Edit

Multicloud workload protection support matrix for Microsoft Defender for Cloud

Important

All Microsoft Defender for Cloud features will be officially retired in the Azure in China region on October 1, 2026. Due to this upcoming retirement, Azure in China customers are no longer able to onboard new subscriptions to the service. A new subscription is any subscription that was not already onboarded to the Microsoft Defender for Cloud service prior to August 18, 2025, the date of the retirement announcement. For more information on the retirement, see Microsoft Defender for Cloud Deprecation in Microsoft Azure Operated by 21Vianet Announcement.

Customers should work with their account representatives for Microsoft Azure operated by 21Vianet to assess the impact of this retirement on their own operations.

Compare Microsoft Defender for Cloud plan and feature support for Azure, Amazon Web Services (AWS), and Google Cloud Platform (GCP). Use the matrices to review workload protection coverage without checking each plan separately.

Note

Some features are in preview. The Azure Preview Supplemental Terms include other legal terms that apply to Azure features that are in beta, preview, or otherwise not yet released into general availability.

Plan coverage at a glance for AWS and GCP

Use the following table to verify Defender for Cloud plan coverage in multicloud environments and review the primary capabilities of each plan. General availability (GA) indicates that a plan is released for production use. The table uses the abbreviations cloud security posture management (CSPM), endpoint detection and response (EDR), and continuous integration and continuous delivery (CI/CD).

Defender for Cloud plan AWS GCP Key plan features Details
Defender for Servers (Plan 1 and Plan 2) GA GA EDR integration, vulnerability scanning, malware scanning, and secrets scanning Defender for Servers support matrix
Defender for Containers GA GA Kubernetes threat detection, container vulnerability assessment, control plane hardening Containers support matrix
Defender CSPM GA GA Agentless posture assessment, attack path analysis, governance and risk prioritization Defender CSPM overview
Defender for SQL Servers on Machines GA GA SQL threat detection and vulnerability assessment on multicloud machines Defender for SQL Servers on Machines overview
Defender for Open-Source Relational Databases Preview Not supported Threat detection for PostgreSQL, MySQL, and MariaDB in supported environments Overview of Defender for Open-Source Relational Databases
Defender for Azure SQL Databases Not supported Not supported Threat detection and vulnerability assessment for Azure SQL services Defender for SQL overview
Defender for Azure Cosmos DB Not supported Not supported Threat protection for Azure Cosmos DB workloads Defender for Azure Cosmos DB
Defender for DevOps GA GA CI/CD security posture, code-to-cloud insights, pull request annotations Defender for DevOps overview
Defender for Storage Not supported Not supported Malware scanning and threat detection for Azure Storage Defender for Storage overview
Defender for Key Vault Not supported Not supported Threat detection for suspicious key and secret access patterns Defender for Key Vault overview
Defender for Resource Manager Not supported Not supported Detection of suspicious Azure Resource Manager operations Defender for Resource Manager overview
Defender for DNS Not supported Not supported DNS-layer threat detection for Azure resources Defender for DNS overview
Defender for App Service Not supported Not supported Threat detection for web apps and APIs running in App Service Defender for App Service overview
Defender for APIs Not supported Not supported API security posture and threat detection in Azure API Management Defender for APIs overview
Defender for AI Services Not supported Not supported Threat protection for generative AI services and applications AI threat protection

Note

Defender for DevOps protects CI/CD platforms (Azure DevOps, GitHub, GitLab) rather than specific cloud environments. Support is not cloud-specific.

Plan availability by cloud

The following table provides a high-level view of Defender for Cloud plan availability for Azure, AWS, and GCP.

Plan Azure AWS GCP
Defender for Servers (Plan 1 and Plan 2) GA GA GA
Defender for Containers GA GA GA
Defender CSPM GA GA GA
Defender for SQL Servers on Machines GA GA GA
Defender for Open-Source Relational Databases GA Preview Not supported
Defender for Azure SQL Databases GA Not supported Not supported
Defender for Azure Cosmos DB GA Not supported Not supported
Defender for DevOps GA GA GA
Defender for Storage GA Not supported Not supported
Defender for Key Vault GA Not supported Not supported
Defender for Resource Manager GA Not supported Not supported
Defender for DNS GA Not supported Not supported
Defender for App Service GA Not supported Not supported
Defender for APIs GA Not supported Not supported
Defender for AI Services GA Not supported Not supported

Defender for Servers

Defender for Servers provides threat detection and advanced defenses for your machines in Azure, AWS, and GCP. For more information, see Defender for Servers.

Note

AWS and GCP machines require Azure Arc for onboarding. Some features, such as file integrity monitoring, depend on the Azure Monitor Agent (AMA) deployed through Arc.

Shared features (Plan 1 and Plan 2)

Feature Azure AWS GCP
Defender for Endpoint automatic onboarding Supported Supported Supported
Defender for Endpoint EDR Supported Supported Supported
Integrated alerts and incidents Supported Supported Supported
Regulatory compliance assessment Supported Supported Supported
Software inventory discovery Supported Supported Supported
Vulnerability scanning (agent-based) Supported Supported Supported

Plan 2 features

Feature Azure AWS GCP
Vulnerability scanning (agentless) Supported Supported Supported
Agentless malware scanning Supported Supported Supported
Agentless machine secrets scanning Supported Supported Supported
Defender for DNS alerts Supported Supported Supported
Defender for Vulnerability Management premium Supported Supported Supported
File integrity monitoring Supported Supported with Azure Arc Supported with Azure Arc
Free data ingestion (500 MB) Supported Supported Supported
Just-in-time virtual machine access Supported Supported Not supported
Network map Supported Not supported Not supported
OS system updates Supported Supported with Azure Arc Supported with Azure Arc
Threat detection (Azure network layer) Supported Not supported Not supported

For detailed operating system, machine type, and feature-level support, see Defender for Servers support matrix.

Defender for Containers

Defender for Containers protects Kubernetes clusters and container workloads. It supports Azure Kubernetes Service (AKS), Amazon Elastic Kubernetes Service (EKS), and Google Kubernetes Engine (GKE). Learn more about Defender for Containers.

Feature Azure (AKS) AWS (EKS) GCP (GKE)
Container registry vulnerability assessment GA GA GA
Runtime container vulnerability assessment (registry scan-based) GA GA GA
Control plane threat detection GA GA GA
Workload threat detection GA GA GA
Binary drift detection GA GA GA
Binary drift blocking Preview Preview Preview
Anti-malware GA GA GA
Agentless discovery for Kubernetes GA GA GA
Attack path analysis GA GA GA
Control plane hardening GA GA GA
Workload hardening GA GA GA

Note

Workload hardening on AWS and GCP requires the Azure Policy extension for Azure Arc-enabled Kubernetes.

Note

Container registry vulnerability assessment supports Azure Container Registry (ACR), Amazon Elastic Container Registry (ECR), Google Artifact Registry (GAR), Google Container Registry (GCR), Docker Hub, and JFrog Artifactory in all clouds.

For detailed support information, see Containers support matrix.

Defender CSPM

Defender CSPM provides cloud security posture management capabilities. Foundational CSPM is available for free in all supported clouds. The paid Defender CSPM plan provides advanced features. For more information, see Defender CSPM.

Foundational CSPM (free) features

Feature Azure AWS GCP More availability
Asset inventory Supported Supported Supported On-premises, Docker Hub, JFrog Artifactory
Data exporting Supported Supported Supported On-premises
Data visualization and reporting with Azure Workbooks Supported Supported Supported On-premises
Microsoft Cloud Security Benchmark Supported Supported Supported Not applicable
Secure score Supported Supported Supported On-premises, Docker Hub, JFrog Artifactory
Security recommendations Supported Supported Supported On-premises, Docker Hub, JFrog Artifactory
Tools for remediation Supported Supported Supported On-premises, Docker Hub, JFrog Artifactory
Workflow automation Supported Supported Supported On-premises
Feature Azure AWS GCP More availability
Agentless code-to-cloud containers vulnerability assessment Supported Supported Supported Not applicable
Agentless discovery for Kubernetes Supported Supported Supported Not applicable
Agentless VM secrets scanning Supported Supported Supported Not applicable
Agentless VM vulnerability scanning Supported Supported Supported Not applicable
AI security posture management Supported Supported Not supported Not applicable
API security posture management Supported Not supported Not supported Not applicable
Attack path analysis Supported Supported Supported Docker Hub, JFrog Artifactory
Azure Kubernetes Service security dashboard (Preview) Supported Not supported Not supported Not applicable
Code-to-cloud mapping for containers Not supported Not supported Not supported GitHub, Azure DevOps, Docker Hub, JFrog Artifactory
Code-to-cloud mapping for infrastructure as code (IaC) Not supported Not supported Not supported Azure DevOps, Docker Hub, JFrog Artifactory
Critical assets protection Supported Supported Supported Not applicable
Custom recommendations Supported Supported Supported Not applicable
Data security posture management (DSPM) Supported Supported Supported Not applicable
External attack surface management Supported Supported Supported Not applicable
Governance to drive remediation at scale Supported Supported Supported Not applicable
Internet exposure analysis Supported Supported Supported Not applicable
Pull request annotations Not supported Not supported Not supported GitHub, Azure DevOps
Regulatory compliance assessments Supported Supported Supported Not applicable
Risk hunting with security explorer Supported Supported Supported Docker Hub, JFrog Artifactory
Risk prioritization Supported Supported Supported Docker Hub, JFrog Artifactory
Serverless protection Supported Supported Not supported Not applicable
ServiceNow integration Supported Supported Supported Not applicable

For detailed support information, see Defender CSPM support.

Defender for Databases

Defender for Databases provides threat detection for database services. Multicloud coverage varies by database type. For more information, see Defender for Databases.

Sub-plan Azure AWS GCP
Defender for Azure SQL Databases GA Not supported Not supported
Defender for SQL Servers on Machines GA GA GA
Defender for Open-Source Relational Databases GA Preview Not supported
Defender for Azure Cosmos DB GA Not supported Not supported

Note

Defender for SQL Servers on Machines protects SQL Server instances running on Azure VMs, AWS EC2 instances (via Arc), and GCP Compute Engine instances (via Arc).

For detailed support information, see Defender for SQL overview.

Defender for DevOps

Defender for DevOps connects to your continuous integration and continuous delivery (CI/CD) platforms and provides security insights for your development pipelines. For more information, see Defender for DevOps.

  • Azure DevOps: GA.
  • GitHub: GA.
  • GitLab: GA.

Defender for APIs

Defender for APIs protects APIs published in Azure API Management. It provides threat detection and security posture insights. For more information, see Defender for APIs.

Note

Defender for APIs is available on Azure only. AWS and GCP environments are not supported.

Feature Azure AWS GCP
API data classification Supported Not supported Not supported
Azure API Management integration Supported Not supported Not supported
Defender CSPM integration2 Supported Not supported Not supported
Inventory Supported Not supported Not supported
Security findings Supported Not supported Not supported
Security posture Supported Not supported Not supported
Security information and event management (SIEM) integrations Supported Not supported Not supported
Threat detection (machine learning-based) Supported Not supported Not supported

2 Requires the Defender CSPM plan and gives access to the cloud security graph.

For detailed support information, see Defender for APIs overview.

Azure-only plans

The following Defender for Cloud plans are available on Azure only and don't currently support AWS or GCP workloads.

Plan Azure AWS GCP
Defender for Storage GA Not supported Not supported
Defender for Key Vault GA Not supported Not supported
Defender for Resource Manager GA Not supported Not supported
Defender for DNS GA Not supported Not supported
Defender for App Service GA Not supported Not supported
Defender for APIs GA Not supported Not supported
Defender for AI Services GA Not supported Not supported