Check ID:
Provider: Azure
Service:
Severity: HIGH
Categories:
Resource type:
defender_ensure_defender_for_containers_is_onProvider: Azure
Service:
defenderSeverity: HIGH
Categories:
container-securityResource type:
microsoft.security/pricingsWhat this check verifies
Azure subscriptions are assessed to determine if the Defender for Containers plan is configured with pricing tierStandard.
Risk
Without Defender for Containers, images and runtimes lack continuous threat detection and vulnerability assessment. Adversaries can ship malicious images, run cryptomining, exfiltrate secrets, and move laterally, degrading confidentiality and availability of container workloads.Recommendation
Enable the Defender for Containers plan atStandard for all relevant subscriptions. Apply least privilege, integrate alerts with response workflows, and use defense in depth: signed images, private registries, RBAC, network policies, and periodic reviews to maintain consistent coverage.
Remediation
- CLI
- Terraform
- Native IaC
- Dashboard steps
az security pricing create —name Containers —tier Standard
References
- https://www.trendmicro.com/cloudoneconformity/knowledge-base/azure/SecurityCenter/defender-container.html
- https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-containers-introduction
Where this check fires
This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable byCheck ID = defender_ensure_defender_for_containers_is_on. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Azure checks