Back to Checks
azure

Defender for DNS is set to On (Standard pricing tier)

defender_ensure_defender_for_dns_is_on
Service: defenderSeverity: high
OfficialBuilt-inVerified
Categories:forensics-ready
Resource Type:microsoft.security/pricings

Microsoft Defender for DNS is configured at the Standard tier for the subscription's Defender pricing

Prowler logoProwlerprowler-provider-azure

Risk

Absent Defender for DNS, query telemetry isn't inspected, allowing C2 callbacks, DNS tunneling, and malicious domains to bypass detection. This increases risks to confidentiality (exfiltration), integrity (malware/DGA), and availability (poisoned or hijacked resolution).

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks defender_ensure_defender_for_dns_is_on

Recommendation

Enable Defender for DNS at the Standard tier across applicable subscriptions. Apply defense in depth: restrict outbound DNS, use private DNS where feasible, and log/monitor query activity. Route alerts to centralized monitoring. Enforce least privilege on security settings and review exclusions regularly.

Remediation

CLI

az security pricing create --name Dns --tier Standard

Terraform

resource "azurerm_security_center_subscription_pricing" "example_resource_name" {
  resource_type = "Dns"
  tier          = "Standard" # Critical: enables Defender for DNS
}

NativeIaC

// Enable Microsoft Defender for DNS at subscription scope
targetScope = 'subscription'

resource example_resource_name 'Microsoft.Security/pricings@2023-01-01' = {
  name: 'Dns'
  properties: {
    pricingTier: 'Standard' // Critical: sets Defender for DNS to ON (Standard tier)
  }
}

Other

1In the Azure portal, go to Microsoft Defender for Cloud
2Select Environment settings and choose your subscription
3Open Defender plans
4Find DNS and set the plan to Standard (On)
5Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.defender.defender_client import defender_client


class defender_ensure_defender_for_dns_is_on(Check):
    def execute(self) -> Check_Report_Azure:
        findings = []
        for subscription, pricings in defender_client.pricings.items():
            subscription_name = defender_client.subscriptions.get(
                subscription, subscription
            )
            if "Dns" in pricings:
                report = Check_Report_Azure(
                    metadata=self.metadata(), resource=pricings["Dns"]
                )
                report.subscription = subscription
                report.resource_name = "Defender plan DNS"
                report.status = "PASS"
                report.status_extended = f"Defender plan Defender for DNS from subscription {subscription_name} ({subscription}) is set to ON (pricing tier standard)."
                if pricings["Dns"].pricing_tier != "Standard":
                    report.status = "FAIL"
                    report.status_extended = f"Defender plan Defender for DNS from subscription {subscription_name} ({subscription}) is set to OFF (pricing tier not standard)."

                findings.append(report)
        return findings

References