Question

A financial services company runs production workloads across Azure, AWS, and Google Cloud. The CISO wants a unified security architecture that aligns with the Microsoft Cybersecurity Reference Architectures (MCRA). The security team needs continuous posture assessment, threat detection for cloud workloads, and a single pane of glass for security findings across all three clouds, while minimizing the deployment of duplicate tooling per cloud. Which design approach best aligns with MCRA guidance for this multicloud requirement?

Accepted Answer

Deploy Microsoft Defender for Cloud with native connectors to AWS and GCP, enabling Defender CSPM and workload protection plans, and surface findings alongside Microsoft Defender XDR and Microsoft Sentinel.

Answer

Deploy separate third-party CNAPP solutions native to each cloud provider and forward all logs into a manually built Azure Monitor workbook for consolidated reporting.

Answer

Use Azure Arc to onboard all AWS and GCP virtual machines as Azure resources, then apply Azure Policy exclusively for posture management without enabling any Defender plans.

Answer

Restrict Microsoft Defender for Cloud to Azure subscriptions only, and rely on each cloud provider's native security center for AWS and GCP workloads with no cross-cloud correlation.