Listen to this Post
Introduction:
Organizations navigating Microsoft’s security ecosystem often find themselves trapped in a labyrinth of licensing terms—Defender for Cloud, Defender for Servers, Defender for Endpoint, and Azure Arc. The confusion is not just semantic; it leads to misconfigurations, gaps in coverage, and unexpected cloud bills. This article breaks down the architectural relationships between these components, clarifies the cost structures, and provides a technical roadmap for onboarding servers correctly—whether they reside in Azure, on-premises, or in a competing cloud like AWS.
Learning Objectives:
- Differentiate between Defender for Cloud (CNAPP), Defender for Servers (P1/P2), and Defender for Endpoint (MDE) P2.
- Understand the role of Azure Arc as an onboarding bridge for hybrid and multi-cloud machines.
- Map the deployment flow: Azure Policy > Arc > MDE extension > Security configurations.
You Should Know:
- The Hierarchy: Defender for Cloud vs. Defender for Servers vs. Defender for Endpoint
The confusion often starts at the product naming layer. Defender for Cloud is the umbrella—a Cloud-Native Application Protection Platform (CNAPP) that provides both Cloud Security Posture Management (CSPM) and a Cloud Workload Protection Platform (CWPP). Within Defender for Cloud, the Defender for Servers plan is the specific billing meter for your virtual machines. There are two tiers: P1 ($5/server/month) and P2 ($15/server/month).
- P1 relies heavily on Microsoft Defender for Endpoint (MDE) technology for core antivirus and endpoint detection.
- P2 adds enhanced Defender for Cloud-only features like File Integrity Monitoring (FIM), network-layer threat detection, and regulatory compliance controls.
Crucially, both P1 and P2 include the full feature set of Defender for Endpoint P2. Think of MDE as the engine, and Defender for Servers as the vehicle that houses it in the cloud.
- Deploying Defender for Endpoint on Servers (The Integration)
When you enable the “Defender for Servers” plan in Defender for Cloud, you must explicitly flip the toggle to allow integration with Defender for Endpoint. Once enabled, Azure Policy takes over.
Step‑by‑step guide to verifying the deployment:
- On Azure VMs: The system pushes the `MDE.Windows` or `MDE.Linux` VM extension.
- Verification Command (Windows):
Get-WmiObject -Class Win32_Product | Where-Object {$_.Name -like "Defender"}Or check Services.msc for “Microsoft Defender for Endpoint” services.
-
Verification Command (Linux):
systemctl status mdatp sudo mdatp health
If the extension is present, the `mdatp` daemon should be running.
Important Caveat: Deploying the agent is not enough. You must also attach a Endpoint protection baseline via Azure Policy (e.g., “Configure Microsoft Defender for Endpoint for Windows with endpoint protection baseline”). Without this, the agent runs with default settings, which may lack critical Attack Surface Reduction (ASR) rules.
- Bridging the Gap with Azure Arc (The Onboarding Method for Non-Azure)
For servers that are not native to Azure—whether they are on-premises, in VMware, or on AWS/GCP—you need a control plane. Azure Arc acts as this bridge. It installs the Azure Connected Machine agent, which registers the server as a resource in Azure, allowing it to be managed like a first-party Azure VM.
Step‑by‑step guide to onboarding a Linux server via Azure Arc:
- Prerequisites: You need “Contributor” permissions on the resource group and a supported OS.
2. Download the agent:
wget https://aka.ms/azcmagent -O ~/install_linux_azcmagent.sh
3. Install and connect:
bash ~/install_linux_azcmagent.sh azcmagent connect --resource-group "Your-RG" --tenant-id "your-tenant" --location "eastus" --subscription-id "your-sub-id"
4. Verification:
azcmagent show
Once Arc-enabled, the server appears in the Azure portal. You can then assign Azure Policy initiatives (like “Deploy Defender for Endpoint”) to this Arc resource, which will automatically install the MDE extension on the on-prem machine.
4. The “Direct Onboarding” Alternative
While Azure Arc is the recommended path for ongoing management and policy compliance, Microsoft allows “Direct Onboarding” for servers. This involves manually downloading and running the MDE onboarding script.
Step‑by‑step guide for direct onboarding (Windows Server):
- Download the onboarding package from the Microsoft Defender 365 portal (Settings > Endpoints > Onboarding).
2. Run the script as Administrator:
.\WindowsDefenderATPLocalOnboardingScript.cmd
3. Verify connectivity:
& "C:\Program Files\Windows Defender Advanced Threat Protection\Tools\MDATPTool.ps1"
Security Consideration: Direct onboarding registers the server with MDE, but it does not make it visible to Defender for Cloud unless you also install the Log Analytics agent or Azure Arc later. This creates a split-brain scenario where the endpoint is protected, but posture management (CSPM) is blind to it.
- The Missing Link: Configuring the AV and ASR Rules
A common failure point is assuming the agent handles everything. Post-installation, you must configure the behavior.
Windows Configuration (via PowerShell):
- Check real-time protection:
Get-MpPreference | Select-Object DisableRealtimeMonitoring
- Enable ASR Rules (Example: Block Office apps from creating child processes):
Add-MpPreference -AttackSurfaceReductionRules_Ids "d4f940ab-401b-4efc-aadc-ad5f3c50688a" -AttackSurfaceReductionRules_Actions Enabled
Linux Configuration:
- Check MDE health and settings:
sudo mdATP config get --feature=cloud_automatic_sample_submission
- Update definitions manually (if needed):
sudo mdATP definitions update
- Cost Analysis: Why P2 Might Be Overkill (or Essential)
The difference between P1 ($5) and P2 ($15) is $120/year per server. For a fleet of 1,000 servers, that is a $120,000 delta.
– Choose P1 if: You primarily need EDR (Endpoint Detection and Response) and antivirus. MDE provides that.
– Choose P2 if: You require compliance auditing (PCI/HIPAA), File Integrity Monitoring (FIM), or Kubernetes workload protection. The “free 500 MB data ingestion” per server per day can also save significant Log Analytics costs if your servers are chatty.
7. The Complete Flow (Putting It All Together)
For a clean, secure deployment, the ideal flow is:
1. Install Azure Arc on the on-prem server (or register an Azure VM).
2. Enable Defender for Cloud with the Defender for Servers P1/P2 plan.
3. Enable “Allow Defender for Endpoint to access my data” in the Defender for Cloud settings.
4. Assign the built-in policy “Configure Microsoft Defender for Endpoint to be installed on Windows/Linux machines” to the resource group containing your Arc or Azure VMs.
5. Assign the endpoint protection baseline policy to ensure ASR and AV settings are hardened.
6. Verify: The server will show as “Monitored” in Defender for Cloud and appear in the MDE portal under “Devices.”
What Undercode Say:
- MDE is the engine, Defender for Servers is the chassis. You cannot separate them in a modern Microsoft security stack; P1/P2 are simply the licensing meters for cloud management features.
- Azure Arc is non-negotiable for hybrid estates. Direct onboarding leads to management silos. Arc ensures your on-prem servers are treated as first-class citizens in Azure Policy and update management.
- Configuration > Installation. Deploying the agent is the first step, not the last. Without enforcing ASR rules and baselines, you are paying for a race car and driving it in first gear.
Prediction:
As Microsoft continues to unify its SIEM (Sentinel) and XDR (Defender) under the “Unified Security Operations Platform,” the lines between Defender for Cloud and Defender for Endpoint will blur further. We predict that within 18 months, the onboarding process will be fully automated via Arc with zero-touch provisioning, and the pricing model will shift from per-server/month to a consumption-based model tied to actual threat telemetry ingested. Organizations that master the Arc-to-Defender pipeline today will be the ones best positioned to leverage AI-driven SOAR capabilities tomorrow.
▶️ Related Video (84% Match):
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Jeffrey Appel – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
