Daily Defender News
Aboutmerill.net
Microsoft Defender for Cloud
Cloud and workloads

Workflow automation in Microsoft Defender for Cloud

4 September 2026Doc update+15 / −13 lines

In brief

The article now clarifies Logic Apps navigation, legacy trigger guidance, DeployIfNotExist policy behavior, and data schema access. It also improves headings, links, screenshots, and accessibility text.

What Defender admins need to know

Administrators can follow clearer instructions when configuring workflow automations and locating event schemas. No action is required.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Automate remediation responses in Microsoft Defender for Cloud

Every security program includes multiple workflows for incident response. These processes might include notifying relevant stakeholders, starting a change management process, and applying specific remediation steps.

Security experts recommend that you automate as many steps of security procedures as you can. Automation reduces overhead. It can also improve your security by ensuring process steps are done quickly, consistently, and according to your predefined requirements.

This article describes the workflow automation feature of Microsoft Defender for Cloud. ThisThe workflow automation feature can trigger consumption logic apps on security alerts, recommendations, and changes to regulatory compliance. For example, you might want Defender for Cloud to email a specific user when an alert occurs. You'll also learn how to create logic apps by using Azure Logic Apps.

Prerequisites

:::image type="content" source="media/workflow-automation/visit-logic.png" alt-text="Screenshot that shows the Actions section of the Add workflow automation screen and the link to go to Azure Logic Apps." border="true":::

You are taken toSelecting **visit the Logic Apps page** opens Azure Logic Apps.

  1. Select (+) Add.

  2. Review the information you entered, and then select Create.

    In your new logic app, you can choose from built-in, predefined templates from the security category. Or you can define a custom flow of events that occur when this process is triggered.the workflow automation runs.

  • When a Defender for Cloud regulatory compliance assessment is created or triggered: You want to trigger automations based on updates to regulatory compliance assessments.
  1. After you define your logic app, return to the Add workflow automation pane.

To manually run a logic app, open an alert or a recommendation, and then select Trigger logic app.

Screenshot of the recommendation page with the Trigger logic app option.

Configure workflow automation at scale

When you automate your organization's monitoring and incident response processes, the time it takes to investigate and mitigate security incidents can greatly improve.

To deploy your automation configurations across your organization, use the supplied Azure Policy DeployIfNotExist policies (mentioned later)described in the following table. The DeployIfNotExist policy effect automatically deploys required resources when they don't already exist, allowing you to create and configure workflow automation procedures.procedures at scale.

Get started with workflow automation templates. 

| Workflow automation for security recommendations | [Deploy Workflow Automation for Microsoft Defender for Cloud recommendations](https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F73d6ab6c-2475-4850-afd6-43795f3492ef) | 73d6ab6c-2475-4850-afd6-43795f3492ef          |
| Workflow automation for regulatory compliance changes | [Deploy Workflow Automation for Microsoft Defender for Cloud regulatory compliance](https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F509122b9-ddd9-47ba-a5f1-d0dac20be63c) | 509122b9-ddd9-47ba-a5f1-d0dac20be63c          |

You can also find policies by searching Azure Policy. In Azure Policy, select **Definitions**, and then search for themthe policies by name.

  1. On the relevant Azure Policy page, select Assign.

    :::image type="content" source="./media/workflow-automation/export-policy-assign.png" alt-text="Screenshot that shows how to assignof the Azure policy.Policy page with the Assign option highlighted.":::

  2. On the Basics tab, set the scope for the policy. To use centralized management, assign the policy to the Management Group that contains the subscriptions that use the workflow automation configuration.

  3. Review the summary page, and then select Create.

Data typestype schemas for workflow automation

To view the raw event schemas of the security alerts or recommendations events that are passed to the logic app, go to the data types schemas for workflow automation. This processViewing the raw event schemas can be useful in cases wherewhen you aren't using the built-in Defender for Cloud built-in Logic Apps connectors (mentioned previously), butand are instead are using the generic HTTP connector. You can use the event JSON schema to manually parse it as you see fit.

Related content