Check ID: defender_ensure_defender_for_arm_is_on
Provider: Azure
Service: defender
Severity: HIGH
Categories: identity-access
Resource type: microsoft.security/pricings

What this check verifies

Microsoft Defender for Cloud plan for Azure Resource Manager is configured at the Standard tier for the subscription

Risk

Without this protection, malicious or misconfigured ARM deployments can go unnoticed. Adversaries could create high-privilege roles, disable logging, or deploy exfiltration paths and crypto workloads, degrading integrity, confidentiality, and availability of Azure resources.

Recommendation

Enable Microsoft Defender for Azure Resource Manager at the Standard tier across all subscriptions. Apply least privilege to deployment principals, enforce the plan via policy for new subscriptions, and route alerts to centralized monitoring to support defense-in-depth and rapid response.

Remediation

az security pricing create —name Arm —tier Standard

References

Where this check fires

This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable by Check ID = defender_ensure_defender_for_arm_is_on. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Azure checks