Check ID: defender_ensure_defender_for_keyvault_is_on
Provider: Azure
Service: defender
Severity: HIGH
Categories: secrets
Resource type: microsoft.security/pricings

What this check verifies

Azure subscriptions are evaluated for the Defender for Key Vaults plan configured at the Standard tier. It identifies where Key Vault protection uses this tier versus where the Defender pricing for KeyVaults is not set accordingly.

Risk

Without Defender for Key Vaults, anomalous access and mass secret retrievals can go undetected, enabling:
  • Secret exfiltration (confidentiality)
  • Key/secret tampering (integrity)
  • Destructive actions like purge/delete (availability)
Lack of signals delays response and facilitates lateral movement.

Recommendation

Enable Defender for Key Vaults at the Standard tier across all subscriptions. Integrate alerts with monitoring and tune noise. Apply least privilege with RBAC, enforce purge protection and logging, and use defense in depth (private access and network restrictions) to prevent abuse and accelerate detection.

Remediation

az security pricing update —name KeyVaults —tier Standard

References

Where this check fires

This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable by Check ID = defender_ensure_defender_for_keyvault_is_on. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Azure checks