Back to Checks
azure

Defender for Containers is set to On (Standard pricing tier)

defender_ensure_defender_for_containers_is_on
Service: defenderSeverity: high
OfficialBuilt-inVerified
Categories:container-security
Resource Type:microsoft.security/pricings

Azure subscriptions are assessed to determine if the Defender for Containers plan is configured with pricing tier Standard.

Prowler logoProwlerprowler-provider-azure

Risk

Without Defender for Containers, images and runtimes lack continuous threat detection and vulnerability assessment. Adversaries can ship malicious images, run cryptomining, exfiltrate secrets, and move laterally, degrading confidentiality and availability of container workloads.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks defender_ensure_defender_for_containers_is_on

Recommendation

Enable the Defender for Containers plan at Standard for all relevant subscriptions. Apply least privilege, integrate alerts with response workflows, and use defense in depth: signed images, private registries, RBAC, network policies, and periodic reviews to maintain consistent coverage.

Remediation

CLI

az security pricing create --name Containers --tier Standard

Terraform

resource "azurerm_security_center_subscription_pricing" "<example_resource_name>" {
  resource_type = "Containers"   # Critical: targets Defender for Containers plan
  tier          = "Standard"     # Critical: enables Standard (ON)
}

NativeIaC

// Subscription-level deployment to enable Defender for Containers
targetScope = 'subscription'

resource <example_resource_name> 'Microsoft.Security/pricings@2023-01-01' = {
  name: 'Containers'
  properties: {
    pricingTier: 'Standard' // Critical: sets Defender for Containers plan to ON (Standard)
  }
}

Other

1In Azure Portal, go to Microsoft Defender for Cloud
2Select Environment settings > choose <subscription>
3Open Pricing & settings
4Find the Containers plan and set it to On (Standard)
5Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.defender.defender_client import defender_client


class defender_ensure_defender_for_containers_is_on(Check):
    def execute(self) -> Check_Report_Azure:
        findings = []
        for subscription, pricings in defender_client.pricings.items():
            subscription_name = defender_client.subscriptions.get(
                subscription, subscription
            )
            if "Containers" in pricings:
                report = Check_Report_Azure(
                    metadata=self.metadata(), resource=pricings["Containers"]
                )
                report.subscription = subscription
                report.status = "PASS"
                report.status_extended = f"Defender plan Defender for Containers from subscription {subscription_name} ({subscription}) is set to ON (pricing tier standard)."
                if pricings["Containers"].pricing_tier != "Standard":
                    report.status = "FAIL"
                    report.status_extended = f"Defender plan Defender for Containers from subscription {subscription_name} ({subscription}) is set to OFF (pricing tier not standard)."

                findings.append(report)
        return findings

References