Check ID:
Provider: Azure
Service:
Severity: HIGH
Categories:
Resource type:
defender_ensure_defender_for_dns_is_onProvider: Azure
Service:
defenderSeverity: HIGH
Categories:
forensics-readyResource type:
microsoft.security/pricingsWhat this check verifies
Microsoft Defender for DNS is configured at theStandard tier for the subscription’s Defender pricing
Risk
Absent Defender for DNS, query telemetry isn’t inspected, allowing C2 callbacks, DNS tunneling, and malicious domains to bypass detection. This increases risks to confidentiality (exfiltration), integrity (malware/DGA), and availability (poisoned or hijacked resolution).Recommendation
Enable Defender for DNS at theStandard tier across applicable subscriptions. Apply defense in depth: restrict outbound DNS, use private DNS where feasible, and log/monitor query activity. Route alerts to centralized monitoring. Enforce least privilege on security settings and review exclusions regularly.
Remediation
- CLI
- Terraform
- Native IaC
- Dashboard steps
az security pricing create —name Dns —tier Standard
References
- https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-dns-introduction
- https://support.icompaas.com/support/solutions/articles/62000234089-ensure-that-microsoft-defender-for-dns-is-set-to-on-automated-
Where this check fires
This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable byCheck ID = defender_ensure_defender_for_dns_is_on. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Azure checks