Check ID: defender_container_images_scan_enabled
Provider: Azure
Service: defender
Severity: HIGH
Categories: vulnerabilities, container-security
Resource type: microsoft.security/pricings

What this check verifies

Azure subscriptions have container image vulnerability assessment enabled for Azure Container Registry via Microsoft Defender for Cloud (ContainerRegistriesVulnerabilityAssessments). Images in registries are evaluated for known package vulnerabilities in their packages and dependencies.

Risk

Without registry scanning, known CVEs in images can reach runtime, enabling RCE, privilege escalation, and lateral movement. This undermines data confidentiality and integrity and can reduce availability through cryptomining or service disruption.

Recommendation

Enable Defender for Cloud image assessment for registries and adopt shift-left scanning.
  • Block deployment of images with high-severity findings
  • Rebuild from patched base images regularly
  • Enforce least privilege on registry access
  • Use image signing and admission controls

Remediation

az rest --method put --url https://management.azure.com/subscriptions/<SUBSCRIPTION_ID>/providers/Microsoft.Security/pricings/Containers?api-version=2023-01-01 --body '{"properties":{"pricingTier":"Standard","extensions":[{"name":"ContainerRegistriesVulnerabilityAssessments","isEnabled":true}]}}'

References

Where this check fires

This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable by Check ID = defender_container_images_scan_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Azure checks