Back to Checks
azure

Defender for Cosmos DB is set to On (Standard pricing tier)

defender_ensure_defender_for_cosmosdb_is_on
Service: defenderSeverity: high
OfficialBuilt-inVerified
Categories:vulnerabilities
Resource Type:microsoft.security/pricings

Microsoft Defender for Azure Cosmos DB is enabled at the subscription using the Standard pricing tier for the CosmosDbs plan, covering all Cosmos DB accounts

Prowler logoProwlerprowler-provider-azure

Risk

Without this protection, Cosmos DB activity lacks advanced threat detection and telemetry. Attacks such as SQL injection, credential abuse, and anomalous access patterns may go unnoticed, enabling data exfiltration and unauthorized changes, degrading confidentiality and integrity.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks defender_ensure_defender_for_cosmosdb_is_on

Recommendation

Enable the Standard plan for Microsoft Defender for Azure Cosmos DB at the subscription to ensure full coverage. Enforce least privilege, route alerts to your SIEM, and tune detections. Use policy to require the plan across environments and regularly review findings to strengthen defense in depth.

Remediation

CLI

az security pricing create -n CosmosDbs --tier Standard

Terraform

# Enable Microsoft Defender for Cosmos DB at Standard tier
resource "azurerm_security_center_subscription_pricing" "example_resource_name" {
  resource_type = "CosmosDbs"  # Critical: target Cosmos DB plan
  tier          = "Standard"    # Critical: sets plan to ON (Standard)
}

NativeIaC

// Set Defender for Cosmos DB plan to Standard at subscription scope
targetScope = 'subscription'

resource example_resource_name 'Microsoft.Security/pricings@2023-01-01' = {
  name: 'CosmosDbs'
  properties: {
    pricingTier: 'Standard' // Critical: enables Defender for Cosmos DB (ON) at Standard tier
  }
}

Other

1In Azure portal, go to Microsoft Defender for Cloud > Environment settings
2Select the target subscription
3Open Defender plans (Pricing)
4Find Azure Cosmos DB and set the plan to On (Standard)
5Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.defender.defender_client import defender_client


class defender_ensure_defender_for_cosmosdb_is_on(Check):
    def execute(self) -> Check_Report_Azure:
        findings = []
        for subscription, pricings in defender_client.pricings.items():
            subscription_name = defender_client.subscriptions.get(
                subscription, subscription
            )
            if "CosmosDbs" in pricings:
                report = Check_Report_Azure(
                    metadata=self.metadata(), resource=pricings["CosmosDbs"]
                )
                report.subscription = subscription
                report.resource_name = "Defender plan Cosmos DB"
                report.status = "PASS"
                report.status_extended = f"Defender plan Defender for Cosmos DB from subscription {subscription_name} ({subscription}) is set to ON (pricing tier standard)."
                if pricings["CosmosDbs"].pricing_tier != "Standard":
                    report.status = "FAIL"
                    report.status_extended = f"Defender plan Defender for Cosmos DB from subscription {subscription_name} ({subscription}) is set to OFF (pricing tier not standard)."

                findings.append(report)
        return findings

References