Microsoft Defender for Cloud Reviews

I am from a Citrix background and in our organization, we implement solutions and provide them to end-users. In our past couple of deployments, we have been using hybrid cloud scenarios where the complete workload is on the Azure platform and the management is done on the Citrix cloud.

The workloads include tasks for Windows 7, Windows 8, and Windows 10 devices, and they are all running on Azure. We have to make sure that they are compliant with our organization's security standards, which is why we are using the Azure Security Center.

We integrate each workload with the Azure Security Center, where we can use things like Azure Defender and use the Azure Log Analytics Workspace.

Our environment is completely virtual. We have a virtual desktop infrastructure, like a Desktop as a Service.

Azure Security Center has helped to improve our security posture. Before we implemented it, we used to have to install the agent manually for each and every workload. For example, if I have 40 machines in my environment, I have to go to all of them and install the agent. This manual process not only required a lot of human effort but created more opportunities for error. By using the Azure Security Center, I can integrate it just by selecting the subscription. It will take care of everything.

This solution has improved our end-user experience in cases, for example, where Microsoft Defender is not implemented, Azure Defender can be integrated. When an end-user runs an EXE file or any malicious activities are running on the device, Azure Security Center will capture them and send an alert to the administrator.

The most valuable features related to my involvement are Azure Defender and enabling log analytics on the workloads. This helps to integrate the workload suite with the analytics repository. For example, if I want to capture any logs from a Windows 10 workload, then this allows me to do so.

The Log Analytics Workspace acts as a repository where it captures all of the data from Windows 10 and Windows 8 workloads. In order to implement it, an agent needs to be installed. With Azure Security Center, we can configure a policy that accounts for different subscription levels. It automatically installs the agent and begins capturing data.

This product provides us with many features including auto-provisioning of dependency agents for Azure Log Analytics, as well as for Azure Defender.

We can create alerts that trigger if there is any malicious activity happening in the workflow and these alerts can be retrieved using the query language.

Azure Security Center takes a long time to update, compared to the on-premises version of Microsoft Defender. It has most of the features for monitoring end-user machines for security updates or malicious activity but, for example, the latest DAT files are slow to arrive compared to Microsoft Defender.

I would rate the stability a four out of five. Once we enable it, the Azure Security Center will push security updates to all of the end-user machines and start capturing the logs. It helps in many ways.

There is no limitation to the scalability. For example, if I have 10 subscriptions in my Azure environment, it is my choice if I have to use five in production and five for non-production. If I require more, I can upgrade it as needed. It's very flexible.

The people who work with this product hands-on are our administrators. Apart from them, nobody has the access required to make changes.

If we face any issue with Azure Security Center, where we are unable to solve it ourselves, we raise a support ticket with Microsoft directly. We describe the issue and they will come back to us with support.

Usually, we are happy with the support that we receive.

Prior to this product, we worked on a solution from McAfee. However, it was a legacy application and when it came time to upgrade, we opted to use one from Azure because we were using Azure already.

In the case of an on-premises workload, we instead use a SQUAM solution by Microsoft.

The initial setup is a straightforward process. We just need to go into the security center and select the substrates. The deployment takes less than one hour to complete.

In terms of an implementation strategy, we simply follow the Microsoft documentation.

There is a helpful cost-reducing option that allows you to integrate production subscriptions with non-production subscriptions. 

My advice for anyone who is considering Azure Security Center is that it has similar features to the on-premises Microsoft Defender, as well as other software security tools. If you are already using an Azure environment then I recommend implementing Azure Security Center versus having security solutions from different vendors.

I would rate this solution a seven out of ten.

This solution replaces, in many ways, the on-premises operations manager that used to be part of the System Center.

The most valuable feature of this solution is the support for a multi-cloud environment.

The policy-related features are good. For example, there is a compliance policy that is related to PCI and another related to NIST.

The support for dynamic networking is good.

Alerting and incident management are valuable features.

The integration with Logic Apps allows for automated responses to incidents. It is also integrated with Microsoft Defender.

They added new functionality into the pretty long list of features and it is constantly being updated. 

There is no perfect product in the world and there are always features that can be added. Innovation is something that is always on the table.

I have been working with Azure Security Center for more than four years.

This product is much more stable than anything else. The SLA has four nines of stability and it is impossible to compare it with anything that is on-premises. Cloud systems are much more stable.

Scalability is not something that we talk about because this product only exists in the cloud. We talk about it in terms of regions. There are approximately 50 zones across the globe, where for example, Canada has three zones that are split into Central, East, and West.

This is an example of Software as a Service, so scalability is out of the question.

If you need tech support, you need to go to the support site, find the proper program, and subscribe to it. Only basic support is included. If you need premium support or if you need a developer, the support is available, you just need to go to the site and find it.

It is extremely easy to subscribe, and extremely easy to understand. It depends on your requirements and on exactly what you need but a description of every program is readily available.

If you have questions, go to the FAQ, and on the same page, you will have access to the documentation. The documentation is crystal clear. It's very practical and actionable. It explains in simple phrases, or words, what the action is, what the purpose is, and what the benefit or value of it is. 

There is no need to find anything else. You start from the price calculator, and then click and get more information, and from the same page, you find what you need. 

You don't need to do anything else.

With respect to implementation, you just switch it on.

If you need to deploy something else then there are step-by-step instructions available. Setup and deployment will be easy for those who have experience working with this type of solution.

For those not used to this type of operation or not working in this area, it is absolutely possible to talk to their partners, such as the one that I work for, and they will help you.

If you hire the consulting service from a partner then they will help you to plan and design, including performing a capacity review to see what is required and what services need to be integrated. You will identify needs such as an on-premises data center versus using a third-party cloud.

This is a worldwide service and depending on the country, there will be different prices. 

There is a price calculator for Azure Services. You select the service that you are interested in, and the basic or the standard is there immediately, which has support options. Different levels of support are available for different prices. A subscription is part of the Azure Service. You will need to find what type of service you need.

If you need to negotiate the price, based on the enterprise agreement or per commitment, the price schema is available. You just need to speak with a partner.

You can also pay with your credit card, but you will need to read the documentation online.

In summary, if you would like to work with a product that addresses security in the cloud, or in a multi-cloud environment then this is exactly the product. There is no need to implement anything else.

There are multiple things that are absolutely nice about this product. That said, there is no such thing as a perfect product.

I would rate Azure Security Center a nine out of ten.

We are using this solution to implement our CAS policy and it monitors compliance with the Security Center.

Also, we use it for thereat protection. It detects any threats and provides threat recommendations.

Azure Security Center should be more easily understood by a non-technical person. It's more about the security before getting into the product.

It needs to be simplified and made more user-friendly for a non-technical person.

In the next release, I would like to see a better dashboard and more integration with IT sales Management.

I have been using Azure Security Center for one year.

We are working with the latest version.

It's a stable solution.

Azure Security Center is scalable. We have ten users in our organization.

The technical support is very good.

The initial setup was straightforward, but you have to understand the product.

It took us 48 hours to deploy.

We have a team of two to maintain this solution. One is an architect and the other is a service engineer.

We did not use a vendor team to implement this solution. I did it myself.

We are using the free version of the Azure Security Center.

I plan to continue using this solution and I recommend it to others.

I would rate Azure Security Center a seven out of ten.

We are using Azure Security Center for software development.

It's a cloud service that includes the security center and tailoring certain options.

The most valuable features of this solution are the remote workforce capabilities and the general experience of the remote workforce.

Pricing could be improved. There are limited options based on pricing for the government.

The initial setup could be simplified.

In the next release, I would like to see more development in the area of NECES scanning or Splunk, or Universal Forwarding. 

I have been working with Azure Security Center for six months.

We are working with Microsoft Azure for the government version of the cloud.

This solution is stable. It's 100% guaranteed and I've never had any problems with it other than some planned IT downtime.

Azure Security Center is scalable. We've been able to scale pretty well for a workforce that has over 400 developers.

My experience with technical support was more like a consultation. "Tell us what you need and we'll see if we can do that for you."

In some cases, they had to develop on top of the commercial product just to conform to certain government regulations and cybersecurity requirements.

Previously, we did not use a different solution, this is the first option.

It was pretty complex. We had to go back and negotiate with Azure on a few of the options that were commercially available, but not in the government products.

I'm not privy to pricing information, but I know it's probably close to a million dollars a year.

The pricing is comparable. The features that we're getting are tailored to what we need.

It was the best fit for us.

In the future, we will be looking at government brands of the same thing that are part of the DISA.

After looking at DISA's product options, they usually select commercial versions and government versions of commercial products like Azure. For example, Amazon Web Services, and Google cloud.

This was our first option or our first go-to solution because we were considering not only Microsoft but Amazon and Google as well.

Microsoft seemed to have most of what we need.

I am currently working on my Cloud Security Certification.

For anyone who is considering this solution, from a cybersecurity standpoint, if they are doing any kind of scanning, vulnerability scanning for software or systems and they're feeding into the cloud, make sure to check whether the security center doesn't offer adequate options for them to work with. If not, then look into other software like Spunk. They look into everything and they have plenty of conversations with the staff. That's the cloud security provider.

I would rate Azure Security Center an eight out of ten.

The dashboard is very good. It gives our clients a lot of information and allows them to have a complete overview of the system. Everything is visible in one glance.

The solution is quite complex. A lot of the different policies that actually get applied don't pertain to every client. If you need to have something open for a client application to work, then you get dinged for having a port open or having an older version of TLS available. 

Even though the TLS is only allotted for a single application, single box, and everything else is completely up to date, it just gives us an inaccurate reporting of how secure the environment actually is.

The solution could use a bit more granularity.

I believe we've been using the solution for one and a half to two years at this point.

I haven't had any real problems with the solution's stability. I'm trying to think of any complaints that anybody may have had. It's always worked whenever we needed it to. I'd describe it as reliable.

The solution is actually easy to scale. You'd be surprised how many cloud solutions out there that aren't scalable. I don't even know why some are in the cloud. As far as this solution is concerned, I've taken it up to a higher medium-sized company. I've scaled as high as 4,500 users. I'm just not sure if it is infinitely scalable. I don't know if it would scale into the tens of thousands. 

In terms of increasing usage in the future, we'll use it as required. It all depends on the client for us. We're solely dependent on what they want and which solution they want to go with.

It's like with any vendor, it's hit and miss. Sometimes you get the new person, sometimes you get the person that's been there for five years. You have to go in asking exactly what you want and use probing questions, and if you work with them enough, you learn what the right answer is. However, you ask those same questions, anyway, upfront. It gives you a baseline at least of where their technical expertise is. Just because they're on the help desk doesn't mean that they know what they're doing.

We use Intune for a lot of the app security purposes with Office 365, and then once we actually get into the AD section, it's just that a lot of people are really getting Office Secure Scores right now.

I've had both complex and straightforward implementations. Some of them can be extremely complex. It's all just tailored to what the client wants. I have other setups where everything is very basic ad easy and all the client wants is some basic reporting and a few easy policies. 

If you utilize everything, then it might take a while for deployment, and also the implementation could be extended. It's all very client-specific.

We're an MSP, so we have massive teams all over the place and I couldn't accurately say how many people it takes to maintain the solution. I know that, generally, you have one project manager and then you would have the main admin who was setting up the portal, but then you have other security personnel that goes in there and does the work on the different sections. It takes a couple of people, but I couldn't give you a hard number as to how many people a typical setup would need for maintenance.

I don't have any idea what the cost of the solution is. That aspect of the product is handled by a separate department.

We're a Microsoft partner.

The solution works for us, however, a client has its own needs and requirements. It's not a one-size-fits-all solution.

I'd rate the solution seven out of ten.

We use it to keep our Azure infrastructure up to date with the security best practices that Microsoft suggests. We also use it to have better visibility into changes in our databases.

It helps me know if a new virtual machine or an app gateway or a functional service has come online that doesn't have the best security practices enforced on them. The impact we've had is a better security posture being enforced throughout our Azure environment.

The solution has also simplified management of endpoints and servers and gives us visibility in a single pane of glass. And it's easy to identify security corrections in the environment.

It has helped save us SOC time and increased their efficiency. While we haven't measured by how much, we see it in their day-to-day activities. And it has likely improved our time to detection, but we just haven't had anything to detect.

The most valuable features of the solution are the insights, meaning the remediation suggestions, as well as the incident alerts.

We have also integrated Microsoft 365 and Microsoft Defender for Cloud with Microsoft Sentinel and the integration was easy.

In addition, it's good at helping us proactively discover unknowns and defend against threats.

I would like to see better automation when it comes to pushing out security features to the recommendations, and better documentation on the step-by-step procedures for enabling certain features.

I have been using Microsoft Defender for Cloud on a day-to-day basis for about a year.

It's quite stable. We don't have many problems.

The scalability is very good.

We have 100 internal users and we are deployed across multiple sites. It's 100 percent cloud and our infrastructure handles API responses for our clients.

For the cloud infrastructure, their technical support is good.

Positive

In my previous company, I used the native portal, which is pretty much what Defender does, on AWS.

The intelligent threat hunting provided by Microsoft 365 and Microsoft Sentinel based on the alerts, incidents, and logs passed along by Microsoft Defender for Cloud is moderate.

The ability of Microsoft solutions to work natively together to deliver integrated protection as well as coordinated detection and responses across the environment is improving a lot, but it still has a ways to go.

Overall, if you are worried about security, you should have Microsoft Defender for Cloud. It's the minimum you should have.

We are consultants and we have customers using Azure Defender for the protection of their businesses. Many of our customers are in the financial industry.

The most valuable features are ransomware protection and access controls. The solution has helped us secure some folders on our systems from unauthorized modifications. 

This solution has been very useful for securing core funds and preventing them from being hijacked by any application or spyware for our banking customers. People can be susceptible to scams easily because they are not aware of the current threat trends. We are able to scan for threats which have helped us limit the risks in the future.

The solution could improve by being more intuitive and easier to use requiring less technical knowledge.

In a future release, the solution could improve by providing more automation and clarity in the autoanalysis. When we provide our customers with a Microsoft solution for security, Microsoft has to go beyond the basic expectations to impress the customers.

I have been using Azure Defender for approximately one year.

The solution is very stable.

Azure Defender is scalable. We have not found any issue.

The technical support has been responsive. However, we need to be connected to the right level of support. For example, if you are a customer or if you purchased this solution as part of a certification, your level of satisfaction for support will depend on the provider you purchased it from. Microsoft will not be the one doing support for you. If you do not have premier support with Microsoft, as a cloud provider, you will have to support your customers when they are in need. Without Microsoft's premier support you only have break-fix support and if there is a major issue you will not have the help to understand what is happening, or how to prevent it from happening in the future.

The implementation can be difficult if there is not any prior training. There is a lot of elements that have to be understood.

We have an advisor that provides us with information to help us control and configure the solution. Additionally, they have assisted us with automation.

The price of the solution is good for the features we receive and there is an additional cost for Microsoft premier support. However, some of my potential customers have found it to be expensive and have gone on to choose another solution. Additionally, if the customer does not take the full package from Azure Defender it makes it difficult for us to manage the solution for them.

I rate Azure Defender an eight out of ten.

The most valuable features of this solution are the vulnerability assessments and the glossary of compliance.

As an analyst, there is no way to configure or create a playbook to automate the process of flagging suspicious domains. Azure Defender does not have this capability and that is one of the features that is very crucial. 

When we receive an alert on suspicious domains, we have to do it manually. We go to VirusTotal, or AlienVault to confirm. It would be useful to have it done automatically.

I have been using Azure Defender for three months.

We are using the latest version.

It's a stable solution. We have not had any issues.

We have not paid for Azure technical support. We have not contacted technical support.

We have not worked with any other solution.

The initial setup was straightforward. It was easy, very easy.

Azure Defender is a bit pricey. The price could be lower.

We are also researching Darktrace. We wanted to see the capabilities that it offers. 

Azure Defender and Azure Resource Manager are all a part of Microsoft Azure. We use all of them.

This solution has the best security center, security manager dashboard that I have ever seen. I would recommend using this solution. It has everything in one place, and it's easy to configure and easy to deploy.

I would rate Azure Defender an eight out of ten.