \\\n  --query \"[].{Control:id, Description:displayName, State:state, PassedResources:passedResources, FailedResources:failedResources}\" \\\n  -o table\n\n# Get failing assessments for a control\naz security regulatory-compliance-assessments list \\\n  --standard-name \"CIS-Azure-2.0\" \\\n  --control-name \"2.1\" \\\n  --query \"[?state=='Failed'].{Assessment:id, State:state}\" -o table\n```\n\n### Step 5: Set Up Security Alerts and Automation\n\nConfigure alert notifications and automated response workflows.\n\n```bash\n# Create security contact for alert notifications\naz security contact create \\\n  --name \"SecurityTeam\" \\\n  --email \"security-ops@company.com\" \\\n  --phone \"+1-555-0199\" \\\n  --alert-notifications on \\\n  --alerts-to-admins on\n\n# List active security alerts\naz security alert list \\\n  --query \"[?status=='Active'].{Name:alertDisplayName, Severity:severity, Time:timeGeneratedUtc, Status:status}\" \\\n  -o table\n\n# Create workflow automation for high-severity alerts (Logic App trigger)\naz security automation create \\\n  --name \"high-severity-alert-response\" \\\n  --resource-group \"security-rg\" \\\n  --scopes \"[{\\\"description\\\":\\\"Full subscription\\\",\\\"scopePath\\\":\\\"\u002Fsubscriptions\u002FSUB_ID\\\"}]\" \\\n  --sources \"[{\n    \\\"eventSource\\\":\\\"Alerts\\\",\n    \\\"ruleSets\\\":[{\n      \\\"rules\\\":[{\n        \\\"propertyJPath\\\":\\\"Severity\\\",\n        \\\"propertyType\\\":\\\"String\\\",\n        \\\"expectedValue\\\":\\\"High\\\",\n        \\\"operator\\\":\\\"Equals\\\"\n      }]\n    }]\n  }]\" \\\n  --actions \"[{\n    \\\"logicAppResourceId\\\":\\\"\u002Fsubscriptions\u002FSUB_ID\u002FresourceGroups\u002Fsecurity-rg\u002Fproviders\u002FMicrosoft.Logic\u002Fworkflows\u002Falert-response\\\",\n    \\\"actionType\\\":\\\"LogicApp\\\"\n  }]\"\n```\n\n### Step 6: Implement Adaptive Application Controls and JIT VM Access\n\nConfigure advanced workload protection features for runtime security.\n\n```bash\n# Enable Just-In-Time VM access\naz security jit-policy create \\\n  --resource-group \"production-rg\" \\\n  --name \"jit-policy\" \\\n  --virtual-machines \"[{\n    \\\"id\\\":\\\"\u002Fsubscriptions\u002FSUB_ID\u002FresourceGroups\u002Fproduction-rg\u002Fproviders\u002FMicrosoft.Compute\u002FvirtualMachines\u002Fweb-server-01\\\",\n    \\\"ports\\\":[\n      {\\\"number\\\":22,\\\"protocol\\\":\\\"TCP\\\",\\\"allowedSourceAddressPrefix\\\":\\\"*\\\",\\\"maxRequestAccessDuration\\\":\\\"PT3H\\\"},\n      {\\\"number\\\":3389,\\\"protocol\\\":\\\"TCP\\\",\\\"allowedSourceAddressPrefix\\\":\\\"*\\\",\\\"maxRequestAccessDuration\\\":\\\"PT3H\\\"}\n    ]\n  }]\"\n\n# Request JIT access when needed\naz security jit-policy initiate \\\n  --resource-group \"production-rg\" \\\n  --name \"jit-policy\" \\\n  --virtual-machines \"[{\n    \\\"id\\\":\\\"VM_ID\\\",\n    \\\"ports\\\":[{\\\"number\\\":22,\\\"endTimeUtc\\\":\\\"2026-02-23T15:00:00Z\\\",\\\"allowedSourceAddressPrefix\\\":\\\"10.0.1.50\\\"}]\n  }]\"\n\n# Review adaptive application control recommendations\naz security adaptive-application-controls list \\\n  --query \"[].{Group:displayName, Recommendation:recommendationAction, VMCount:vmRecommendations|length(@)}\" \\\n  -o table\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| Microsoft Defender for Cloud | Azure-native security platform providing CSPM and cloud workload protection (CWP) across Azure, hybrid, and multi-cloud environments |\n| Secure Score | Numerical measure of an organization's security posture based on the percentage of security recommendations that have been implemented |\n| Security Recommendation | Actionable guidance from Defender for Cloud to improve security posture, prioritized by severity and secure score impact |\n| Defender Plan | Workload-specific protection tier (Servers, Containers, SQL, Storage, etc.) that enables advanced threat detection for specific resource types |\n| Just-In-Time VM Access | Feature that reduces attack surface by blocking management ports (SSH\u002FRDP) by default and granting time-limited access on request |\n| Adaptive Application Controls | Machine-learning-based allowlisting that recommends which applications should be allowed to run on VMs |\n\n## Tools & Systems\n\n- **Microsoft Defender for Cloud**: Central security platform with CSPM, CWP, and regulatory compliance capabilities\n- **Azure Policy**: Governance service used by Defender for Cloud to evaluate and enforce security configurations\n- **Log Analytics Workspace**: Backend data store for security telemetry collected by Defender agents\n- **Azure Logic Apps**: Workflow automation for incident response triggered by Defender alerts\n- **Azure Arc**: Extends Defender for Cloud protection to hybrid and multi-cloud servers and Kubernetes clusters\n\n## Common Scenarios\n\n### Scenario: Rolling Out Defender for Cloud Across a Multi-Subscription Enterprise\n\n**Context**: An enterprise with 20 Azure subscriptions needs to enable Defender for Cloud with server, container, and SQL protection while establishing a compliance baseline against CIS Azure 2.0.\n\n**Approach**:\n1. Enable the CSPM plan (CloudPosture) across all subscriptions using Azure Policy initiative\n2. Enable Defender for Servers P2, Containers, and SQL on production subscriptions\n3. Configure auto-provisioning to deploy Log Analytics agents to all VMs\n4. Enable CIS Azure 2.0 and PCI DSS 4.0 compliance standards\n5. Create security contacts and configure alert notifications to the SOC team\n6. Set up workflow automation for High severity alerts via Logic Apps\n7. Enable JIT VM access for all production servers to eliminate persistent SSH\u002FRDP exposure\n8. Create a weekly Secure Score report for executive stakeholders\n\n**Pitfalls**: Defender for Servers P2 costs per server per hour. For environments with many VMs, costs can escalate quickly. Use Defender for Servers P1 for development subscriptions and P2 only for production. Auto-provisioning of agents may conflict with existing agent deployments managed by SCCM or other tools.\n\n## Output Format\n\n```\nMicrosoft Defender for Cloud Deployment Report\n=================================================\nOrganization: Acme Corp\nSubscriptions: 20 (12 production, 8 non-production)\nDeployment Date: 2026-02-23\n\nDEFENDER PLANS ENABLED:\n  CloudPosture (CSPM):     20 \u002F 20 subscriptions\n  Servers P2:              12 \u002F 20 (production only)\n  Containers:              12 \u002F 20 (production only)\n  SQL:                     12 \u002F 20 (production only)\n  Storage:                 20 \u002F 20 all subscriptions\n  Key Vault:               20 \u002F 20 all subscriptions\n\nSECURE SCORE:\n  Current: 62% (baseline)\n  Target: 80% within 90 days\n\nCOMPLIANCE STATUS (CIS Azure 2.0):\n  Compliant controls:        78 \u002F 142 (55%)\n  Non-compliant controls:    52 \u002F 142\n  Not applicable:            12 \u002F 142\n\nRECOMMENDATIONS:\n  Critical:    8 recommendations affecting 34 resources\n  High:       24 recommendations affecting 89 resources\n  Medium:     56 recommendations affecting 234 resources\n  Low:        34 recommendations affecting 112 resources\n\nSECURITY ALERTS (Last 7 Days):\n  High severity:    3\n  Medium severity:  12\n  Low severity:     28\n```\n",{"name":5,"tags":25,"author":32,"domain":33,"license":15,"version":34,"subdomain":26,"description":35},[26,27,28,29,30,31],"cloud-security","azure","defender-for-cloud","cspm","cwpp","security-recommendations","mahipal","cybersecurity","1.0","Implementing Microsoft Defender for Cloud to enable cloud security posture management, workload protection across VMs, containers, databases, and storage, configure security recommendations, and set up adaptive security controls with automated remediation.\n","main","c2b1fdccc779e99ac814e55fb69ca8d71215dd0f","https:\u002F\u002Fgithub.com\u002FSamuelChien\u002Fmega-skills-collection","https:\u002F\u002Fgithub.com\u002FSamuelChien","http:\u002F\u002Fsamuelchien.com\u002F","2026-05-26 08:27:14",{"source":8,"skillName":5,"commands":43,"prompt":53,"zipAvailable":54},[44,47,50],{"tool":45,"command":46},"npx","npx skills add SamuelChien\u002Fmega-skills-collection --skill implementing-azure-defender-for-cloud",{"tool":48,"command":49},"bunx","bunx skills add SamuelChien\u002Fmega-skills-collection --skill implementing-azure-defender-for-cloud",{"tool":51,"command":52},"pnpm","pnpm dlx skills add SamuelChien\u002Fmega-skills-collection --skill implementing-azure-defender-for-cloud","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FSamuelChien\u002Fmega-skills-collection\u002Fblob\u002Fmain\u002Fimplementing-azure-defender-for-cloud\u002FSKILL.md",true,[56,60,66],{"path":57,"resourceType":57,"resourceTypeDesc":58,"sizeBytes":59,"sourceHtmlUrl":16},"LICENSE","许可证",11255,{"path":61,"resourceType":62,"resourceTypeDesc":63,"sizeBytes":64,"sourceHtmlUrl":65},"references\u002Fapi-reference.md","REFERENCE","参考文档",2278,"https:\u002F\u002Fgithub.com\u002FSamuelChien\u002Fmega-skills-collection\u002Fblob\u002Fmain\u002Fimplementing-azure-defender-for-cloud\u002Freferences\u002Fapi-reference.md",{"path":67,"resourceType":68,"resourceTypeDesc":69,"sizeBytes":70,"sourceHtmlUrl":71},"scripts\u002Fagent.py","SCRIPT","脚本",6929,"https:\u002F\u002Fgithub.com\u002FSamuelChien\u002Fmega-skills-collection\u002Fblob\u002Fmain\u002Fimplementing-azure-defender-for-cloud\u002Fscripts\u002Fagent.py",[73,81,88,95,102,109],{"skillNo":74,"name":75,"nameZh":6,"description":76,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":77,"licenseFileUrl":6,"sourceHtmlUrl":78,"categories":79,"keywords":80,"publishedAt":20},"01M76R4WZQZAXGGXMQCA0FZ716","zustand-store-ts","Create Zustand stores with TypeScript, subscribeWithSelector middleware, and proper state\u002Faction separation. Use when building React state management, creating global stores, or implementing reactive state patterns with Zustand.","MIT","https:\u002F\u002Fgithub.com\u002FSamuelChien\u002Fmega-skills-collection\u002Fblob\u002Fmain\u002Fzustand-store-ts\u002FSKILL.md",[],[],{"skillNo":82,"name":83,"nameZh":6,"description":84,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":77,"licenseFileUrl":6,"sourceHtmlUrl":85,"categories":86,"keywords":87,"publishedAt":20},"01M76R4T9KENDH7FENGZQHBW4G","zustand-store-creator","Zustand Store Creator - Auto-activating skill for Frontend Development.\nTriggers on: zustand store creator, zustand store creator\nPart of the Frontend Development skill category.","https:\u002F\u002Fgithub.com\u002FSamuelChien\u002Fmega-skills-collection\u002Fblob\u002Fmain\u002Fzustand-store-creator\u002FSKILL.md",[],[],{"skillNo":89,"name":90,"nameZh":6,"description":91,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":77,"licenseFileUrl":6,"sourceHtmlUrl":92,"categories":93,"keywords":94,"publishedAt":20},"01M76R3YWN84B7SANJ52X799ZE","zero-trust-config-helper","Zero Trust Config Helper - Auto-activating skill for Security Advanced.\nTriggers on: zero trust config helper, zero trust config helper\nPart of the Security Advanced skill category.","https:\u002F\u002Fgithub.com\u002FSamuelChien\u002Fmega-skills-collection\u002Fblob\u002Fmain\u002Fzero-trust-config-helper\u002FSKILL.md",[],[],{"skillNo":96,"name":97,"nameZh":6,"description":98,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":77,"licenseFileUrl":6,"sourceHtmlUrl":99,"categories":100,"keywords":101,"publishedAt":20},"01M76R3HNSV2AEYSKHM915GJ58","zapier-integration-helper","Zapier Integration Helper - Auto-activating skill for Business Automation.\nTriggers on: zapier integration helper, zapier integration helper\nPart of the Business Automation skill category.","https:\u002F\u002Fgithub.com\u002FSamuelChien\u002Fmega-skills-collection\u002Fblob\u002Fmain\u002Fzapier-integration-helper\u002FSKILL.md",[],[],{"skillNo":103,"name":104,"nameZh":6,"description":105,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":106,"categories":107,"keywords":108,"publishedAt":20},"01M76R3DJSKAT4FA7DV4BF3GCE","zai-cli","Execute z.AI CLI providing vision, search, reader, and GitHub exploration via CLI and MCP.\nUse when user needs image\u002Fvideo analysis, OCR, UI-to-code conversion, error diagnosis,\nreal-time web search, web page to markdown extraction, or GitHub code exploration.\nTrigger with phrases like \"analyze this image\", \"search the web for\", \"read this page\",\n\"explore this repo\", or \"use zai\". Requires Z_AI_API_KEY.","https:\u002F\u002Fgithub.com\u002FSamuelChien\u002Fmega-skills-collection\u002Fblob\u002Fmain\u002Fzai-cli\u002FSKILL.md",[],[],{"skillNo":110,"name":111,"nameZh":6,"description":112,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":77,"licenseFileUrl":6,"sourceHtmlUrl":113,"categories":114,"keywords":115,"publishedAt":20},"01M76R2KAM699XE9AJVAWE4H2E","yt-research","Research competitor YouTube channels, niches, and trending topics for your content strategy.\nUse this skill whenever the user says \"research channels\", \"analyze competitors\", \"find trending topics\",\n\"niche analysis\", \"competitive research\", \"what are other creators doing\", \"scrape YouTube channels\",\nor wants to understand the competitive landscape for a specific tool or topic area. Use when working with yt research. Trigger with 'yt', 'research'.","https:\u002F\u002Fgithub.com\u002FSamuelChien\u002Fmega-skills-collection\u002Fblob\u002Fmain\u002Fyt-research\u002FSKILL.md",[],[]]