Check ID: defender_ensure_defender_for_app_services_is_on
Provider: Azure
Service: defender
Severity: HIGH
Categories: vulnerabilities
Resource type: microsoft.security/pricings

What this check verifies

Azure subscriptions are evaluated for Defender for App Service coverage by inspecting the AppServices pricing configuration. The finding indicates whether the plan is set to Standard, which applies protection to App Service resources at the subscription scope.

Risk

Without this coverage, malicious traffic and runtime anomalies may go unseen, enabling:
  • Confidentiality loss via data exfiltration
  • Integrity compromise through web shells or code tampering
  • Availability impact from takeover and resource abuse

Recommendation

Enable Defender for App Service at subscription scope with tier Standard. Integrate alerts with SOC tooling, tune rules to reduce noise, and review findings regularly. Apply defense in depth and least privilege, and automate responses to contain threats quickly.

Remediation

az security pricing create -n AppServices —tier standard

References

Where this check fires

This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable by Check ID = defender_ensure_defender_for_app_services_is_on. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Azure checks