Back to Checks
azure

Defender for Endpoint is enabled

defender_ensure_wdatp_is_enabled
Service: defenderSeverity: high
OfficialBuilt-inVerified
Categories:vulnerabilitiesforensics-ready
Resource Type:microsoft.security/integrations

Azure subscription integrates Microsoft Defender for Endpoint with Defender for Cloud via WDATP. The setting's presence and enabled state at the subscription scope are evaluated.

Prowler logoProwlerprowler-provider-azure

Risk

Without this integration, servers lack EDR telemetry, automated onboarding, and unified alerts, shrinking visibility. Hands-on-keyboard intrusions, ransomware, and credential theft can persist unnoticed, enabling data exfiltration (confidentiality), unauthorized changes (integrity), and outages (availability).

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks defender_ensure_wdatp_is_enabled

Recommendation

Enable the Defender for Endpoint integration in Defender for Cloud at the subscription scope and ensure agents are deployed on supported machines.

  • Apply least privilege to onboarding roles
  • Centralize alerting and response
  • Use defense in depth with hardening and network controls to reduce attack surface

Remediation

CLI

az rest --method put --uri https://management.azure.com/subscriptions/<SUBSCRIPTION_ID>/providers/Microsoft.Security/settings/WDATP?api-version=2019-01-01 --body '{"properties":{"isEnabled":true}}'

Terraform

# Enable Microsoft Defender for Endpoint (WDATP) integration
resource "azurerm_security_center_setting" "<example_resource_name>" {
  setting_name = "WDATP"
  enabled      = true # Critical: turns on WDATP integration
}

NativeIaC

// Enable Microsoft Defender for Endpoint (WDATP) integration at subscription scope
resource <example_resource_name> 'Microsoft.Security/settings@2019-01-01' = {
  name: 'WDATP'
  properties: {
    isEnabled: true // Critical: turns on the WDATP (Defender for Endpoint) integration
  }
}

Other

1In Azure Portal, go to Microsoft Defender for Cloud
2Select Environment settings > choose your subscription
3Open Settings (or Integrations)
4Find Microsoft Defender for Endpoint (WDATP) integration
5Toggle On and Save

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.defender.defender_client import defender_client


class defender_ensure_wdatp_is_enabled(Check):
    def execute(self) -> Check_Report_Azure:
        findings = []

        for (
            subscription_id,
            settings,
        ) in defender_client.settings.items():
            subscription_name = defender_client.subscriptions.get(
                subscription_id, subscription_id
            )
            if "WDATP" not in settings:
                report = Check_Report_Azure(metadata=self.metadata(), resource={})
                report.subscription = subscription_id
                report.resource_name = subscription_id
                report.resource_id = f"/subscriptions/{subscription_id}"
                report.status = "FAIL"
                report.status_extended = f"Microsoft Defender for Endpoint integration not exists for subscription {subscription_name} ({subscription_id})."
            else:
                report = Check_Report_Azure(
                    metadata=self.metadata(), resource=settings["WDATP"]
                )
                report.subscription = subscription_id
                if settings["WDATP"].enabled:
                    report.status = "PASS"
                    report.status_extended = f"Microsoft Defender for Endpoint integration is enabled for subscription {subscription_name} ({subscription_id})."
                else:
                    report.status = "FAIL"
                    report.status_extended = f"Microsoft Defender for Endpoint integration is disabled for subscription {subscription_name} ({subscription_id})."

            findings.append(report)

        return findings

References