Check ID:
Provider: Azure
Service:
Severity: HIGH
Categories:
Resource type:
defender_ensure_defender_for_cosmosdb_is_onProvider: Azure
Service:
defenderSeverity: HIGH
Categories:
vulnerabilitiesResource type:
microsoft.security/pricingsWhat this check verifies
Microsoft Defender for Azure Cosmos DB is enabled at the subscription using theStandard pricing tier for the CosmosDbs plan, covering all Cosmos DB accounts
Risk
Without this protection, Cosmos DB activity lacks advanced threat detection and telemetry. Attacks such as SQL injection, credential abuse, and anomalous access patterns may go unnoticed, enabling data exfiltration and unauthorized changes, degrading confidentiality and integrity.Recommendation
Enable theStandard plan for Microsoft Defender for Azure Cosmos DB at the subscription to ensure full coverage. Enforce least privilege, route alerts to your SIEM, and tune detections. Use policy to require the plan across environments and regularly review findings to strengthen defense in depth.
Remediation
- CLI
- Terraform
- Native IaC
- Dashboard steps
az security pricing create -n CosmosDbs —tier Standard
References
- https://learn.microsoft.com/th-th/Azure/defender-for-cloud/defender-for-databases-enable-cosmos-protections?tabs=azure-portal
- https://www.trendmicro.com/cloudoneconformity/knowledge-base/azure/CosmosDB/enable-advanced-threat-protection.html
Where this check fires
This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable byCheck ID = defender_ensure_defender_for_cosmosdb_is_on. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Azure checks