10.4 Azure Monitor Network Insights & Defender for Cloud Network Posture
Key Takeaways
- Azure Monitor Network Insights requires no configuration and is organised into five components: Topology, Network health and metrics, Connectivity, Traffic, and the Diagnostic Toolkit.
- The Connectivity tab surfaces Connection Monitor tests grouped by source and destination with reachability criteria based on checks-failed percentage and round-trip time, while the Traffic tab lists NSGs and their flow log and Traffic Analytics configuration state.
- Onboarded resource types get a resource-specific topology view and a built-in metrics workbook, and the list includes Application Gateway, Bastion, Azure Firewall, Front Door, NAT Gateway, ExpressRoute, Load Balancer, Private Link, Traffic Manager, virtual hubs, and virtual network gateways.
- Attack path analysis, cloud security explorer, and the cloud security graph are all part of the Defender Cloud Security Posture Management plan and additionally require agentless scanning for VMs or the vulnerability assessment capability in Defender for Servers.
- Attack path analysis starts from an external entry point such as an internet-exposed vulnerable resource and traces lateral movement to critical assets, while cloud security explorer lets you run graph-based queries against the same cloud security graph.
Azure Monitor Network Insights & Defender for Cloud Network Posture
Network Watcher gives you point diagnostics — IP flow verify, next hop, packet capture — that answer "why did this packet fail?" The AZ-700 monitoring objective also requires two estate-wide views: Azure Monitor Network Insights, which answers "is the network healthy?", and Microsoft Defender for Cloud, which answers "where is the network exposed?"
1. Azure Monitor Network Insights
Network Insights provides a visual representation of topology, health, and metrics for all deployed network resources without requiring any configuration. It is a read-only overlay on data Azure already collects, which makes "we would need to deploy agents first" a wrong answer whenever Network Insights is the subject.
It is structured around five components.
| Component | What it gives you |
|---|---|
| Topology | An interactive visualisation of virtual networks and connected resources across multiple subscriptions, regions, and resource groups, with drill-down to an individual resource such as a VM |
| Network health and metrics | Tiles per resource type showing instance counts, resource health, and alerts, with filters for subscription, resource group, and type |
| Connectivity | All Connection Monitor tests, grouped by Sources and Destinations tiles, with configurable reachability criteria |
| Traffic | All NSGs in the selected scope, showing which are configured for NSG flow logs and Traffic Analytics, searchable by IP address |
| Diagnostic Toolkit | A launcher for packet capture, VPN troubleshoot, connection troubleshoot, next hop, and IP flow verify |
Connectivity tab detail
Reachability status is derived from criteria you set: checks failed (%) and round-trip time (ms). Selecting the reachability icon opens the Connection Monitor page with the hop-by-hop topology and identified connectivity issues; the Checks Failed Percent and Round-Trip Time columns link to the metrics page.
Traffic tab detail
The search box finds which NSGs are configured for a given IP address — useful when you know an address is being blocked but not which NSG owns it. The regional grid lets you edit flow log and Traffic Analytics configuration in place.
Onboarded resources
All networking resources are visible, but onboarded types additionally get a resource-specific topology view and a built-in metrics workbook: Application Gateway, Azure Bastion, Azure Firewall, Azure Front Door, Azure NAT Gateway, ExpressRoute, Load Balancer, Local Network Gateway, Network Interface, Network Security Group, Private Link, Public IP address, Route table/UDR, Traffic Manager, Virtual Hub, Virtual Network, Virtual Network Gateway (ExpressRoute and VPN), and Virtual WAN.
[!TIP] The Application Gateway resource view is the fastest way to debug a broken listener chain: it renders frontend IPs connected to listeners, rules, and backend pools, with connecting lines colour-coded by backend pool health. Right-clicking a backend pool jumps straight to VM insights or Network Watcher connection troubleshoot.
Network Insights vs. Network Watcher
| Question | Tool |
|---|---|
| "Are any of my ExpressRoute or VPN connections unhealthy right now?" | Network Insights — Network health tab |
| "Which NSG rule is dropping this specific packet?" | Network Watcher — IP flow verify |
| "What does the whole topology look like across three subscriptions?" | Network Insights — Topology |
| "What is the next hop for traffic from this NIC to that address?" | Network Watcher — Next hop |
| "Is latency between this VM and that endpoint degrading over time?" | Connection Monitor, surfaced in the Network Insights Connectivity tab |
2. Microsoft Defender for Cloud: Network Security Posture
The blueprint names three Defender for Cloud capabilities explicitly: evaluating network security recommendations from Secure Score, evaluating recommendations from attack path analysis, and identifying network resources with Cloud Security Explorer.
Secure Score
Defender for Cloud continuously assesses resources against security controls and produces recommendations. Recommendations are grouped into security controls, and each control contributes to an overall Secure Score percentage. Network-relevant recommendations are the ones a network engineer owns, for example:
- Management ports of virtual machines should be protected with just-in-time network access control
- Internet-facing virtual machines should be protected with network security groups
- Subnets should be associated with a network security group
- Azure DDoS Protection Standard should be enabled
- Storage accounts should restrict network access
Remediating a recommendation raises the score for its control. The score is therefore a prioritisation instrument: work the controls with the largest potential point gain rather than the longest list of findings.
The cloud security graph
Underneath both remaining capabilities sits the cloud security graph — a graph-based context engine that ingests cloud asset inventory, connections, lateral movement possibilities, internet exposure, permissions, network connections, and vulnerabilities, and builds a graph of your multicloud environment.
Attack path analysis
An attack path is a series of steps an attacker could take to breach the environment and reach an asset. It starts at an external entry point — typically an internet-exposed vulnerable resource — then follows available lateral movement, such as attached identities with permissions to other resources, until it reaches a critical target such as a database holding sensitive data.
Defender for Cloud runs a proprietary algorithm over the cloud security graph to find these paths, and it performs active reachability scans to validate whether an exposure really is accessible from outside, which reduces false positives. Each path comes with recommendations that break the path.
For a network engineer this is the difference between a list of findings and a priority: an NSG allowing 3389 from the internet on an isolated test VM is a low-priority recommendation, while the same rule on a VM whose managed identity can reach a production database is the first step of a live attack path.
Cloud security explorer
Cloud security explorer lets you run graph-based queries against the same cloud security graph using a query builder — proactive exploration rather than waiting for a finding. Typical network questions:
- Which virtual machines are internet-exposed and have a high-severity vulnerability?
- Which storage accounts are reachable from the internet and contain sensitive data?
- Which resources are exposed through a public IP with no NSG association?
Licensing prerequisite
All three contextual capabilities — the cloud security graph, attack path analysis, and cloud security explorer — are part of the Defender Cloud Security Posture Management (Defender CSPM) plan. They additionally require either agentless scanning for virtual machines or the vulnerability assessment capability on the Defender for Servers plan.
In the Azure portal you reach them at Microsoft Defender for Cloud > Attack path analysis and Microsoft Defender for Cloud > Cloud security explorer.
[!IMPORTANT] Free Defender for Cloud gives you Secure Score and recommendations; it does not give you attack paths or the security explorer. If a scenario says the team can see recommendations but the attack path blade is empty, the answer is enabling Defender CSPM, not a networking change.
3. Choosing the Right Monitoring Surface
| Requirement in the scenario | Correct answer |
|---|---|
| Visualise all network resources and their health with no configuration | Azure Monitor Network Insights |
| Continuous latency and packet-loss measurement between two endpoints | Connection Monitor (Network Watcher), viewed on the Insights Connectivity tab |
| Determine whether a specific NSG rule allows a flow | IP flow verify (Network Watcher) |
| Record and analyse actual allowed and denied traffic | VNet flow logs plus Traffic Analytics |
| Prioritised list of network hardening actions with a measurable score | Defender for Cloud Secure Score recommendations |
| Find which internet-exposed resources form an exploitable chain to sensitive data | Attack path analysis (Defender CSPM) |
| Ad-hoc question such as "which VMs are internet-exposed and unpatched?" | Cloud security explorer (Defender CSPM) |
A network operations lead wants a single view that shows the health of every ExpressRoute connection, VPN gateway, Application Gateway, and Load Balancer across three subscriptions, along with any alerts, without deploying agents or writing queries. Which capability meets the requirement?
A security team can see Defender for Cloud recommendations and their Secure Score, but the Attack path analysis and Cloud security explorer blades return no data. What is required to enable those capabilities?
An engineer must answer the ad-hoc question "which virtual machines in our multicloud estate are exposed to the internet and also carry a high-severity vulnerability?" without waiting for a finding to be raised. Which Defender for Cloud capability is designed for this?
You've completed this section
Continue exploring other exams