Check ID:
Provider: Azure
Service:
Severity: HIGH
Categories:
Resource type:
defender_container_images_scan_enabledProvider: Azure
Service:
defenderSeverity: HIGH
Categories:
vulnerabilities, container-securityResource type:
microsoft.security/pricingsWhat this check verifies
Azure subscriptions have container image vulnerability assessment enabled for Azure Container Registry via Microsoft Defender for Cloud (ContainerRegistriesVulnerabilityAssessments). Images in registries are evaluated for known package vulnerabilities in their packages and dependencies.
Risk
Without registry scanning, known CVEs in images can reach runtime, enabling RCE, privilege escalation, and lateral movement. This undermines data confidentiality and integrity and can reduce availability through cryptomining or service disruption.Recommendation
Enable Defender for Cloud image assessment for registries and adopt shift-left scanning.- Block deployment of images with high-severity findings
- Rebuild from patched base images regularly
- Enforce least privilege on registry access
- Use image signing and admission controls
Remediation
- CLI
- Terraform
- Native IaC
- Dashboard steps
References
- https://learn.microsoft.com/en-us/azure/container-registry/scan-images-defender
- https://learn.microsoft.com/en-us/azure/container-registry/container-registry-check-health
- https://learn.microsoft.com/en-us/troubleshoot/azure/azure-container-registry/image-vulnerability-assessment
- https://www.trendmicro.com/cloudoneconformity/knowledge-base/azure/AKS/enable-image-vulnerability-scanning.html
Where this check fires
This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable byCheck ID = defender_container_images_scan_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Azure checks