Back to Checks
azure

Defender for Azure Resource Manager is set to On (Standard pricing tier)

defender_ensure_defender_for_arm_is_on
Service: defenderSeverity: high
OfficialBuilt-inVerified
Categories:identity-access
Resource Type:microsoft.security/pricings

Microsoft Defender for Cloud plan for Azure Resource Manager is configured at the Standard tier for the subscription

Prowler logoProwlerprowler-provider-azure

Risk

Without this protection, malicious or misconfigured ARM deployments can go unnoticed. Adversaries could create high-privilege roles, disable logging, or deploy exfiltration paths and crypto workloads, degrading integrity, confidentiality, and availability of Azure resources.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks defender_ensure_defender_for_arm_is_on

Recommendation

Enable Microsoft Defender for Azure Resource Manager at the Standard tier across all subscriptions. Apply least privilege to deployment principals, enforce the plan via policy for new subscriptions, and route alerts to centralized monitoring to support defense-in-depth and rapid response.

Remediation

CLI

az security pricing create --name Arm --tier Standard

Terraform

# Enable Microsoft Defender for Azure Resource Manager at Standard tier
resource "azurerm_security_center_subscription_pricing" "<example_resource_name>" {
  tier          = "Standard"   # Critical: enables Standard pricing (ON)
  resource_type = "Arm"        # Critical: targets Defender for Azure Resource Manager
}

NativeIaC

// Enable Microsoft Defender for Azure Resource Manager at Standard tier
resource example_pricing 'Microsoft.Security/pricings@2023-01-01' = {
  name: 'Arm'
  properties: {
    pricingTier: 'Standard' // Critical: sets Defender for ARM plan to Standard (ON)
  }
}

Other

1In Azure Portal, go to Microsoft Defender for Cloud
2Select Environment settings > your subscription
3Open Defender plans
4Set "Defender for Azure Resource Manager" to On/Standard
5Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.defender.defender_client import defender_client


class defender_ensure_defender_for_arm_is_on(Check):
    def execute(self) -> Check_Report_Azure:
        findings = []
        for subscription, pricings in defender_client.pricings.items():
            subscription_name = defender_client.subscriptions.get(
                subscription, subscription
            )
            if "Arm" in pricings:
                report = Check_Report_Azure(
                    metadata=self.metadata(), resource=pricings["Arm"]
                )
                report.subscription = subscription
                report.resource_name = "Defender plan ARM"
                report.status = "PASS"
                report.status_extended = f"Defender plan Defender for ARM from subscription {subscription_name} ({subscription}) is set to ON (pricing tier standard)."
                if pricings["Arm"].pricing_tier != "Standard":
                    report.status = "FAIL"
                    report.status_extended = f"Defender plan Defender for ARM from subscription {subscription_name} ({subscription}) is set to OFF (pricing tier not standard)."

                findings.append(report)
        return findings

References