Back to Checks
azure

Defender for App Services is set to On (Standard pricing tier)

defender_ensure_defender_for_app_services_is_on
Service: defenderSeverity: high
OfficialBuilt-inVerified
Categories:vulnerabilities
Resource Type:microsoft.security/pricings

Azure subscriptions are evaluated for Defender for App Service coverage by inspecting the AppServices pricing configuration. The finding indicates whether the plan is set to Standard, which applies protection to App Service resources at the subscription scope.

Prowler logoProwlerprowler-provider-azure

Risk

Without this coverage, malicious traffic and runtime anomalies may go unseen, enabling:

  • Confidentiality loss via data exfiltration
  • Integrity compromise through web shells or code tampering
  • Availability impact from takeover and resource abuse

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks defender_ensure_defender_for_app_services_is_on

Recommendation

Enable Defender for App Service at subscription scope with tier Standard. Integrate alerts with SOC tooling, tune rules to reduce noise, and review findings regularly. Apply defense in depth and least privilege, and automate responses to contain threats quickly.

Remediation

CLI

az security pricing create -n AppServices --tier standard

Terraform

# Enable Defender for App Services at subscription level
resource "azurerm_security_center_subscription_pricing" "example_resource_name" {
  tier          = "Standard"   # Critical: sets the plan to Standard (ON)
  resource_type = "AppServices" # Applies the setting to App Services
}

NativeIaC

// Enable Defender for App Services at subscription scope
targetScope = 'subscription'

resource example_resource_name 'Microsoft.Security/pricings@2024-01-01' = {
  name: 'AppServices'
  properties: {
    pricingTier: 'Standard' // Critical: sets the plan to Standard (ON) for App Services
  }
}

Other

1In the Azure portal, go to Microsoft Defender for Cloud
2Select Environment settings > your subscription
3On Defender plans, toggle App Service to On
4Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.defender.defender_client import defender_client


class defender_ensure_defender_for_app_services_is_on(Check):
    def execute(self) -> Check_Report_Azure:
        findings = []
        for subscription, pricings in defender_client.pricings.items():
            subscription_name = defender_client.subscriptions.get(
                subscription, subscription
            )
            if "AppServices" in pricings:
                report = Check_Report_Azure(
                    metadata=self.metadata(), resource=pricings["AppServices"]
                )
                report.subscription = subscription
                report.resource_name = "Defender plan App Services"
                report.status = "PASS"
                report.status_extended = f"Defender plan Defender for App Services from subscription {subscription_name} ({subscription}) is set to ON (pricing tier standard)."
                if pricings["AppServices"].pricing_tier != "Standard":
                    report.status = "FAIL"
                    report.status_extended = f"Defender plan Defender for App Services from subscription {subscription_name} ({subscription}) is set to OFF (pricing tier not standard)."

                findings.append(report)
        return findings

References