Back to Checks
azure

Microsoft Defender CSPM is set to On

defender_ensure_defender_cspm_is_on
Service: defenderSeverity: medium
OfficialBuilt-inVerified
Categories:threat-detection
Resource Type:microsoft.security/pricings

Microsoft Defender for Cloud Cloud Security Posture Management (CSPM) plan is evaluated for standard tier activation. Defender CSPM provides advanced posture management capabilities including attack path analysis, cloud security explorer, agentless scanning, and governance rules.

Prowler logoProwlerprowler-provider-azure

Risk

Without Defender CSPM, the subscription relies on foundational CSPM (free tier) which lacks attack path analysis, agentless vulnerability scanning, and security governance. Advanced threats exploiting misconfiguration chains go undetected.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks defender_ensure_defender_cspm_is_on

Recommendation

Enable Defender CSPM standard tier for advanced cloud security posture management. Evaluate the cost against the security benefits — CSPM provides attack path analysis and agentless scanning.

Remediation

CLI

az security pricing create -n CloudPosture --tier Standard

Terraform

resource "azurerm_security_center_subscription_pricing" "<example_resource_name>" {
  tier          = "Standard"  # Critical: enables Defender CSPM
  resource_type = "CloudPosture"
}

NativeIaC

targetScope = 'subscription'

resource defenderCSPM 'Microsoft.Security/pricings@2024-01-01' = {
  name: 'CloudPosture'
  properties: {
    pricingTier: 'Standard' // Critical: enables Defender CSPM
  }
}

Other

1Sign in to Azure portal
2Go to Microsoft Defender for Cloud
3Select Environment Settings
4Click on the subscription
5Set Cloud Security Posture Management (CSPM) to On
6Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.defender.defender_client import defender_client


class defender_ensure_defender_cspm_is_on(Check):
    """
    Ensure Microsoft Defender Cloud Security Posture Management (CSPM) is set to On.

    This check evaluates whether the Defender CSPM plan (CloudPosture pricing) is enabled with the Standard tier for each subscription.

    - PASS: The CloudPosture pricing tier is "Standard" (Defender CSPM is on).
    - FAIL: The CloudPosture pricing tier is not "Standard" (Defender CSPM is off).
    """

    def execute(self) -> Check_Report_Azure:
        findings = []
        for subscription, pricings in defender_client.pricings.items():
            subscription_name = defender_client.subscriptions.get(
                subscription, subscription
            )
            if "CloudPosture" in pricings:
                report = Check_Report_Azure(
                    metadata=self.metadata(),
                    resource=pricings["CloudPosture"],
                )
                report.subscription = subscription
                report.resource_name = "Defender plan CSPM"
                report.status = "PASS"
                report.status_extended = f"Defender plan CSPM from subscription {subscription_name} ({subscription}) is set to ON (pricing tier standard)."
                if pricings["CloudPosture"].pricing_tier != "Standard":
                    report.status = "FAIL"
                    report.status_extended = f"Defender plan CSPM from subscription {subscription_name} ({subscription}) is set to OFF (pricing tier not standard)."

                findings.append(report)
        return findings

References