> For the complete documentation index, see [llms.txt](https://msdocs.aohwv.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://msdocs.aohwv.com/quick-start/step-7-azure-defender-for-cloud.md).

# Step 7 — Azure (Defender for Cloud)

This step connects two Azure sources:

* **Defender for Cloud** detects threats against your Azure resources (virtual machines, storage, databases, key vaults and more) and flags weak configurations.
* **The Azure Activity Log** records every admin action in Azure: who created, changed or deleted what, including role assignments and deleted backups or logs.

{% hint style="info" %}
**Two portals, one product.** You **set up** Defender for Cloud in the **Azure portal**: turning on plans, connecting subscriptions and clouds, and continuous export. You can **view** its alerts and cloud security posture in the **Microsoft Defender portal**, alongside your other Defender alerts.
{% endhint %}

| Do this in…                                                      | For                                                                                                                                         |
| ---------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------- |
| **Azure portal** → Microsoft Defender for Cloud                  | Defender plans, subscriptions, AWS and GCP connections, continuous export, recommendations                                                  |
| **Defender portal** → Incidents & alerts, and **Cloud security** | Investigating Defender for Cloud alerts and incidents together with endpoint, email and identity alerts, and viewing cloud security posture |

### Before you start

* **Step 1 — Event Hub Setup** is complete
* **Owner**, or **Security Administrator** plus **Contributor**, on each Azure subscription
* A list of the Azure subscriptions you want to monitor

{% hint style="info" %}
**Time:** about 20 minutes, plus a few minutes for each additional subscription
{% endhint %}

## Part A — Defender for Cloud

### 1. Check which Defender plans are on

Defender for Cloud is a set of protection **plans**, one for each type of Azure resource. A plan that's turned off sends **no alerts**, which is the most common gap.

1. Sign in to the [Azure portal](https://portal.azure.com) and open **Microsoft Defender for Cloud**.
2. Go to **Management** → **Environment settings**.
3. Check the **Defender coverage** column. It shows how many plans are on for each subscription, for example **3/14 plans**.
4. Select a **subscription name** (the key icon) to open its **Defender plans** and turn on the ones you need.

<figure><img src="https://1382101996-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FL4D4OecOctRFu1RNXXjo%2Fuploads%2FWSDNoi7KBY2VmA2xoSbi%2Fdefender%20for%20cloud_26.jpeg?alt=media&amp;token=1912573b-8d7b-498c-a297-21dd77e6c65b" alt=""><figcaption></figcaption></figure>

*The Defender coverage column shows how many plans are on for each subscription.*

{% hint style="info" %}
**Select the subscription, not the workspaces listed under it.** Log Analytics workspaces also appear in this list, but plans and continuous export are set at the subscription level.
{% endhint %}

| Plan                           | Protects against                                                        |
| ------------------------------ | ----------------------------------------------------------------------- |
| **Servers**                    | Malware and attacks on virtual machines. Includes Defender for Endpoint |
| **Storage**                    | Malware uploads and unusual access to storage accounts                  |
| **Key Vault**                  | Unusual access to secrets, keys and certificates                        |
| **Databases** (SQL and others) | SQL injection, suspicious logins and data theft                         |
| **Resource Manager**           | Suspicious admin operations across the subscription                     |
| **App Service**                | Attacks on web apps                                                     |
| **Containers**                 | Threats in Kubernetes and container images                              |

Turn on the plans that match the resources you use. Each paid plan has its own cost, so review pricing with your Microsoft partner or account team.

{% hint style="info" %}
**Not sure which plans you need?** RedLegg Advisory can review your Azure environment and recommend the right coverage. See **Get Expert Help**.
{% endhint %}

### 2. Turn on continuous export

Continuous export sends Defender for Cloud data to your Event Hub.

1. In **Defender for Cloud** → **Environment settings**, select the subscription name.
2. Select **Continuous export**, then the **Event hub** tab.
3. Set **Export enabled** to **On**.
4. Under **Exported data types**, select:
   * **Security recommendations**, all severities
   * **Secure score**
   * **Regulatory compliance**, if you track a compliance standard
   * **Security alerts**, all severities (see the note below about duplicates)
5. Under **Export frequency**, select both **Streaming updates** and **Snapshots**.
6. Under **Export target**, select:
   * The subscription where your Event Hub lives
   * **Event Hub namespace:** your namespace from Step 1
   * **Event Hub name:** **defender-cloud**
   * **Event Hub policy name:** **RootManageSharedAccessKey**
7. Select **Save**.
8. Repeat for each subscription.

{% hint style="warning" %}
**Avoid duplicate alerts.** Defender for Cloud alerts also appear in **Defender XDR**, which you connected in Step 3. To check, go to the [Microsoft Defender portal](https://security.microsoft.com) → **Incidents & alerts** → **Alerts** and filter by **Detection source** for Defender for Cloud. If they appear there, ask RedLegg whether to collect alerts from Defender XDR only, and use continuous export for recommendations, secure score and compliance.
{% endhint %}

{% hint style="info" %}
**Many subscriptions?** Instead of repeating this for each one, assign the built-in Azure Policy for continuous export to Event Hub at the management group level. In **Policy** → **Definitions**, search for **export to Event Hub**.&#x20;
{% endhint %}

## Part B — Azure Activity Log

The Activity Log is set **once per subscription**, not on each resource.

1. In the Azure portal, open **Monitor** → **Activity log**.
2. Select **Export Activity Logs**.
3. Choose a subscription, then select **+ Add diagnostic setting**.
4. **Diagnostic setting name:** siem-activity
5. Under **Logs**, select **all categories**.
6. Check **Stream to an event hub**, then select:
   * **Event hub namespace:** your namespace from Step 1
   * **Event hub name:** **activity-logs**
   * **Event hub policy name:** **RootManageSharedAccessKey**
7. Select **Save**.
8. Repeat for each subscription.

{% hint style="info" %}
**Why not every Azure resource log?** Raw logs from every key vault, storage account and database are very high volume and costly. The Defender plans above watch those resources and alert on suspicious activity, so your SOC gets the threats without the noise.
{% endhint %}

### What your SOC can detect with these logs

* Malware or attacks on Azure virtual machines, storage, databases and key vaults
* Someone giving themselves **Owner** or other admin access
* **Diagnostic settings or logs deleted**, a sign of an attacker covering their tracks
* **Backups or recovery vaults deleted**, a common step before ransomware
* Firewall or network rules opened to the internet
* Many large virtual machines suddenly created, a sign of crypto mining
* Security posture getting worse over time, through secure score and recommendations

### Verify

1. In the Azure portal, open the Event Hub namespace and check **Incoming Messages** on both **defender-cloud** and **activity-logs**.
2. For a quick Activity Log test, add a tag to any resource (for example, **test: siem**), then search for that change in your SIEM. It should appear within about 15 minutes.
3. Defender for Cloud recommendations may only appear after the next update or weekly snapshot, so check back if they're not there yet.

## Related

* [Step 6 — Purview](/quick-start/step-6-purview.md) — Data loss prevention events
* [Step 8 — Intune (optional)](/quick-start/step-8-intune-optional.md) — Device management admin actions


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://msdocs.aohwv.com/quick-start/step-7-azure-defender-for-cloud.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.