Check ID: defender_ensure_defender_for_server_is_on
Provider: Azure
Service: defender
Severity: HIGH
Categories: vulnerabilities
Resource type: microsoft.security/pricings

What this check verifies

Microsoft Defender for Servers subscription plan (VirtualMachines) is configured to the Standard tier. The evaluation checks whether the Servers plan is enabled at this level for all server workloads in the subscription.

Risk

Without Defender for Servers, endpoints lack unified EDR, hardening, and threat analytics. This enables silent malware, credential theft, and lateral movement, driving data exfiltration (C), ransomware/tampering (I), and outages or cryptomining abuse (A).

Recommendation

Enable the Defender for Servers plan at the subscription scope with tier Standard, choosing P1 or P2 per asset risk. Ensure all Azure VMs and Arc-enabled servers are covered for EDR integration. Apply defense in depth and least privilege, and continuously monitor and tune alerts.

Remediation

az security pricing create —name VirtualMachines —tier Standard

References

Where this check fires

This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable by Check ID = defender_ensure_defender_for_server_is_on. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Azure checks