Back to Checks
azure

Defender for Key Vaults is set to On (Standard pricing tier)

defender_ensure_defender_for_keyvault_is_on
Service: defenderSeverity: high
OfficialBuilt-inVerified
Categories:secrets
Resource Type:microsoft.security/pricings

Azure subscriptions are evaluated for the Defender for Key Vaults plan configured at the Standard tier. It identifies where Key Vault protection uses this tier versus where the Defender pricing for KeyVaults is not set accordingly.

Prowler logoProwlerprowler-provider-azure

Risk

Without Defender for Key Vaults, anomalous access and mass secret retrievals can go undetected, enabling:

  • Secret exfiltration (confidentiality)
  • Key/secret tampering (integrity)
  • Destructive actions like purge/delete (availability)

Lack of signals delays response and facilitates lateral movement.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks defender_ensure_defender_for_keyvault_is_on

Recommendation

Enable Defender for Key Vaults at the Standard tier across all subscriptions. Integrate alerts with monitoring and tune noise. Apply least privilege with RBAC, enforce purge protection and logging, and use defense in depth (private access and network restrictions) to prevent abuse and accelerate detection.

Remediation

CLI

az security pricing update --name KeyVaults --tier Standard

Terraform

# Enable Microsoft Defender for Key Vaults (Standard)
resource "azurerm_security_center_subscription_pricing" "example_resource_name" {
  resource_type = "KeyVaults"
  tier          = "Standard" # Critical: sets the plan to Standard (ON)
}

NativeIaC

// Enable Microsoft Defender for Key Vaults (Standard tier) at subscription scope
resource example_pricing 'Microsoft.Security/pricings@2023-01-01' = {
  name: 'KeyVaults'
  properties: {
    pricingTier: 'Standard' // Critical: sets the KeyVaults plan to Standard (ON)
  }
}

Other

1In Azure Portal, go to Microsoft Defender for Cloud
2Select Environment settings, then choose your subscription
3Open Defender plans
4Find Key Vaults and set the plan to On/Standard
5Save

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.defender.defender_client import defender_client


class defender_ensure_defender_for_keyvault_is_on(Check):
    def execute(self) -> Check_Report_Azure:
        findings = []
        for subscription, pricings in defender_client.pricings.items():
            subscription_name = defender_client.subscriptions.get(
                subscription, subscription
            )
            if "KeyVaults" in pricings:
                report = Check_Report_Azure(
                    metadata=self.metadata(), resource=pricings["KeyVaults"]
                )
                report.subscription = subscription
                report.resource_name = "Defender plan KeyVaults"
                report.status = "PASS"
                report.status_extended = f"Defender plan Defender for KeyVaults from subscription {subscription_name} ({subscription}) is set to ON (pricing tier standard)."
                if pricings["KeyVaults"].pricing_tier != "Standard":
                    report.status = "FAIL"
                    report.status_extended = f"Defender plan Defender for KeyVaults from subscription {subscription_name} ({subscription}) is set to OFF (pricing tier not standard)."

                findings.append(report)
        return findings

References