Back to Checks
azure

Defender for Servers is set to On (Standard pricing tier)

defender_ensure_defender_for_server_is_on
Service: defenderSeverity: high
OfficialBuilt-inVerified
Categories:vulnerabilities
Resource Type:microsoft.security/pricings

Microsoft Defender for Servers subscription plan (VirtualMachines) is configured to the Standard tier. The evaluation checks whether the Servers plan is enabled at this level for all server workloads in the subscription.

Prowler logoProwlerprowler-provider-azure

Risk

Without Defender for Servers, endpoints lack unified EDR, hardening, and threat analytics. This enables silent malware, credential theft, and lateral movement, driving data exfiltration (C), ransomware/tampering (I), and outages or cryptomining abuse (A).

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks defender_ensure_defender_for_server_is_on

Recommendation

Enable the Defender for Servers plan at the subscription scope with tier Standard, choosing P1 or P2 per asset risk. Ensure all Azure VMs and Arc-enabled servers are covered for EDR integration. Apply defense in depth and least privilege, and continuously monitor and tune alerts.

Remediation

CLI

az security pricing create --name VirtualMachines --tier Standard

Terraform

# Enable Defender for Servers (Standard) on the subscription
resource "azurerm_security_center_subscription_pricing" "<example_resource_name>" {
  resource_type = "VirtualMachines"
  tier          = "Standard" # Critical: sets Defender for Servers to ON (Standard)
}

NativeIaC

// Enable Defender for Servers (Standard) at subscription scope
@description('Enable Microsoft Defender for Servers (Standard)')
targetScope = 'subscription'

resource <example_resource_name> 'Microsoft.Security/pricings@2024-01-01' = {
  name: 'VirtualMachines'
  properties: {
    pricingTier: 'Standard' // Critical: sets Defender for Servers to ON (Standard)
  }
}

Other

1In Azure Portal, go to Microsoft Defender for Cloud
2Select Environment settings, then your <subscription>
3On Defender plans, set Servers to On (Standard)
4Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.defender.defender_client import defender_client


class defender_ensure_defender_for_server_is_on(Check):
    def execute(self) -> Check_Report_Azure:
        findings = []
        for subscription, pricings in defender_client.pricings.items():
            subscription_name = defender_client.subscriptions.get(
                subscription, subscription
            )
            if "VirtualMachines" in pricings:
                report = Check_Report_Azure(
                    metadata=self.metadata(),
                    resource=pricings["VirtualMachines"],
                )
                report.subscription = subscription
                report.resource_name = "Defender plan Servers"
                report.status = "PASS"
                report.status_extended = f"Defender plan Defender for Servers from subscription {subscription_name} ({subscription}) is set to ON (pricing tier standard)."
                if pricings["VirtualMachines"].pricing_tier != "Standard":
                    report.status = "FAIL"
                    report.status_extended = f"Defender plan Defender for Servers from subscription {subscription_name} ({subscription}) is set to OFF (pricing tier not standard)."

                findings.append(report)
        return findings

References