Microsoft AzureOverview
Turning on Microsoft Defender for Servers enables threat detection, providing threat intelligence, anomaly detection, and behavior analytics in the Microsoft Defender for Cloud.
Rationale
Enabling Microsoft Defender for Servers allows for greater defense-in-depth, with threat detection provided by the Microsoft Security Response Center (MSRC).
Impact
Turning on Microsoft Defender for Servers in Microsoft Defender for Cloud incurs an additional cost per resource.
Two Defender for Servers plans exist:
- Plan 1: Subscription only
- Plan 2: Subscription and workspace
Default Value
By default, Microsoft Defender for Servers plan is off.
Remediation guidance
Remediate from Azure Portal
- Go to
Microsoft Defender for Cloud - Under
Management, selectEnvironment Settings - Click on the subscription name
- Click
Defender plansin the left pane - Under
Cloud Workload Protection (CWP), locateServerin the Plan column, set Status toOn - Select
Save
Remediate from Azure CLI
Run the following command:
az security pricing create -n VirtualMachines --tier 'standard'
Remediate from PowerShell
Run the following command:
Set-AzSecurityPricing -Name 'VirtualMachines' -PricingTier 'Standard'
Service-wide remediation
Recommended when many resources are affected: fix the platform baseline first so new resources inherit the secure setting, then remediate the existing flagged resources in batches.
Azure
Use management group or subscription Azure Policy assignments, remediation tasks where supported, landing-zone standards, and IaC modules so drift is prevented at scale.
Operational rollout
- Fix the baseline first at the account, subscription, project, cluster, or tenant scope that owns this control.
- Remediate the currently affected resources in batches, starting with internet-exposed and production assets.
- Re-scan and track approved exceptions with an owner and expiry date.
Query logic
These are the stored checks tied to this control.
Azure subscriptions without Microsoft Defender for Servers
Connectors
Covered asset types
Expected check: eq []
{
connectors(
where: { pricing_SOME: { name: "VirtualMachines", pricingTier: "Free" } }
) {
...AssetFragment
}
}
