Check ID:
Provider: Azure
Service:
Severity: HIGH
Categories:
Resource type:
defender_ensure_defender_for_arm_is_onProvider: Azure
Service:
defenderSeverity: HIGH
Categories:
identity-accessResource type:
microsoft.security/pricingsWhat this check verifies
Microsoft Defender for Cloud plan for Azure Resource Manager is configured at theStandard tier for the subscription
Risk
Without this protection, malicious or misconfigured ARM deployments can go unnoticed. Adversaries could create high-privilege roles, disable logging, or deploy exfiltration paths and crypto workloads, degrading integrity, confidentiality, and availability of Azure resources.Recommendation
Enable Microsoft Defender for Azure Resource Manager at theStandard tier across all subscriptions. Apply least privilege to deployment principals, enforce the plan via policy for new subscriptions, and route alerts to centralized monitoring to support defense-in-depth and rapid response.
Remediation
- CLI
- Terraform
- Native IaC
- Dashboard steps
az security pricing create —name Arm —tier Standard
References
- https://techcommunity.microsoft.com/blog/coreinfrastructureandsecurityblog/switch-to-the-new-defender-for-resource-manager-pricing-plan/4001636
- https://www.trendmicro.com/cloudoneconformity/knowledge-base/azure/SecurityCenter/pricing-tier.html
Where this check fires
This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable byCheck ID = defender_ensure_defender_for_arm_is_on. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Azure checks