Check ID:
Provider: Azure
Service:
Severity: HIGH
Categories:
Resource type:
defender_ensure_defender_for_server_is_onProvider: Azure
Service:
defenderSeverity: HIGH
Categories:
vulnerabilitiesResource type:
microsoft.security/pricingsWhat this check verifies
Microsoft Defender for Servers subscription plan (VirtualMachines) is configured to the Standard tier. The evaluation checks whether the Servers plan is enabled at this level for all server workloads in the subscription.
Risk
Without Defender for Servers, endpoints lack unified EDR, hardening, and threat analytics. This enables silent malware, credential theft, and lateral movement, driving data exfiltration (C), ransomware/tampering (I), and outages or cryptomining abuse (A).Recommendation
Enable the Defender for Servers plan at the subscription scope with tierStandard, choosing P1 or P2 per asset risk. Ensure all Azure VMs and Arc-enabled servers are covered for EDR integration. Apply defense in depth and least privilege, and continuously monitor and tune alerts.
Remediation
- CLI
- Terraform
- Native IaC
- Dashboard steps
az security pricing create —name VirtualMachines —tier Standard
References
- https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers-select-plan
- https://learn.microsoft.com/en-us/azure/defender-for-cloud/faq-defender-for-servers
- https://www.trendmicro.com/cloudoneconformity/knowledge-base/azure/SecurityCenter/microsoft-defender-vm-server.html
- https://learn.microsoft.com/en-us/answers/questions/1131575/defender-for-servers-policy-definitions.html
Where this check fires
This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable byCheck ID = defender_ensure_defender_for_server_is_on. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Azure checks