Manage and monitor security posture

The recurring question in this domain is posture or detection? Posture asks "is this configured safely?" and is answered by Defender for Cloud recommendations, secure score and attack paths. Detection asks "is something happening right now?" and is answered by workload protection plans, Defender XDR and Sentinel analytics rules. Sort the scenario into one of those two buckets first.

4.1 Managing posture with Microsoft Defender for Cloud

flowchart TB
  FREE["Foundational CSPM — free, on for every subscription<br/>secure score · Microsoft cloud security benchmark<br/>recommendations · asset inventory"] --> CSPM
  CSPM["Defender CSPM plan — attack path analysis<br/>cloud security explorer · agentless scanning<br/>sensitive data discovery · secret scanning · DevOps"] --> CWP
  CWP["Workload protection plans, one per resource type<br/>runtime threat detection and security alerts"] --> XDR
  XDR["Alerts surface in Microsoft Defender XDR<br/>and can be ingested by Microsoft Sentinel"]

What Defender CSPM adds over the free tier

Secure score and regulatory compliance

• Secure score is calculated from recommendations grouped into security controls; you only earn a control's points when every resource in it is healthy.
• The Microsoft cloud security benchmark is applied by default to every subscription and cannot be removed. Add PCI DSS, ISO/IEC 27001, NIST SP 800-53, CIS or a sovereign standard on top in Environment settings → Security policies.
• Custom standards and custom recommendations (authored as Azure Policy definitions or KQL-based graph queries) cover internal requirements.
• An exemption marks a resource or recommendation as waived or mitigated so it stops dragging the score down, with a justification and an optional expiry.
• Compliance assessment requires Defender CSPM, Defender for Servers Plan 2 or any other paid plan on the subscription — the free tier gives you MCSB recommendations but not the compliance dashboard.

Workload protection plans

Each is enabled per subscription (some also per resource), and each brings its own alerts:

Multicloud and hybrid

• AWS — create an AWS connector, which deploys a CloudFormation (or Terraform) template creating cross-account roles. Choose which plans to extend: CSPM, Servers, Containers, Databases.
• GCP — a GCP project or organisation connector using workload identity federation, so there is no service account key to store.
• On-premises and other clouds' VMs — onboard through Azure Arc, which makes them ordinary Azure resources for policy, Defender and Machine Configuration purposes.

Vulnerability management and the external attack surface

• Microsoft Defender Vulnerability Management (MDVM) is the built-in scanner for Azure, AWS, GCP and Arc-enabled machines. Agent-based scanning comes with Defender for Servers Plan 1 and 2; agentless scanning and the premium features — certificate assessment, baseline assessment, vulnerable application blocking — are Plan 2. A bring-your-own-licence Qualys or Rapid7 scanner is also supported and needs no paid Defender plan.
• Microsoft Defender External Attack Surface Management (Defender EASM) looks at you from the outside. You deploy it as an Azure resource (with a 30-day trial), seed a discovery group with domains, hosts, IP blocks, ASNs and WHOIS data, and it builds an inventory of internet-facing assets you may not know you own. It feeds the External Attack Surface Protection initiative in Microsoft Security Exposure Management, where its findings join the unified exposure graph.

4.2 Microsoft Sentinel: workspaces and roles

Sentinel is a solution enabled on a Log Analytics workspace — the workspace holds the data, Sentinel adds the SIEM and SOAR layer. It is increasingly operated from the Microsoft Defender portal alongside Defender XDR, which is where the unified incident queue and advanced hunting live.

Workspace design decisions the exam tests

• One workspace wherever possible — correlation across sources is the point of a SIEM, and cross-workspace queries cost complexity.
• Split when you must for data residency, data ownership between tenants, or genuinely separate retention and cost ownership.
• For finer access within one workspace, use resource-context RBAC (a user who can read the Azure resource can read its logs) or table-level RBAC (a custom role with Microsoft.OperationalInsights/workspaces/query/<Table>/read).
• Managed service providers use Azure Lighthouse for delegated cross-tenant access.

4.3 Content hub and data connectors

The content hub is the in-product marketplace. You install solutions — packaged bundles containing data connectors, analytics rules, hunting queries, workbooks, playbooks, parsers and watchlists for a given product — rather than installing each artifact separately. Installed content is then managed under Content management, where updates are applied.

flowchart TB
  COL{"How does the source reach the workspace?"}
  COL -->|"An Azure resource"| DIAG["Diagnostic settings<br/>pointed at the workspace"]
  COL -->|"A Windows or<br/>Linux machine"| AMA["Azure Monitor Agent,<br/>driven by a data<br/>collection rule"]
  COL -->|"A Syslog or<br/>CEF appliance"| FWD["A Linux forwarder<br/>running the agent,<br/>receiving on port 514"]
  COL -->|"A SaaS or<br/>API source"| CCP["A content hub connector,<br/>or the Codeless<br/>Connector Platform"]
  DIAG --> TBL
  AMA --> TBL
  FWD --> TBL
  CCP --> TBL
  TBL{"A table in the workspace — which tier is it in?"}
  TBL -->|"Analytics tier"| AN["Analytics rules, hunting, workbooks and playbooks<br/>90 days included, extendable to two years"]
  TBL -->|"Data lake tier"| DL["Low-cost retention up to twelve years<br/>KQL jobs, Spark jobs, notebooks and summary rules"]

// A workspace transformation in a data collection rule: drop the noise before
// it is billed, and redact a field you are not allowed to store.
source
| where EventID in (4624, 4625, 4672, 4720, 4732, 4688)
| where not(Account endswith "$")          // machine accounts
| extend Account = iff(EventID == 4625, "REDACTED", Account)
| project TimeGenerated, Computer, EventID, Account, LogonType, IpAddress

4.4 Custom tables, tiers and retention

Custom tables carry a _CL suffix and are created in the workspace with an explicit schema, then populated through a DCR and the Logs Ingestion API (or a connector). Search job results land in a separate table with an _SRCH suffix.

Table plans in Azure Monitor

Tiers in Microsoft Sentinel

Both tiers are managed from Data management → Tables, where you set the analytics retention and the total retention independently per table. Data that ages out of analytics retention remains readable in the lake for the remainder of the total retention.

4.5 Automation rules and playbooks

flowchart TB
  INC["An incident is created or updated, or an analyst runs it by hand"] --> AR["Automation rule — runs inside Microsoft Sentinel"]
  AR --> ACT{"What does the rule do?"}
  ACT -->|"A built-in action"| BUILT["Change status or severity · assign an owner · add a tag · close as a false positive"]
  ACT -->|"Run a playbook"| PB["Playbook — an Azure Logic App with the Microsoft Sentinel connector"]
  PB --> EXT["Block an address on the firewall · disable a user in Entra ID · isolate a device<br/>in Defender · post to Teams · open a ticket"]

4.6 Querying Microsoft Purview Audit

Microsoft 365 activity — mailbox access, SharePoint file operations, Teams events, Copilot interactions, admin actions — lands in the unified audit log. It is searched from the Microsoft Defender portal under Audit (and from the Purview portal), filtered by date range, activity, user and workload.

• Audit (Standard) retains for 180 days.
• Audit (Premium) retains Microsoft Entra, Exchange, SharePoint and OneDrive audit records for one year (extendable to ten with an add-on), adds audit log retention policies, higher API bandwidth, and Intelligent Insights events such as MailItemsAccessed and Send used in compromise investigations.
• Searches run asynchronously as jobs; results can be exported.
• For correlation with everything else, ingest the unified audit log into Sentinel through the Microsoft 365 connector rather than searching it by hand.

4.7 Microsoft Security Copilot

Security Copilot is a natural-language layer over the Microsoft security estate, available standalone at securitycopilot.microsoft.com and embedded inside Defender, Sentinel, Entra, Intune and Purview.

Capacity and workspaces

• Compute is bought as Security Compute Units (SCUs), provisioned hourly against an Azure subscription and resource group. You choose a prompt evaluation location (or allow evaluation anywhere when your geography is busy) and can add overage units for spikes.
• A workspace is a scoped, tenant-bound environment where users, automations and agents operate. Workspaces let you segment by team, region or business unit, each with its own role assignments, prompt history, plugin configuration and SCU capacity.
• Provisioning capacity requires Azure Owner or Contributor on the subscription or resource group, plus Security Administrator or higher in the tenant.
• A usage dashboard and a capacity calculator help size it; SCUs billed hourly can be deleted and recreated to control cost while testing.

Permissions, and why they are not what people expect

Plugins, promptbooks and agents

• Plugins connect Copilot to data — Microsoft plugins (Defender XDR, Sentinel, Entra, Intune, Purview, Defender Threat Intelligence, EASM), non-Microsoft plugins, and custom plugins built from an API spec or KQL. Plugin settings can be managed at workspace or organisation level rather than per user.
• Promptbooks are saved sequences of prompts — repeatable workflows for incident summarisation, script analysis or threat actor research.
• Connectors wrap the Copilot API so Logic Apps and Copilot Studio can call into it from existing automation.
• Agents run autonomously against a trigger — the Phishing Triage Agent in Defender, the Conditional Access Optimization Agent in Entra, the Threat Intelligence Briefing Agent — and are discovered in the agent library or in Microsoft Security Store. Getting an agent from the Store needs Azure billing Contributor or Owner plus a Copilot owner or contributor role, and sometimes a Global Administrator to grant the agent its permissions. Agents consume SCUs on top of any subscription fee, and their activity is audited.

Skill 4 checklist

Next: the AI & agent security deep dive, which pulls the AI material out of Skills 1, 3 and 4 into one narrative.