Setting up Microsoft Defender for Cloud requires configuring global subscription settings, enabling paid workload protection plans, configuring agent provisioning, and establishing continuous security governance.

Prerequisites

Before starting, ensure your user account has one of the following Role-Based Access Control (RBAC) permissions:

• Security Admin or Owner (Required to turn on Defender plans and change security policies).
• Contributor (Can edit resource configurations and view security states).

1.Enable Foundational CSPM:Prerequisite Step.

1. Log in to the Azure Portal.
2. Search for and select Microsoft Defender for Cloud.
3. Navigate to Getting Started on the left menu.
4. Select the target Azure Subscription and click Upgrade or Enable on all subscriptions.

Note: Enabling Defender for Cloud automatically turns on Foundational CSPM (Cloud Security Posture Management) across your subscription at no cost.

2.Configure Environment Settings and Enable Defender Plans:Paid Workload Plans.

1. On the left navigation pane under Management, select Environment settings.
2. Expand your management group and click on your target Subscription.
3. Under the Defender plans blade, toggle On the specific workload protection plans required for your environment (e.g., Servers, Containers, Databases, Storage, Key Vault).
4. Click Save at the top left.

3.Configure Auto-Provisioning and Monitoring Agents:Agent Deployment.

1. While inside the subscription’s Environment settings, select Settings & Monitoring from the left sub-menu.
2. Turn On relevant extensions based on your active plans:
   • Log Analytics Agent / Azure Monitor Agent (AMA): Auto-provisions logs and vulnerability monitoring agents to VMs.
   • Agentless scanning for VMs: Enables agentless disk scanning for malware and vulnerabilities without installing software.
   • Defender for Containers components: Automatically installs the Defender profile/DaemonSet on Azure Kubernetes Service (AKS) clusters.
3. Click Continue and Save.

4.Set Up Email Notifications and Alerting:Operational Readiness.

1. In the subscription’s Environment settings, select Email notifications.
2. Add the email addresses of your Security Operations Center (SOC) team or administrators.
3. Under Notification settings, set the minimum severity level for email alerts (recommended: High or Medium).
4. Check Also send email notifications to subscription owners if executive alerting is required.
5. Click Save.

5.Assign Security Baselines & Compliance Standards:Governance & Compliance.

1. On the main Defender for Cloud menu, click Regulatory compliance.
2. Click Manage compliance policies.
3. Select your subscription and click Add more standards (e.g., PCI-DSS, ISO 27001, NIST SP 800-53).
4. Assign the standard to automatically evaluate your Azure environment against these benchmarks.

Verification & Post-Setup Checklist

To verify that your configuration was successful:

• Verify Secure Score Calculation: Go to Overview in Defender for Cloud. Within 24 hours, your Secure Score will populate along with populated recommendations under the Recommendations blade.
• Verify Agent Deployment: For VM workloads, navigate to Inventory, select a Virtual Machine, and confirm that the Azure Monitor Agent or Defender Endpoint extension shows as Succeeded.
• Test Security Alerts: Use the Azure CLI or PowerShell to simulate a sample alert (Microsoft provides standard test commands) and verify that an alert appears under Security alerts.