Defender for Endpoint is enabled

Check ID: defender_ensure_wdatp_is_enabled
Provider: Azure
Service: defender
Severity: HIGH
Categories: vulnerabilities, forensics-ready
Resource type: microsoft.security/integrations

What this check verifies

Azure subscription integrates Microsoft Defender for Endpoint with Defender for Cloud via WDATP. The setting’s presence and enabled state at the subscription scope are evaluated.

Risk

Without this integration, servers lack EDR telemetry, automated onboarding, and unified alerts, shrinking visibility. Hands-on-keyboard intrusions, ransomware, and credential theft can persist unnoticed, enabling data exfiltration (confidentiality), unauthorized changes (integrity), and outages (availability).

Recommendation

Enable the Defender for Endpoint integration in Defender for Cloud at the subscription scope and ensure agents are deployed on supported machines.

Apply least privilege to onboarding roles
Centralize alerting and response
Use defense in depth with hardening and network controls to reduce attack surface

Remediation

CLI
Terraform
Native IaC
Dashboard steps

az rest --method put --uri https://management.azure.com/subscriptions/<SUBSCRIPTION_ID>/providers/Microsoft.Security/settings/WDATP?api-version=2019-01-01 --body '{"properties":{"isEnabled":true}}'

# Enable Microsoft Defender for Endpoint (WDATP) integration
resource "azurerm_security_center_setting" "<example_resource_name>" {
  setting_name = "WDATP"
  enabled      = true # Critical: turns on WDATP integration
}

// Enable Microsoft Defender for Endpoint (WDATP) integration at subscription scope
resource <example_resource_name> 'Microsoft.Security/settings@2019-01-01' = {
  name: 'WDATP'
  properties: {
    isEnabled: true // Critical: turns on the WDATP (Defender for Endpoint) integration
  }
}

References

Where this check fires

This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable by Check ID = defender_ensure_wdatp_is_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to Azure checks

All virtual machines have system updates applied Conditional Access requires MFA for Microsoft Admin Portals

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires