Check ID:
Provider: Azure
Service:
Severity: HIGH
Categories:
Resource type:
defender_auto_provisioning_log_analytics_agent_vms_onProvider: Azure
Service:
defenderSeverity: HIGH
Categories:
loggingResource type:
microsoft.resources/subscriptionsWhat this check verifies
Microsoft Defender for Cloud auto-provisioning of the Log Analytics agent to Azure VMs is configured toOn at the subscription level
Risk
Without automatic agent deployment, some VMs lack security telemetry, creating blind spots for vulnerabilities, missing patches, and threats. Attackers can persist or move laterally unnoticed, undermining confidentiality and integrity, while delayed detection hampers effective response.Recommendation
Set Defender for Cloud auto-provisioning toOn so all VMs receive the monitoring agent consistently.
Apply defense in depth by enforcing coverage for new and existing machines, standardizing workspaces, and auditing enrollment. Use least privilege for data access and integrate with endpoint protection and vulnerability assessment.
Remediation
- CLI
- Terraform
- Native IaC
- Dashboard steps
az security auto-provisioning-setting update —name default —auto-provision On
References
- https://learn.microsoft.com/en-us/azure/defender-for-cloud/data-security
- https://www.trendmicro.com/cloudoneconformity-staging/knowledge-base/azure/SecurityCenter/automatic-provisioning-of-monitoring-agent.html
- https://learn.microsoft.com/en-us/azure/defender-for-cloud/monitoring-components
Where this check fires
This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable byCheck ID = defender_auto_provisioning_log_analytics_agent_vms_on. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Azure checks