Question

A financial services company is designing its Azure environment using the Well-Architected Framework. The security team wants to enable Microsoft Defender for Cloud plans across 400 subscriptions but faces budget pressure from finance. Their crown-jewel workloads (payment processing databases and customer-facing APIs) reside in 30 subscriptions, while the remaining 370 subscriptions host non-production dev/test resources with no sensitive data. As the cybersecurity architect, how should you balance the WAF Cost Optimization and Security pillars when planning Defender for Cloud enablement?

Accepted Answer

Enable the free Defender CSPM foundational posture assessment across all 400 subscriptions, and selectively enable paid workload protection plans only on the 30 subscriptions hosting crown-jewel workloads.

Answer

Enable all Defender for Cloud plans uniformly across all 400 subscriptions to ensure consistent coverage, and negotiate a larger security budget with finance.

Answer

Disable Defender for Cloud entirely on the 370 non-production subscriptions and rely on network security groups and Azure Policy for protection there.

Answer

Enable paid Defender plans only on the 370 dev/test subscriptions since they have the most resources, and use manual reviews for the 30 production subscriptions.