Microsoft Ignite 2021: Azure Security Center Becomes Microsoft Defender for Cloud

Retrospective: this article looks back at events from November 2021, written in 2026 with the benefit of hindsight.

At Microsoft Ignite in November 2021, Microsoft combined Azure Security Center and Azure Defender into a single product: Microsoft Defender for Cloud. It covered both cloud security posture management (CSPM) and cloud workload protection (CWP) — across Azure, AWS and, soon after, Google Cloud.

What changed

• Secure score and recommendations (formerly Azure Security Center) became Defender for Cloud's posture management.
• Workload protection plans (formerly Azure Defender) — for servers, storage, SQL, containers, Key Vault, App Service, DNS, Resource Manager — became Defender plans within Defender for Cloud.
• Native multi-cloud support: AWS accounts could be connected without agents for posture assessment, with GCP following.

Why it mattered

Organizations increasingly ran workloads in more than one cloud. Defender for Cloud aimed to give one view of misconfigurations and threats across them, measured against the Microsoft cloud security benchmark and regulatory standards.

How it evolved

Microsoft added Defender CSPM (a paid tier with attack path analysis, cloud security explorer, agentless scanning and sensitive data awareness), DevOps security for code repositories, and protection for AI workloads. In parallel, the CNAPP market grew, with vendors such as Wiz, Palo Alto Prisma Cloud and Orca competing directly.

In hindsight

Defender for Cloud made baseline posture management available to most Azure customers at little or no cost (the free foundational CSPM tier). The common gap isn't tooling — it's acting on recommendations. Secure scores that sit unchanged for months are one of the most frequent findings in Azure assessments.