Describe the capabilities of Microsoft security solutions
Defender for Cloud and Cloud Security Posture
CoreUnderstand Defender for Cloud, CSPM, recommendations, standards, and workload protection.
Aligned to the SC-900 skills measured as of July 28, 2026; product behavior verified September 10, 2026.
Why this matters
Cloud security requires both reducing configuration risk and detecting active threats against running workloads. Defender for Cloud brings those complementary concerns together.
Must Know
- Microsoft Defender for Cloud is a cloud-native application protection platform that provides security posture management and workload protection across cloud and hybrid resources.
- Cloud Security Posture Management (CSPM) continuously assesses resources and configurations, surfaces recommendations, and helps reduce exposure.
- Security policies define desired controls; standards group requirements; assessments evaluate resources; recommendations identify actions that can improve posture.
- Secure score summarizes posture improvement progress from recommendations; it is a prioritization signal, not proof of security or compliance.
- Cloud workload protection adds threat detection and advanced defenses for supported workloads through Defender plans.
Compare and Distinguish
- CSPM vs cloud workload protection: prevent and reduce misconfiguration exposure versus detect and respond to threats affecting workloads.
- Security policy vs recommendation: desired requirement versus a finding and suggested improvement for a resource.
- Secure score vs compliance certification: posture measurement and prioritization versus formal assurance against a defined requirement.
- Defender for Cloud vs Microsoft Sentinel: posture/workload protection versus SIEM and SOAR across security data.
Scenario examples
- A team reviews recommendations for exposed resources to improve its cloud security posture.
- A database workload uses an appropriate Defender plan for workload-specific threat detection.
- A regulatory standard view organizes relevant assessments without guaranteeing that every legal obligation is satisfied.
Exam traps
- A high secure score is not a guarantee that attacks cannot succeed.
- CSPM is not the same as runtime workload threat protection.
- A recommendation identifies an improvement; it does not always mean the resource has been automatically changed.
- Defender for Cloud is broader than one Azure-only antivirus product.
Key takeaways
- Defender for Cloud combines posture management and workload protection.
- CSPM finds and prioritizes posture weaknesses.
- Policies, standards, assessments, recommendations, and secure score have distinct roles.
- Workload protection addresses active threats to supported workload types.
Ready for the quiz?
- Which capability focuses on misconfiguration exposure?
- What does a recommendation represent?
- Why is secure score not a compliance guarantee?
Related objectives
- D3.2.S1 — Describe Microsoft Defender for Cloud
- D3.2.S2 — Describe Cloud Security Posture Management (CSPM)
- D3.2.S3 — Describe how security policies, standards, and recommendations improve the cloud security posture
- D3.2.S4 — Describe enhanced security features provided by cloud workload protection