Microsoft AZ-801: Microsoft Defender for Cloud and Endpoint Security — Study Guide

By Laurynas Brazys · 7 August 2026 · #microsoft #az-801 #certification #exam-prep #study-guide

Part of the Microsoft Windows Server Hybrid Administrator Associate AZ-801 — Study Guide. Practice with verified answers in the Microsoft exam hub, or take timed practice tests on ExamRoll.io.

Overview

Microsoft Defender for Cloud and Microsoft Defender for Endpoint form a cohesive stack for hardening hybrid Windows Server estates, detecting threats, and enforcing least-privilege access. In Azure and on-premises (via Azure Arc), they provide posture management, automated remediation, and endpoint detection and response (EDR). Understanding Defender for Servers plans, workflow automation, access controls, integrity monitoring, and container protections is essential to build a consistent security baseline and operationalize response.

Cloud Security Posture and Server Plans

Defender for Cloud’s Secure Score quantifies how well your resources comply with security best practices and regulatory standards mapped through Azure Policy. Each security control contributes a weighted share of the score and is backed by one or more recommendations. You improve the Secure Score by addressing recommendations across compute, networking, identities, and data. The remediation workflow begins by drilling into a recommendation, reviewing affected resources and remediation steps, and using quick fixes where available. For example, enabling endpoint protection is a single-click deployment tied to policy that can auto-provision agents. Owners can be assigned to recommendations, due dates set, and remediation tasks tracked. Where a recommendation is not applicable, you can create an exemption with a justification and optional expiration, which updates Secure Score without masking unrelated risk. Regulatory compliance views (e.g., Azure Security Benchmark, CIS) project the same controls into standard-specific assessments for auditors and continuous monitoring.

Defender for Servers provides layered protections via two plans:

Plan 1 (approximately $5/server/month, regional variations apply) focuses on endpoint-level protections by including Microsoft Defender for Endpoint Plan 2 for servers. It delivers EDR with behavioral detections, threat and vulnerability management core capabilities, attack surface reduction recommendations, and security baselines surfaced through MDE. Plan 1 is ideal where you want powerful EDR with minimal Azure-native hardening features.
Plan 2 (approximately $15/server/month, region-dependent) includes everything in Plan 1 and adds Azure-native hardening and monitoring capabilities: just-in-time (JIT) VM access, adaptive application controls, adaptive network hardening, file integrity monitoring (FIM), server vulnerability assessment (via integrated Qualys or MDE-based Defender Vulnerability Management), sensitive data discovery integrations, and deeper threat detections sourced from both host and cloud context. Plan 2 is the comprehensive option for enterprises standardizing on Defender for Cloud for both prevention and detection.

Both plans support Azure and Arc-enabled servers. Onboarding at the subscription or workspace level allows Defender for Cloud to auto-provision required agents and extensions using managed identities and Azure Policy, ensuring consistent deployment across scale.

Protection Controls and Automation

Workflow automation operationalizes recommendations and alerts. Playbooks are Azure Logic Apps bound to Defender for Cloud triggers:

Alert trigger: When a security alert is created or updated, a playbook can enrich, notify (Teams/Email), or take action (isolate host, stop VM).
Recommendation trigger: When a new unhealthy resource appears for a recommendation, a playbook can open a ticket, assign ownership, or invoke remediation APIs.
Regulatory compliance trigger: On assessment changes, a playbook can export findings to GRC tooling.

Implement playbooks using a system-assigned managed identity granted least-privilege roles (for example, Virtual Machine Contributor to stop VMs). Use filtering conditions to target specific alerts such as “Antimalware disabled in the virtual machine,” then call the Compute PowerOff operation for the affected VM. This pattern reduces mean time to remediate while preserving auditability and consistency.

Just-in-time VM access shrinks the attack surface by closing management ports (SSH, RDP, custom) at the NSG or Azure Firewall until explicitly requested. Prerequisites include an NSG or Azure Firewall applied to the VM network interface or subnet; if none exists, create an NSG first. Configure JIT to specify allowed ports, source ranges (prefer preferred source IP restriction), protocol, and maximum access duration per port. When an operator requests access, Defender for Cloud validates RBAC permissions and either auto-approves or routes for approval per your policy. It then inserts a temporary allow rule scoped to the requester’s public IP and removes it automatically at expiry. All requests, approvals, and NSG rule changes are audited in Defender for Cloud and Azure Activity logs, and can be streamed to Log Analytics or Microsoft Sentinel.

Adaptive application controls leverage machine learning to group similar machines (by workload and observed processes) and propose allowlists. You refine and publish rules using:

Publisher and signer-based allow rules for signed binaries
File path rules for installed locations
Hash rules for specific binaries Operate in audit mode first to observe would-be blocks, then move to enforce mode to block execution outside the allowlist. For Windows, controls are implemented through Windows Defender Application Control under the hood; for Linux, observed process allowlists are enforced via supported mechanisms. Ensure operational processes such as software updates and management agents are allowed to avoid drift-related false positives.

Adaptive network hardening analyzes actual traffic patterns and proposes tightened inbound NSG rules. For example, if RDP is observed only from a known management network, the recommendation will restrict 3389/TCP to that range instead of Any. Review and apply recommendations per NSG; Defender for Cloud writes updated rules with descriptive names, preserving change context. Reassess periodically, as new legitimate sources can lead to updated proposals.

File integrity monitoring adds detective controls for changes to critical files and registries. Configure FIM by associating a Log Analytics workspace and enabling the FIM data collection for targeted machines (auto-provisioning is supported). Define monitored paths and registry keys, including include/exclude patterns and sensitivity to content changes versus attribute-only changes. Defender for Cloud raises alerts on unauthorized or suspicious changes with details on who, what, and when; events are stored in your workspace for hunting and correlation. Use retention and data export settings to keep change history aligned with compliance needs.

Endpoint and Vulnerability Management

Onboarding Windows Server to Microsoft Defender for Endpoint is streamlined via Defender for Cloud. For Azure VMs, enable auto-provisioning; for on-premises or other clouds, connect machines with Azure Arc (Azure Connected Machine agent), then enable Defender for Servers to auto-install the MDE unified agent on supported Windows Server versions. Validate onboarding by confirming sensor connectivity and alert generation from test detections.

EDR in block mode strengthens protection by allowing MDE to block malicious artifacts and behaviors even when a third-party antivirus is primary or when Microsoft Defender Antivirus runs in passive mode. Ensure the Microsoft Defender Antivirus engine and platform are present and up to date; enable EDR in block mode via MDE security settings (GPO, Intune, or the MDE portal). This mode is particularly valuable on servers where signature-based AV may miss post-exploitation tool use, as it allows behavior-based blocks.

Live response provides secure, audited remote shell access from the Microsoft Defender portal to an onboarded server for triage and containment. With appropriate roles, responders can collect artifacts, inspect processes and persistence, kill malicious processes, delete files, and apply mitigation scripts. Live response sessions are logged and can be integrated into incident response runbooks.

Vulnerability assessment for servers is available through two integrations:

Integrated Qualys: Defender for Cloud deploys a lightweight Qualys agent extension that performs authenticated scans and reports software vulnerabilities to Defender for Cloud. No separate Qualys subscription is required, and results feed Secure Score and recommendations. This path is commonly used when you prefer Azure-native provisioning with minimal dependency on MDE.
Microsoft Defender Vulnerability Management (via MDE): Uses the MDE sensor to provide software inventory, CVE assessment, attack surface reduction recommendations, and exposure scoring without additional agents. It consolidates vulnerabilities with endpoint detections, enabling unified remediation workflows. Choose MDE-based VA when you standardize on MDE and want deep device posture analytics; choose integrated Qualys when MDE is not deployed to specific servers or you require parity between Windows and Linux without additional onboarding steps. In Defender for Servers Plan 2, either data source can be selected at scope level; ensure only one is enabled to avoid duplication.

Containers and Registries

Defender for Cloud’s Defender for Containers secures both images and runtime. For Azure Container Registry, enable image scanning so that each image push and regular rescans identify CVEs, exposed secrets, and configuration issues (e.g., running as root). Findings are surfaced as Defender for Cloud recommendations and can block deployments via pipeline gates. For multi-cloud registries or CI systems, integrate the Defender scanner into your build process to shift-left.

At runtime, enable the Defender agent for Kubernetes (AKS add-on or DaemonSet for other clusters) to detect suspicious behaviors such as privilege escalation within containers, anomalous process activity, crypto-mining, or lateral movement attempts. The runtime sensor correlates host signals, Kubernetes audit logs, and container events, generating alerts enriched with pod, namespace, and node metadata. Harden clusters by applying recommended Kubernetes policy controls, enforcing minimal privileges, and controlling ingress/egress with network policies; align with Secure Score recommendations mapped to the Azure Security Benchmark.

Practical Problem Scenario

Siemens AG operates a hybrid Windows Server estate with Azure VMs and on-premises servers. Management needs to reduce exposure from open management ports, automate reaction to critical alerts, and gain continuous visibility into unauthorized file changes, all while improving regulatory posture.

Onboard servers and choose plan

Action: Enable Microsoft Defender for Servers Plan 2 on the production subscription and the central Log Analytics workspace. Connect on-premises servers using Azure Arc and enable auto-provisioning.
Why: Plan 2 provides JIT, adaptive controls, FIM, and vulnerability assessment in addition to MDE, aligning with Siemens’ prevention and detection goals while ensuring consistent agent deployment across Azure and on-premises.

Improve posture and Secure Score

Action: Review Secure Score and prioritize recommendations tied to high-risk controls (e.g., endpoint protection not installed, exposed management ports). Assign owners and due dates; create exemptions with justification where a control truly doesn’t apply (e.g., air-gapped lab).
Why: Secure Score drives measurable risk reduction and maps directly to regulatory controls Siemens must report on.

Implement JIT VM access

Action: Ensure each VM NIC/subnet has an NSG; for those without, create NSGs and associate appropriately. Configure JIT for RDP/SSH and custom admin ports with 3-hour maximum windows and source IP restrictions to Siemens’ jump hosts. Require approval for production.
Why: JIT removes standing exposure of management ports and satisfies least privilege by time-bounding and source-scoping access, with full audit trails.

Automate response with Logic Apps

Action: Create a playbook triggered by security alerts matching “Antimalware disabled in the virtual machine.” Use a managed identity with Virtual Machine Contributor to call the PowerOff API on the affected VM and notify SecOps via Teams.
Why: Automated shutdown of noncompliant hosts prevents rapid exploitation while notifying stakeholders; using managed identity enforces least privilege with auditable actions.

Enforce adaptive application and network controls

Action: Enable adaptive application controls in audit mode for IIS and SQL server groups; refine allowlists for signed binaries and standard paths, then move to enforce mode. Apply adaptive network hardening recommendations to tighten NSG rules for inbound ports to known Siemens management IPs.
Why: Application allowlisting and hardened NSGs reduce attack surface and block unknown executables, aligning with Siemens’ baseline standards.

Configure file integrity monitoring

Action: Assign a central Log Analytics workspace, define monitored OS and application directories and registry hives, exclude known noisy paths, and enable alerts for unauthorized changes. Stream FIM alerts to Microsoft Sentinel for correlation.
Why: FIM provides early detection of tampering and unauthorized configuration drift, meeting audit requirements and improving incident detection.

Standardize vulnerability assessment

Action: Use MDE-based Defender Vulnerability Management for all MDE-onboarded servers; disable Qualys where MDE is present. For legacy servers without MDE, enable the integrated Qualys extension.
Why: Consolidating on MDE-based VA simplifies operations and deepens analytics; Qualys fills gaps where MDE is not feasible, preventing data duplication.

Secure containers and registries

Action: Enable ACR image scanning and the AKS Defender agent. Configure CI gates to block images with critical CVEs and enforce runtime detections with alert routing to SecOps.
Why: This ensures vulnerabilities are remediated before deployment and runtime anomalies are detected quickly with Kubernetes context, completing Siemens’ defense-in-depth strategy.

← Windows Server Security and Hardening · All domains · Microsoft Sentinel and Security Monitoring →

Practice these questions → · Timed practice on ExamRoll.io →