Study workspace

Prepare for SC-200 with a reference that remembers your progress.

All nine learning paths now run in the new architecture. Select one to reveal its brief and modules.

09 / 09

Choose a learning path

0/404 units
03Microsoft Defender for Cloud6 modules · 48 units · 4 hr 17 min · Cloud security posture, multicloud onboarding, workload protection, alerts, and response0/48 units complete−
Learning path 03 · Microsoft Defender for Cloud ↗

6 modules · 48 units · 4 hr 17 min · Cloud security posture, multicloud onboarding, workload protection, alerts, and response

0%

Study focus

Cloud posture and coverage

Connect Azure and hybrid resources, extend multicloud coverage, and manage cloud security posture.

Workload threat response

Enable workload protections, investigate alerts, and remediate risks across cloud resources.

6 modules · 48 units

Select one or more modules

Each click adds or removes a module from your workspace. Units remain closed until you open them.

01Plan for cloud workload protections using Microsoft Defender for Cloud0/7 units−
01

Module 1

Plan for cloud workload protections using Microsoft Defender for Cloud

Focus: Defender for Cloud architecture, CSPM, cloud workload protection, the protection plans, and initial enablement.
0/7
01 / 07Introduction

Microsoft Defender for Cloud protects Azure, hybrid, and multicloud environments through security posture management and workload threat protection. This module establishes the service model and the choices required before deployment.

Official moduleObjectives and prerequisites
02 / 07Explain Microsoft Defender for Cloud

Defender for Cloud has two complementary pillars. Cloud security posture management (CSPM) discovers weaknesses, measures secure score, and recommends hardening. Cloud workload protection (CWP) detects and responds to threats against specific resource types.

1 · AssessContinuously inventory resources and configurations.
2 · SecurePrioritize recommendations and improve secure score.
3 · DefendDetect attacks and produce contextual alerts.
4 · RespondInvestigate, remediate, and automate actions.
Exam takeaway: posture management reduces the probability of compromise; workload protection detects active threats.
Official lessonCSPM and CWP overview
03 / 07Describe Microsoft Defender for Cloud workload protections

Protection is licensed through workload-specific Defender plans. Plans cover Servers, App Service, Storage, Databases, Containers, Key Vault, Resource Manager, and APIs. Azure Arc extends supported protections to servers and Kubernetes clusters outside Azure.

  • Prevent: secure score, recommendations, regulatory compliance, just-in-time access, and adaptive controls.
  • Detect: behavioral analytics, threat intelligence, anomaly detection, and service-native telemetry.
  • Integrate: export alerts to Microsoft Sentinel or another SIEM/SOAR and use Microsoft Defender XDR integrations.
Official lessonWorkload protection plans and capabilities
04 / 07Exercise - Microsoft Defender for Cloud interactive guide

Use the interactive guide to recognize the portal areas for Overview, Recommendations, Inventory, Regulatory compliance, Workload protections, Security alerts, and Environment settings. Practice mapping each area to assess, secure, defend, or respond.

Official interactive exerciseGuided Defender for Cloud portal tour
05 / 07Enable Microsoft Defender for Cloud

Open Environment settings, select the management group, subscription, or connected cloud account, and enable all plans or only the required workload plans. Owner, Contributor, or Security Admin permissions are commonly required for configuration.

  1. Define the environment and regulatory scope.
  2. Select CSPM and workload plans according to risk and licensing.
  3. Configure monitoring components and data collection.
  4. Verify coverage, recommendations, and alerts after onboarding.
Exam takeaway: enabling Defender for Cloud is not a single global switch; protection plans and monitoring settings are configured per environment.
Official lessonEnable plans and monitoring
06 / 07Module assessment

Review the distinction between CSPM and CWP, the assess-secure-defend lifecycle, workload-specific plans, Azure Arc coverage, and Environment settings.

Official assessmentPlanning knowledge check
07 / 07Summary and resources

Plan Defender for Cloud by identifying environments and workloads, measuring posture, choosing the required Defender plans, and deciding how alerts flow into security operations.

Official moduleSummary and resources
End of learning pathMicrosoft Defender for Cloud
↑