Azure Defender For Cloud Skill

This skill provides expert guidance for Azure Defender For Cloud. Covers troubleshooting, best practices, decision making, architecture & design patterns, limits & quotas, security, configuration, integrations & coding patterns, and deployment. It combines local quick-reference content with remote documentation fetching capabilities.

How to Use This Skill

IMPORTANT for Agent: Use the Category Index below to locate relevant sections. For categories with line ranges (e.g., L35-L120), use read_file with the specified lines. For categories with file links (e.g., [security.md](security.md)), use read_file on the linked reference file

IMPORTANT for Agent: If metadata.generated_at is more than 3 months old, suggest the user pull the latest version from the repository. If mcp_microsoftdocs tools are not available, suggest the user install it: Installation Guide

This skill requires network access to fetch documentation content:

• Preferred: Use mcp_microsoftdocs:microsoft_docs_fetch with query string from=learn-agent-skill. Returns Markdown.
• Fallback: Use fetch_webpage with query string from=learn-agent-skill&accept=text/markdown. Returns Markdown.

Category Index

Category	Lines	Description
Troubleshooting	L37-L86	Diagnosing, interpreting, and responding to Defender for Cloud security alerts and deployment issues across Azure, AWS, GCP, containers, SQL, storage, DNS, APIs, and VMs.
Best Practices	L87-L106	Best-practice guides for configuring, investigating, and remediating Defender for Cloud alerts, vulnerabilities, misconfigurations, and EDR gaps across VMs, SQL, Kubernetes, containers, and storage.
Decision Making	L107-L130	Planning and cost decisions for Defender for Cloud: choosing portals and plans, migrations (Storage, Servers, CSPM, FIM, BYOL), data residency, cost allocation/estimation, and licensing.
Architecture & Design Patterns	L131-L140	Multicloud security architecture for Defender for Cloud: connector auth for AWS/GCP, secure/private connectivity, container protection design, ownership models, and applying Zero Trust.
Limits & Quotas	L141-L150	Limits, quotas, and constraints for Defender for Cloud: data ingestion benefits, free trial caps, portal limitations, CSV export limits, data collection extension lifecycles, and storage malware scan capacity.
Security	L151-L210	Configuring and managing Defender for Cloud security: roles/RBAC, compliance, recommendations, alerts, incident response, storage/VM/container/AKS protections, and secure integrations across clouds.
Configuration	L211-L277	Configuring and tuning Defender for Cloud features: malware/code/VM/container/SQL/storage scanning, alerts, exports, policies, CI/CD integration, cross-tenant, and automation settings.
Integrations & Coding Patterns	L278-L313	Integrating Defender for Cloud with SIEMs, XDR, ServiceNow, CI/CD, multi‑cloud logs, partner tools, and using APIs/CLI/ARG to export, query, and automate alerts and SQL VA data.
Deployment	L314-L338	Guides for planning and deploying Defender for Cloud components (Servers, Containers, SQL, APIs, DevOps, GHAS) at scale, including prerequisites, platform support, and automation options.

Troubleshooting

Topic	URL
Interpret and respond to Defender for Cloud AI alerts	https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-ai-workloads
Interpret Defender for Cloud alerts for Azure App Service	https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-azure-app-service
Interpret Defender for Cloud alerts for Azure Cosmos DB	https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-azure-cosmos-db
Interpret Defender for Cloud alerts for Azure DDoS Protection	https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-azure-ddos-protection
Interpret Defender for Cloud alerts for Azure Key Vault	https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-azure-key-vault
Interpret Defender for Cloud alerts for Azure network layer	https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-azure-network-layer
Interpret Defender for Cloud alerts for Azure Storage	https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-azure-storage
Interpret Defender for Cloud alerts for Azure VM extensions	https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-azure-vm-extensions
Diagnose and simulate Kubernetes alerts in Defender for Containers	https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-containers
Interpret Defender for Cloud alerts for Defender for APIs	https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-defender-for-apis
Interpret Defender for Cloud alerts for DNS	https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-dns
Interpret Defender for Cloud alerts for Linux machines	https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-linux-machines
Interpret Defender for Cloud alerts for open-source relational databases	https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-open-source-relational-databases
Use Defender for Cloud security alert reference	https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference
Interpret Defender for Cloud alerts for Resource Manager	https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-resource-manager
Interpret and respond to Defender SQL security alerts	https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-sql-database-and-azure-synapse-analytics
Interpret Defender for Cloud alerts for Windows machines	https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines
Investigate API security alerts and posture in Defender for Cloud	https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-apis-posture
Validate and test Microsoft Defender for APIs alerts	https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-apis-validation
Troubleshoot common Defender for Containers deployment and runtime issues	https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-containers-troubleshoot
Verify Defender for Containers sensor deployment	https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-containers-verify-deployment
Respond to Microsoft Defender for DNS security alerts	https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-dns-alerts
Investigate and remediate Defender for Resource Manager alerts	https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-resource-manager-usage
Investigate and respond to Defender for SQL alerts	https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-sql-alerts
Test and validate Defender for Storage data security features	https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-storage-test
Understand Defender for Storage security threats and alerts	https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-storage-threats-alerts
Review deprecated Defender for Cloud security alerts	https://learn.microsoft.com/en-us/azure/defender-for-cloud/deprecated-alerts
Fix EDR solution recommendations in Defender for Cloud	https://learn.microsoft.com/en-us/azure/defender-for-cloud/endpoint-detection-response-solution-recommendations
FAQ and troubleshooting for Endor Labs integration	https://learn.microsoft.com/en-us/azure/defender-for-cloud/faq-endor-labs
Use Defender for Cloud incident reference and management info	https://learn.microsoft.com/en-us/azure/defender-for-cloud/incidents-reference
Investigate and remediate malware alerts on Kubernetes nodes	https://learn.microsoft.com/en-us/azure/defender-for-cloud/kubernetes-nodes-malware
Resolve machine vulnerability findings in Defender for Cloud	https://learn.microsoft.com/en-us/azure/defender-for-cloud/remediate-vulnerability-findings-vm
Fix agentless scan errors for GCP VMs in Defender	https://learn.microsoft.com/en-us/azure/defender-for-cloud/resolve-disk-scanning-error
Resolve GCP Domain Restricted Sharing for Defender onboarding	https://learn.microsoft.com/en-us/azure/defender-for-cloud/resolve-gcp-sharing-policy
Resolve GCP VPC Service Controls issues for Defender	https://learn.microsoft.com/en-us/azure/defender-for-cloud/resolve-vpc-service-controls-issues
Handle Defender for Cloud pull request security annotations	https://learn.microsoft.com/en-us/azure/defender-for-cloud/review-pull-request-annotations
Verify and troubleshoot agentless malware scanning alerts	https://learn.microsoft.com/en-us/azure/defender-for-cloud/test-agentless-malware-scanning
Troubleshoot Defender for Cloud AWS and GCP connector issues	https://learn.microsoft.com/en-us/azure/defender-for-cloud/troubleshoot-connectors
Troubleshoot Defender for SQL on Machines configuration	https://learn.microsoft.com/en-us/azure/defender-for-cloud/troubleshoot-sql-machines-guide
Troubleshoot Defender for SQL deployment in government clouds	https://learn.microsoft.com/en-us/azure/defender-for-cloud/troubleshoot-sql-machines-guide-gov
Troubleshoot express and classic SQL VA configuration	https://learn.microsoft.com/en-us/azure/defender-for-cloud/troubleshoot-vulnerability-findings
Troubleshoot common Microsoft Defender for Cloud issues	https://learn.microsoft.com/en-us/azure/defender-for-cloud/troubleshooting-guide
Troubleshoot gated Kubernetes deployments with Defender for Containers	https://learn.microsoft.com/en-us/azure/defender-for-cloud/troubleshooting-runtime-gated
Verify Defender for SQL protection on machines	https://learn.microsoft.com/en-us/azure/defender-for-cloud/verify-machine-protection
Verify Defender for SQL protection in government clouds	https://learn.microsoft.com/en-us/azure/defender-for-cloud/verify-machine-protection-gov
Verify Defender protection for AWS open-source databases	https://learn.microsoft.com/en-us/azure/defender-for-cloud/verify-protection-open-source-relational-databases-aws

Best Practices

Topic	URL
Validate Microsoft Defender for Cloud alert configuration	https://learn.microsoft.com/en-us/azure/defender-for-cloud/alert-validation
Review and remediate OS baseline misconfigurations in Defender for Cloud	https://learn.microsoft.com/en-us/azure/defender-for-cloud/apply-security-baseline
Use binary drift detection to protect container workloads	https://learn.microsoft.com/en-us/azure/defender-for-cloud/binary-drift-detection
Write Cloud Security Explorer queries for VM vulnerabilities	https://learn.microsoft.com/en-us/azure/defender-for-cloud/cloud-security-explorer-software-vulnerabilities
Handle false-positive recommendations in Defender for Storage	https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-storage-false-positive-recommendations
Investigate and fix Defender for Endpoint misconfiguration findings	https://learn.microsoft.com/en-us/azure/defender-for-cloud/endpoint-detection-misconfiguration
Remediate endpoint detection and response gaps in Defender for Cloud	https://learn.microsoft.com/en-us/azure/defender-for-cloud/endpoint-detection-response-solution-recommendations
Review and remediate Kubernetes node vulnerabilities	https://learn.microsoft.com/en-us/azure/defender-for-cloud/kubernetes-nodes-va
Remediate OS misconfigurations with Defender for Cloud	https://learn.microsoft.com/en-us/azure/defender-for-cloud/operating-system-misconfiguration
Review and remediate Azure SQL VA findings	https://learn.microsoft.com/en-us/azure/defender-for-cloud/sql-azure-vulnerability-assessment-find
SQL vulnerability assessment rules and guidance	https://learn.microsoft.com/en-us/azure/defender-for-cloud/sql-azure-vulnerability-assessment-rules
Track SQL vulnerability assessment rule changes	https://learn.microsoft.com/en-us/azure/defender-for-cloud/sql-azure-vulnerability-assessment-rules-changelog
Operate Defender for Cloud individual recommendations	https://learn.microsoft.com/en-us/azure/defender-for-cloud/transition-grouped-individual-recommendations
Protect Azure VMs with JIT access and application control	https://learn.microsoft.com/en-us/azure/defender-for-cloud/tutorial-protect-resources
Investigate and fix vulnerabilities in running Kubernetes containers	https://learn.microsoft.com/en-us/azure/defender-for-cloud/view-and-remediate-vulnerabilities-containers
Review and remediate Defender registry image vulnerabilities	https://learn.microsoft.com/en-us/azure/defender-for-cloud/view-and-remediate-vulnerability-registry-images

Decision Making

Topic	URL
Choose between Azure and Defender portals for Defender for Cloud	https://learn.microsoft.com/en-us/azure/defender-for-cloud/azure-portal-vs-defender-portal-comparison
Allocate Defender for Cloud costs using Azure Cost Analysis	https://learn.microsoft.com/en-us/azure/defender-for-cloud/chargeback
Select and configure Defender for Cloud plans for GCP projects	https://learn.microsoft.com/en-us/azure/defender-for-cloud/configure-google-plans
Estimate Microsoft Defender for Cloud costs with calculator	https://learn.microsoft.com/en-us/azure/defender-for-cloud/cost-calculator
Evaluate and migrate from Defender for Storage classic	https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-storage-classic
Migrate from classic to new Defender for Storage plan	https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-storage-classic-migrate
Plan migration from BYOL VM vulnerability scanning	https://learn.microsoft.com/en-us/azure/defender-for-cloud/deploy-vulnerability-assessment-byol-vm
Manage Defender for open-source databases on AWS RDS	https://learn.microsoft.com/en-us/azure/defender-for-cloud/enable-defender-for-databases-aws
Migrate to updated File Integrity Monitoring in Defender for Servers	https://learn.microsoft.com/en-us/azure/defender-for-cloud/episode-fifty-three
Plan and choose Microsoft CNAPP with Defender for Cloud	https://learn.microsoft.com/en-us/azure/defender-for-cloud/episode-forty-eight
Understand and use the new secure score in Defender for Cloud	https://learn.microsoft.com/en-us/azure/defender-for-cloud/episode-sixty-six
Answer common questions about Defender for Containers	https://learn.microsoft.com/en-us/azure/defender-for-cloud/faq-defender-for-containers
Decide and opt in to Foundational CSPM in Defender	https://learn.microsoft.com/en-us/azure/defender-for-cloud/foundational-cspm-opt-in
Use GitHub Advanced Security with Defender for Cloud	https://learn.microsoft.com/en-us/azure/defender-for-cloud/github-advanced-security-overview
Plan deployment of Defender for Servers across environments	https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers
Plan Defender for Servers data residency and workspaces	https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers-data-workspace
Choose the right Defender for Servers plan	https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers-select-plan
Plan for Log Analytics agent retirement in Defender	https://learn.microsoft.com/en-us/azure/defender-for-cloud/prepare-deprecation-log-analytics-mma-agent
Plan for Log Analytics agent retirement in Defender	https://learn.microsoft.com/en-us/azure/defender-for-cloud/prepare-deprecation-log-analytics-mma-agent
Optimize Defender for Cloud spend with pre-purchase DCUs	https://learn.microsoft.com/en-us/azure/defender-for-cloud/prepurchase-plan

Architecture & Design Patterns

Topic	URL
Understand GCP connector authentication architecture in Defender for Cloud	https://learn.microsoft.com/en-us/azure/defender-for-cloud/authentication-architecture-google-cloud
Understand AWS connector authentication architecture in Defender for Cloud	https://learn.microsoft.com/en-us/azure/defender-for-cloud/concept-authentication-architecture-aws
Design secure connectivity with Microsoft Security Private Link for Defender for Cloud	https://learn.microsoft.com/en-us/azure/defender-for-cloud/concept-private-links
Review Defender for Containers security architecture and connectivity	https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-containers-architecture
Understand Defender for Containers deployment architecture options	https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-containers-deployment-overview
Apply Zero Trust principles with Defender for Cloud	https://learn.microsoft.com/en-us/azure/defender-for-cloud/zero-trust

Limits & Quotas

Topic	URL
Understand Defender for Servers data ingestion benefit	https://learn.microsoft.com/en-us/azure/defender-for-cloud/data-ingestion-benefit
Review current limitations in Defender portal	https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-portal/known-limitations
Export Defender for Cloud alerts to CSV with limits	https://learn.microsoft.com/en-us/azure/defender-for-cloud/export-alerts-to-csv
Understand Defender for Cloud free trial limits	https://learn.microsoft.com/en-us/azure/defender-for-cloud/free-trial
Review Defender for Cloud data collection extensions and retirement timelines	https://learn.microsoft.com/en-us/azure/defender-for-cloud/monitoring-components
Interpret Defender for Storage malware scan results and capacity limits	https://learn.microsoft.com/en-us/azure/defender-for-cloud/understand-malware-scan-results