Defender XDR vs Defender for Cloud
Microsoft Defender XDR correlates alerts about users, devices, email, identities and SaaS apps into incidents, and Microsoft Defender for Cloud protects and assesses Azure, AWS and Google Cloud resources. The decision rule: if the thing being attacked is a person, a laptop, a mailbox or a SaaS app, the answer is in the Defender XDR family; if it is a subscription, a virtual machine, a storage account, a container cluster or a database in a cloud, the answer is Defender for Cloud. They overlap at the edges, and exams are built on those edges.
What each one is
Microsoft Defender XDR is the extended detection and response layer. Per Microsoft Learn it natively coordinates detection, prevention, investigation and response across endpoints, identities, email and applications. It gives a combined incidents queue, automatic attack disruption, self-healing of impacted assets and advanced hunting over raw signals, all in the Microsoft Defender portal. It correlates signals from the products you have licensed.
Microsoft Defender for Cloud is a cloud-native application protection platform (CNAPP). Microsoft Learn names three parts: cloud security posture management (CSPM), DevSecOps for code-level security, and a cloud workload protection platform (CWPP) for virtual machines, containers, storage, databases and serverless functions. It covers Azure, AWS, GCP and on-premises machines.
The two are not rivals. The Defender XDR documentation lists Defender for Cloud among the products whose signals it uses, and the Defender for Cloud documentation says it integrates with the Defender portal and is expanding there. Microsoft notes that some features are now in the Defender portal and more will follow, so the portal in which a feature lives can change. A question about what a product does stays stable even when the portal moves.
Which product answers which problem
| The problem | Product | Family |
|---|---|---|
| Malware or ransomware on laptops and servers | Defender for Endpoint | Defender XDR |
| Phishing mail, malicious links, attachments, Teams protection | Defender for Office 365 | Defender XDR |
| Attacks against on-premises Active Directory, lateral movement | Defender for Identity | Defender XDR |
| Risky sign-ins and user risk in Entra | Entra ID Protection | Feeds Defender XDR |
| Unsanctioned SaaS apps, shadow IT, OAuth app risk | Defender for Cloud Apps | Defender XDR |
| Missing patches and weak configuration across assets | Defender Vulnerability Management | Defender XDR |
| Insecure configuration of Azure, AWS or GCP resources, secure score | Defender for Cloud (CSPM) | Defender for Cloud |
| Threats on cloud VMs, containers, storage, databases, Key Vault | Defender for Cloud (workload plans) | Defender for Cloud |
| Insecure code, exposed secrets or IaC mistakes in GitHub, Azure DevOps, GitLab | Defender for Cloud (DevOps security) | Defender for Cloud |
| One queue of correlated incidents, hunting across products | Defender XDR | Defender XDR |
| Collect logs from everything, write analytics rules, orchestrate playbooks | Microsoft Sentinel | SIEM and SOAR |
Two names cause most of the damage. Defender for Cloud (cloud resources) and Defender for Cloud Apps (SaaS apps) differ by one word. And Defender for Servers, a plan inside Defender for Cloud, brings in Defender for Endpoint technology: Microsoft Learn says Defender for Servers Plan 1 and 2 provide server protection through Defender for Endpoint, so a server alert can appear in both worlds.
Worked example
A company runs 40 Azure VMs and 6,000 laptops. Over a weekend, three things happen:
- A finance user clicks a phishing link and her laptop starts encrypting files.
- A storage account is found with public blob access and no one noticed for months.
- A VM in a different subscription runs a cryptominer.
Item 1 is Defender for Office 365 (the link) plus Defender for Endpoint (the laptop), and Defender XDR joins them into one incident and can disrupt the attack automatically. Item 2 is a posture finding: Defender for Cloud raises a recommendation and lowers the secure score, with no attack involved. Item 3 is a workload threat: Defender for Servers generates the alert, and Defender for Cloud shows it. If the SOC wants all three in one view, Defender for Cloud alerts flow into the Defender portal’s incident queue, and Sentinel can sit on top as the long-term log store.
Free versus paid in Defender for Cloud
Foundational CSPM is free and provides the secure score, security policy and recommendations, and multicloud connection. The paid Defender CSPM plan adds attack path analysis, the cloud security explorer, governance rules and agentless scanning features. The workload protections are separate paid plans: Defender for Servers, Containers, Storage, Databases, App Service, Key Vault, Resource Manager, APIs and AI services. Microsoft updates plan names and contents often, so check the pricing and plan pages before quoting a detail outside an exam.
Which exams test this
| Exam | How it appears | Where it is covered here |
|---|---|---|
| SC-900 | Capabilities of Microsoft security solutions (35–40%): describe Defender for Cloud, CSPM and cloud workload protection, and separately the Defender XDR services, including Defender for Endpoint, Office 365, Identity and Cloud Apps | Security solutions explained |
| SC-200 | Manage a security operations environment (40–45%): configure Defender XDR automation, investigation and attack disruption; Respond to security incidents (35–40%): work Defender XDR incidents, including alerts from Defender for Cloud workload protections | Manage security operations and respond to security incidents |
| SC-500 | Manage and monitor security posture (20–25%): Defender CSPM, compliance evaluation, workload protection plans and AWS or GCP onboarding; Secure compute (20–25%): Defender for Servers, Defender for AI Services and blast radius analysis in Defender XDR | Security posture explained and secure compute explained |
| AZ-900 | Azure architecture and services (35–40%): describe the purpose of Defender for Cloud, at fundamentals level only | Architecture and services explained |
| AB-900 | Core features and objects of Microsoft 365 services (30–35%): understand the features and capabilities of Defender XDR; Defender for Cloud is not named | Microsoft 365 core features explained |
| AZ-802 | Secure Windows Server infrastructure (10–15%): configure and manage Defender for Servers, the Defender for Cloud plan | Security explained |
| AZ-400 | Develop a security and compliance plan (10–15%): configure Defender for Cloud DevOps security and integrate GitHub Advanced Security with Defender for Cloud | Security and compliance explained |
| SC-401 | A minor topic. Manage risks, alerts, and activities (30–35%): respond to Purview alerts in Defender XDR and to Defender for Cloud Apps file policy alerts | Alerts and activities explained |
For SC-900, SC-200, SC-401 and AB-900 the rows follow the English outlines that take effect in October 2026; Microsoft lists only minor changes against the previous versions.
How the questions are built
The scenario states the asset, and the asset decides the product. Constraint words to watch:
- “SaaS”, “shadow IT”, “sanctioned” point to Defender for Cloud Apps, never to Defender for Cloud.
- “Secure score”, “recommendation”, “misconfiguration”, “compliance with a benchmark”, “AWS account” point to Defender for Cloud posture management.
- “Correlate”, “single incident”, “across email and endpoints”, “advanced hunting”, “attack disruption” point to Defender XDR.
- “Alert on suspicious activity in a database or container” points to a Defender for Cloud workload plan, which has to be enabled on that resource type.
- “Collect logs”, “custom analytics rule”, “playbook” point to Sentinel, not to either Defender product.
- “Paid versus free” separates Foundational CSPM from the Defender CSPM plan.
The classic wrong answer is the product with the right word in the name. A question about protecting SaaS applications that offers “Defender for Cloud” as the first option is testing whether you read the whole name.
Practice questions
Question 1. A security team wants a single incident that combines a phishing email, the user's compromised sign-in and the malware that ran afterwards on that user's laptop, and wants response actions taken automatically where confidence is high. Which solution provides this?
- A. Microsoft Defender for Cloud with the Defender CSPM plan
- B. Foundational CSPM in Defender for Cloud
- C. Microsoft Defender XDR
- D. Microsoft Defender for Cloud Apps
Show answer
Answer: C
Microsoft Defender XDR correlates alerts from email, identity and endpoint products into one incident and can disrupt attacks automatically. Defender for Cloud assesses and protects cloud resources, not user phishing flows. Foundational CSPM only reports posture recommendations and a secure score. Defender for Cloud Apps covers SaaS application risk and does not combine email and endpoint evidence.
Question 2. A company has Azure subscriptions and an AWS account. The security officer wants one secure score and a list of misconfiguration recommendations for resources in both clouds, at no extra cost. What should be used?
- A. Foundational CSPM in Microsoft Defender for Cloud, with the AWS account connected
- B. Microsoft Defender XDR advanced hunting
- C. Microsoft Defender for Cloud Apps
- D. Microsoft Defender for Endpoint on the AWS virtual machines
Show answer
Answer: A
Foundational CSPM in Defender for Cloud is free and provides the secure score, recommendations and connection to AWS and GCP accounts. Defender XDR works on users, devices, email and apps and does not score cloud resource configuration. Defender for Cloud Apps discovers SaaS usage. Defender for Endpoint protects devices and is not a posture assessment of cloud accounts.
Go deeper
- What is Microsoft Defender XDR? on Microsoft Learn
- Microsoft Defender for Cloud overview on Microsoft Learn
- Cloud security posture management in Defender for Cloud for the free and paid CSPM tiers
- Related on this site: KQL cheat sheet, Zero Trust explained, SC-200 versus SC-500