Check ID: defender_ensure_defender_for_containers_is_on
Provider: Azure
Service: defender
Severity: HIGH
Categories: container-security
Resource type: microsoft.security/pricings

What this check verifies

Azure subscriptions are assessed to determine if the Defender for Containers plan is configured with pricing tier Standard.

Risk

Without Defender for Containers, images and runtimes lack continuous threat detection and vulnerability assessment. Adversaries can ship malicious images, run cryptomining, exfiltrate secrets, and move laterally, degrading confidentiality and availability of container workloads.

Recommendation

Enable the Defender for Containers plan at Standard for all relevant subscriptions. Apply least privilege, integrate alerts with response workflows, and use defense in depth: signed images, private registries, RBAC, network policies, and periodic reviews to maintain consistent coverage.

Remediation

az security pricing create —name Containers —tier Standard

References

Where this check fires

This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable by Check ID = defender_ensure_defender_for_containers_is_on. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Azure checks