Threat detection, posture & security operations
Amazon GuardDuty vs Microsoft Defender for Cloud (workload protection)
Amazon GuardDuty maps to the workload protection plans in Microsoft Defender for Cloud (Defender for Servers, Containers, Storage, Databases, Resource Manager, and others).
Side-by-side comparison
| Aspect | Amazon Web Services | Microsoft Azure |
|---|---|---|
| Service | Amazon GuardDuty | Microsoft Defender for Cloud (workload protection) |
| Lifecycle | Generally available | Generally available |
| What it is | Threat detection from CloudTrail, VPC Flow Logs, and DNS logs, plus protection plans for S3, EKS, runtime (EC2, ECS, EKS), malware, RDS logins, and Lambda. | Cloud-native application protection with paid Defender plans for servers, containers, storage, databases, App Service, Key Vault, Resource Manager, APIs, and AI, across Azure, AWS, and GCP. |
| Pricing model | Based on volume of analyzed events and logs, and per protection plan usage (with a 30-day free trial). | Per plan, usually per protected resource per hour or month (for example, per server or per storage account), with a 30-day trial for most plans. |
| Docs | Amazon GuardDuty docs | Microsoft Defender for Cloud (workload protection) docs |
| Pricing page | Amazon GuardDuty pricing | Microsoft Defender for Cloud (workload protection) pricing |
| Exams | SCS-C03 SAA-C03 | SC-500 SC-200 |
Key differences
- Packaging. GuardDuty is one service with foundational detection (CloudTrail, VPC Flow Logs, DNS logs) plus optional protection plans. Defender for Cloud enables a separate paid plan per resource type, with Defender for Endpoint integrated in Defender for Servers.
- Multicloud. Defender for Cloud can also protect AWS and GCP resources through connectors. GuardDuty covers AWS only.
- Alerts go to Security Hub (AWS) or Defender XDR and Sentinel (Microsoft).
Pricing summary
Pricing models only. No prices are quoted because they change by region and over time.
- AWS
- Based on volume of analyzed events and logs, and per protection plan usage (with a 30-day free trial). Amazon GuardDuty pricing →
- Azure
- Per plan, usually per protected resource per hour or month (for example, per server or per storage account), with a 30-day trial for most plans. Microsoft Defender for Cloud (workload protection) pricing →
Certification exam mapping
| Exam | Provider | Level | Status |
|---|---|---|---|
| AWS Certified Security – Specialty SCS-C03 | AWS | Specialty | current The current code (SCS-C03) is taken from the exam-prep link on the official certification page. Simplified Chinese, Spanish (Latin America), and Portuguese (Brazil) versions retire after Dec 31, 2026. |
| AWS Certified Solutions Architect – Associate SAA-C03 | AWS | Associate | current Italian version retires after Dec 31, 2026. |
| Microsoft Certified – Cloud and AI Security Engineer Associate SC-500 | Azure | Associate | current New certification. A practice assessment isn't available yet, which the page says usually means the exam recently left (or is in) beta. |
| Microsoft Certified – Security Operations Analyst Associate SC-200 | Azure | Associate | current |
Relevance is based on each exam's published scope, not a line-by-line objective match. Check the official study guide.
FAQ
What is the Azure equivalent of Amazon GuardDuty?
Amazon GuardDuty maps to the workload protection plans in Microsoft Defender for Cloud (Defender for Servers, Containers, Storage, Databases, Resource Manager, and others).
How does pricing compare between Amazon GuardDuty and Microsoft Defender for Cloud (workload protection)?
AWS: Based on volume of analyzed events and logs, and per protection plan usage (with a 30-day free trial). Azure: Per plan, usually per protected resource per hour or month (for example, per server or per storage account), with a 30-day trial for most plans. Check the official pricing pages for current rates.
Which certification exams cover this topic?
AWS Certified Security – Specialty (SCS-C03); AWS Certified Solutions Architect – Associate (SAA-C03); Microsoft Certified – Cloud and AI Security Engineer Associate (SC-500); Microsoft Certified – Security Operations Analyst Associate (SC-200).