Question

A financial services company runs a customer-facing web application backed by Azure Key Vault (for API secrets), Azure SQL Database, and Azure Storage accounts (holding uploaded documents). Recent penetration testing found that an attacker who compromised the app tier could enumerate secrets and download blobs without triggering any alert. The security architect must recommend a Microsoft Defender for Cloud configuration that provides threat detection specifically for anomalous data-plane access to these PaaS services — such as unusual secret retrieval patterns and atypical blob access from suspicious IPs. Which approach best meets this requirement?

Accepted Answer

Enable the Defender for Storage and Defender for Key Vault plans (and Defender for Azure SQL), which provide data-plane threat detection alerts for these resource types.

Answer

Rely on Defender CSPM to raise attack-path and recommendation findings, since posture management covers runtime data-plane threats for PaaS services.

Answer

Deploy the Defender for Servers plan to the App Service compute instances so its agent inspects all downstream calls to Key Vault, SQL, and Storage.

Answer

Configure Azure Policy to enforce private endpoints on all three services, which will generate Defender alerts whenever data-plane access occurs from public IPs.