/azure-defender-for-cloud

name: azure-defender-for-cloud
description: Expert knowledge for Azure Defender For Cloud development including troubleshooting, best practices, decision making, architecture & design patterns, limits & quotas, security, configuration, integrations & coding patterns, and deployment. Use when securing multicloud workloads, tuning alerts, exporting data via API/CLI, or integrating SIEM/ITSM tools, and other Azure Defender For Cloud related development tasks. Not for Azure Defender For Iot (use azure-defender-for-iot), Azure External Attack Surface Management (use azure-external-attack-surface-management), Azure Firewall (use azure-firewall), Azure DDoS Protection (use azure-ddos-protection).
compatibility: Requires network access. Uses mcp_microsoftdocs:microsoft_docs_fetch or fetch_webpage to retrieve documentation.
metadata:
  generated_at: "2026-08-09"
  generator: "docs2skills/1.0.0"

Azure Defender For Cloud Skill

This skill provides expert guidance for Azure Defender For Cloud. Covers troubleshooting, best practices, decision making, architecture & design patterns, limits & quotas, security, configuration, integrations & coding patterns, and deployment. It combines local quick-reference content with remote documentation fetching capabilities.

How to Use This Skill

> **IMPORTANT for Agent**: Use the **Category Index** below to locate relevant sections. For categories with line ranges (e.g., `L35-L120`), use `read_file` with the specified lines. For categories with file links (e.g., `[security.md](security.md)`), use `read_file` on the linked reference file

> **IMPORTANT for Agent**: If `metadata.generated_at` is more than 3 months old, suggest the user pull the latest version from the repository. If `mcp_microsoftdocs` tools are not available, suggest the user install it: [Installation Guide](https://github.com/MicrosoftDocs/mcp/blob/main/README.md)

This skill requires **network access** to fetch documentation content:

• **Preferred**: Use `mcp_microsoftdocs:microsoft_docs_fetch` with query string `from=learn-agent-skill`. Returns Markdown.
• **Fallback**: Use `fetch_webpage` with query string `from=learn-agent-skill&accept=text/markdown`. Returns Markdown.

Category Index

| Category | Lines | Description | |----------|-------|-------------| | Troubleshooting | L37-L84 | Troubleshooting and interpreting Defender for Cloud alerts, validating detections, fixing deployment/config issues across VMs, SQL, storage, containers, APIs, DNS, AWS/GCP connectors, and integrations. | | Best Practices | L85-L102 | Guides for investigating and remediating alerts, misconfigurations, and vulnerabilities across VMs, containers, SQL, storage, and endpoints in Defender for Cloud. | | Decision Making | L103-L129 | Guides for choosing and migrating Defender for Cloud plans/features, estimating and optimizing costs, planning deployments, data residency, secure score, CNAPP, and agent/feature retirements. | | Architecture & Design Patterns | L130-L139 | Multicloud security architecture for Defender for Cloud: connector auth for AWS/GCP, secure/private connectivity, container protection design, ownership models, and applying Zero Trust. | | Limits & Quotas | L140-L149 | Limits, quotas, and constraints for Defender for Cloud: data ingestion, portal limitations, alert export caps, free trial limits, extension lifecycles, and storage malware scan capacity. | | Security | L150-L198 | Configuring Defender for Cloud security: roles/RBAC, permissions, standards, recommendations, exemptions, threat protection, CIEM/CSPM, Kubernetes/containers/storage/compute/Key Vault and data protection. | | Configuration | L199-L278 | Configuring and tuning Defender for Cloud features: malware and vulnerability scanning, containers/SQL/storage, alerts, exports, DevOps/CI/CD, policies, cross-tenant, and automation settings. | | Integrations & Coding Patterns | L279-L316 | Integrating Defender for Cloud with tools and platforms (Power BI, XDR, ServiceNow, QRadar/Splunk, AWS/GCP), using APIs/CLI for data export, queries, and automation of security workflows. | | Deployment | L317-L341 | Deploying and scaling Defender for Cloud plans and sensors (Containers, APIs, SQL, DevOps, GHAS), prerequisites/support matrices, and automation via CLI, PowerShell, ARM/Bicep, and policies. |

Troubleshooting

| Topic | URL | |-------|-----| | Interpret and respond to Defender for Cloud AI alerts | https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-ai-workloads | | Interpret Defender for Cloud alerts for Azure App Service | https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-azure-app-service | | Interpret Defender for Cloud alerts for Azure Cosmos DB | https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-azure-cosmos-db | | Interpret Defender for Cloud alerts for Azure DDoS Protection | https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-azure-ddos-protection | | Interpret Defender for Cloud alerts for Azure Key Vault | https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-azure-key-vault | | Interpret Defender for Cloud alerts for Azure network layer | https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-azure-network-layer | | Interpret Defender for Cloud alerts for Azure Storage | https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-azure-storage | | Interpret Defender for Cloud alerts for Azure VM extensions | https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-azure-vm-extensions | | Diagnose and simulate Kubernetes alerts in Defender for Containers | https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-containers | | Interpret Defender for Cloud alerts for Defender for APIs | https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-defender-for-apis | | Interpret Defender for Cloud alerts for DNS | https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-dns | | Interpret Defender for