Back to Checks
azure

Defender auto-provisioning of Log Analytics agent for Azure VMs is enabled

defender_auto_provisioning_log_analytics_agent_vms_on
Service: defenderSeverity: high
OfficialBuilt-inVerified
Categories:logging
Resource Type:microsoft.resources/subscriptions

Microsoft Defender for Cloud auto-provisioning of the Log Analytics agent to Azure VMs is configured to On at the subscription level

Prowler logoProwlerprowler-provider-azure

Risk

Without automatic agent deployment, some VMs lack security telemetry, creating blind spots for vulnerabilities, missing patches, and threats.

Attackers can persist or move laterally unnoticed, undermining confidentiality and integrity, while delayed detection hampers effective response.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks defender_auto_provisioning_log_analytics_agent_vms_on

Recommendation

Set Defender for Cloud auto-provisioning to On so all VMs receive the monitoring agent consistently.

Apply defense in depth by enforcing coverage for new and existing machines, standardizing workspaces, and auditing enrollment. Use least privilege for data access and integrate with endpoint protection and vulnerability assessment.

Remediation

CLI

az security auto-provisioning-setting update --name default --auto-provision On

Terraform

# Enable Defender auto-provisioning of Log Analytics agent
resource "azurerm_security_center_auto_provisioning" "<example_resource_name>" {
  auto_provision = "On" # Critical: turns auto-provisioning ON
}

NativeIaC

// Enable Defender auto-provisioning of Log Analytics agent at subscription scope
targetScope = 'subscription'

resource autoProv 'Microsoft.Security/autoProvisioningSettings@2017-08-01-preview' = {
  name: 'default'
  properties: {
    autoProvision: 'On' // Critical: turns auto-provisioning ON for the subscription
  }
}

Other

1In the Azure portal, open Microsoft Defender for Cloud
2Select Environment settings, then choose your subscription
3Open Auto provisioning
4Set Auto-provisioning of Log Analytics agent to On
5Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.defender.defender_client import defender_client


class defender_auto_provisioning_log_analytics_agent_vms_on(Check):
    def execute(self) -> Check_Report_Azure:
        findings = []

        for (
            subscription_id,
            auto_provisioning_settings,
        ) in defender_client.auto_provisioning_settings.items():
            subscription_name = defender_client.subscriptions.get(
                subscription_id, subscription_id
            )
            for auto_provisioning_setting in auto_provisioning_settings.values():
                report = Check_Report_Azure(
                    metadata=self.metadata(),
                    resource=auto_provisioning_setting,
                )
                report.subscription = subscription_id
                report.status = "PASS"
                report.status_extended = f"Defender Auto Provisioning Log Analytics Agents from subscription {subscription_name} ({subscription_id}) is set to ON."

                if auto_provisioning_setting.auto_provision != "On":
                    report.status = "FAIL"
                    report.status_extended = f"Defender Auto Provisioning Log Analytics Agents from subscription {subscription_name} ({subscription_id}) is set to OFF."

                findings.append(report)

        return findings

References