Check ID:
Provider: Azure
Service:
Severity: HIGH
Categories:
Resource type:
defender_ensure_defender_for_keyvault_is_onProvider: Azure
Service:
defenderSeverity: HIGH
Categories:
secretsResource type:
microsoft.security/pricingsWhat this check verifies
Azure subscriptions are evaluated for the Defender for Key Vaults plan configured at theStandard tier. It identifies where Key Vault protection uses this tier versus where the Defender pricing for KeyVaults is not set accordingly.
Risk
Without Defender for Key Vaults, anomalous access and mass secret retrievals can go undetected, enabling:- Secret exfiltration (confidentiality)
- Key/secret tampering (integrity)
- Destructive actions like purge/delete (availability)
Recommendation
Enable Defender for Key Vaults at theStandard tier across all subscriptions. Integrate alerts with monitoring and tune noise. Apply least privilege with RBAC, enforce purge protection and logging, and use defense in depth (private access and network restrictions) to prevent abuse and accelerate detection.
Remediation
- CLI
- Terraform
- Native IaC
- Dashboard steps
az security pricing update —name KeyVaults —tier Standard
References
- https://www.trendmicro.com/cloudoneconformity/knowledge-base/azure/SecurityCenter/defender-key-vault.html
- https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-key-vault-introduction
Where this check fires
This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable byCheck ID = defender_ensure_defender_for_keyvault_is_on. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Azure checks