Microsoft Defender for Cloud in Rwanda

What is Microsoft Defender for Cloud, and who needs it

It’s Microsoft’s cloud security posture and workload protection service. The posture side continuously checks your cloud resources against security recommendations and gives a secure score. The protection side, through paid plans, watches specific resources such as servers, databases and storage for attacks. It suits organisations that have moved servers or applications into Azure, run a website or database there, or are planning a cloud migration and want security built in from the start.

The problem it solves

Cloud resources are created in minutes, often by different people, and a single wrong setting can expose them to the internet. A storage account left public, a database open to every address, or a virtual machine with remote desktop exposed are among the most common causes of cloud breaches. They aren’t visible from inside the office network, so traditional security tools don’t see them. Defender for Cloud shows them in one place and alerts on attacks against them.

Free posture, paid protection

Foundational posture management (free). Switched on for Azure subscriptions. It inventories resources, checks them against security recommendations and produces a secure score. Most organisations get real value from this alone, provided someone acts on the recommendations.

Defender CSPM (paid). Deeper analysis, such as attack paths showing how a weakness in one resource could lead to sensitive data, and wider compliance assessments.

Workload protection plans (paid, per resource). Defender for Servers, in two plans, adds endpoint detection and response through Defender for Endpoint and, in Plan 2, vulnerability assessment and other protections. Separate plans cover databases, storage, containers and more.

We start with the free assessment, fix what it finds, then recommend paid plans only for resources whose risk justifies the monthly cost.

Where your cloud resources live

The nearest Azure regions to Rwanda are in South Africa. Where Azure resources hold personal data, their location is part of your data protection position under Rwanda’s Law N° 058/2021, which requires storage in Rwanda unless the National Cyber Security Authority’s registration certificate permits otherwise. Defender for Cloud doesn’t change where data is stored, but its inventory makes it easy to document what is where. We’re not lawyers, so confirm the position with your adviser.

What the work involves

1. Connect subscriptions, and any AWS, Google Cloud or on-premises servers in scope.
2. Review the posture: secure score and recommendations, ranked by risk.
3. Fix the high-risk findings, such as public exposure, open management ports and missing updates.
4. Enable paid plans where justified, and configure their alerts.
5. Route alerts to the people who will act, alongside device and email alerts.
6. Review regularly, as new resources and recommendations appear.

What’s included and what’s not

Typical timelines and what drives cost

Onboarding and an initial posture review typically take two to four days, with remediation depending on what’s found. Cost is driven by the number of subscriptions and resources, how many findings need fixing, which paid plans are enabled and on how many resources, and whether other clouds or on-premises servers are included.

Equipment typically used

Microsoft Defender for Cloud in the Azure portal, the Microsoft Defender portal for combined alerts, Azure Policy for keeping resources compliant, and connectors for AWS, Google Cloud and on-premises servers where needed.

Common mistakes we see

Free recommendations generated but never read. Paid plans switched on for every resource without checking cost. Storage and databases left open to the internet for convenience. Remote desktop exposed on cloud servers. Alerts going to an address nobody monitors. And cloud resources created outside any naming or ownership rules, so nobody knows who to ask about a finding.