Check ID:
Provider: Azure
Service:
Severity: HIGH
Categories:
Resource type:
defender_ensure_defender_for_app_services_is_onProvider: Azure
Service:
defenderSeverity: HIGH
Categories:
vulnerabilitiesResource type:
microsoft.security/pricingsWhat this check verifies
Azure subscriptions are evaluated for Defender for App Service coverage by inspecting theAppServices pricing configuration. The finding indicates whether the plan is set to Standard, which applies protection to App Service resources at the subscription scope.
Risk
Without this coverage, malicious traffic and runtime anomalies may go unseen, enabling:- Confidentiality loss via data exfiltration
- Integrity compromise through web shells or code tampering
- Availability impact from takeover and resource abuse
Recommendation
Enable Defender for App Service at subscription scope with tierStandard. Integrate alerts with SOC tooling, tune rules to reduce noise, and review findings regularly. Apply defense in depth and least privilege, and automate responses to contain threats quickly.
Remediation
- CLI
- Terraform
- Native IaC
- Dashboard steps
az security pricing create -n AppServices —tier standard
References
- https://learn.microsoft.com/en-us/azure/defender-for-cloud/tutorial-enable-app-service-plan
- https://www.trendmicro.com/cloudoneconformity/knowledge-base/azure/SecurityCenter/defender-app-service.html
Where this check fires
This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable byCheck ID = defender_ensure_defender_for_app_services_is_on. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Azure checks