Enable and configure workload protection plans in Microsoft Defender for Cloud
Intermediate
Security Engineer
Microsoft Defender for Cloud
Azure
Enable Cloud Workload Protection Platform (CWPP) plans in Microsoft Defender for Cloud to defend servers, storage, databases, and AI workloads against active threats. You identify the right plan for each workload type — including Defender for AI Services and Defender for APIs — configure plan-specific settings such as the Defender for Servers P1/P2 tier distinction and Defender for Storage malware scanning, and deploy protection at subscription or management group scope. The module concludes by verifying coverage using the Coverage workbook.
Learning objectives
After completing this module, you will be able to:
- Identify the CWPP plans available in Defender for Cloud and explain what workloads each plan protects — including Defender for AI Services and Defender for APIs
- Enable workload protection plans at the subscription level using Environment Settings in the Azure portal
- Configure Defender for Servers (Plan 1 vs. Plan 2) and Defender for Storage sub-settings for your protection requirements
- Deploy protection plans at scale using management groups and Azure Policy, and verify plan coverage using the Coverage workbook
Prerequisites
- Familiarity with Microsoft Defender for Cloud at a basic level
- Understanding of Azure resource types and Azure role-based access control (RBAC)
- Knowledge of cloud security concepts including threat protection and security posture
Get started with Azure
Choose the Azure account that's right for you. Pay as you go or try Azure free for up to 30 days. Sign up.