4.2.4. Defender for Servers: Onboarding, Configuration, and Agentless Scanning
💡 First Principle: Defender for Servers offers two fundamentally different ways to gain visibility into a server's security posture — deploying an agent for deep, real-time protection, or scanning without one for fast, low-friction coverage — and they answer different questions rather than one simply being an upgrade of the other.
Onboarding servers to Defender for Servers (including hybrid and multicloud scenarios via Arc, 4.2.3) enables workload protection for VMs. Configuration includes selecting a plan tier, enabling vulnerability scanning, and enabling endpoint detection and response (EDR) capability, typically through Microsoft Defender for Endpoint integration. Agentless scanning provides visibility — vulnerabilities, exposed secrets, malware indicators — by reading the disk directly (via a snapshot) rather than installing anything inside the running OS, making it fast to roll out broadly but limited to point-in-time visibility rather than real-time protection.
| Capability | Deployment | Provides |
|---|---|---|
| Agent-based (EDR) | Installed inside the VM | Real-time protection, active response |
| Agentless scanning | Reads a disk snapshot, no in-VM install | Vulnerabilities, secrets, malware indicators (point-in-time) |
⚠️ Exam Trap: Agentless scanning does not provide real-time protection or endpoint detection and response — it provides visibility without deployment overhead. A scenario requiring active, real-time threat response still needs the agent-based EDR capability; agentless scanning alone would leave that requirement unmet.
Reflection Question: Why might an organization deliberately deploy both agentless scanning and agent-based EDR on the same fleet of VMs, rather than choosing one?
