Back to Checks
azure

Security Center built-in policy assignment has enforcement mode set to Default

policy_ensure_asc_enforcement_enabled
Service: policySeverity: medium
OfficialBuilt-inVerified
Resource Type:microsoft.authorization/policyassignments

Defender for Cloud default policy assignment (SecurityCenterBuiltIn) uses enforcement mode Default rather than DoNotEnforce

Prowler logoProwlerprowler-provider-azure

Risk

With DoNotEnforce, policy effects like deny and deployIfNotExists aren't applied, letting insecure configs persist. This erodes confidentiality and integrity (exposed endpoints, weak encryption) and can affect availability via unpatched or misconfigured services, enabling compromise and lateral movement.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks policy_ensure_asc_enforcement_enabled

Recommendation

Keep enforcement mode Default on the default initiative and avoid disabling critical effects. Apply at scale for consistent governance, align with least privilege and defense in depth, validate changes in Audit in non-prod, and manage justified exceptions via time-bound policy exemptions instead of turning enforcement off.

Remediation

CLI

az policy assignment update --name SecurityCenterBuiltIn --scope /subscriptions/<SUBSCRIPTION_ID> --enforcement-mode Default

Terraform

# Set enforcement mode to Default for the Security Center built-in assignment
resource "azurerm_policy_assignment" "<example_resource_name>" {
  name                 = "SecurityCenterBuiltIn"
  scope                = "/subscriptions/<SUBSCRIPTION_ID>"
  policy_definition_id = "<POLICY_OR_INITIATIVE_DEFINITION_ID>"
  enforcement_mode     = "Default" # CRITICAL: Enables enforcement to pass the check
}

NativeIaC

// Set enforcement mode to Default for the Security Center built-in assignment
// Deploy at subscription scope
targetScope = 'subscription'

resource policyAssignment 'Microsoft.Authorization/policyAssignments@2021-06-01' = {
  name: 'SecurityCenterBuiltIn'
  properties: {
    policyDefinitionId: '<POLICY_OR_INITIATIVE_DEFINITION_ID>'
    enforcementMode: 'Default' // CRITICAL: Ensures the assignment enforces policy (fixes the finding)
  }
}

Other

1In Azure portal, go to Policy > Assignments
2Find the assignment named "SecurityCenterBuiltIn" and select it
3Click Edit assignment
4Set Enforcement mode to Enabled (Default)
5Click Review + save to apply

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.policy.policy_client import policy_client


class policy_ensure_asc_enforcement_enabled(Check):
    def execute(self) -> Check_Report_Azure:
        findings = []

        for subscription_id, policies in policy_client.policy_assigments.items():
            subscription_name = policy_client.subscriptions.get(
                subscription_id, subscription_id
            )
            if "SecurityCenterBuiltIn" in policies:
                report = Check_Report_Azure(
                    metadata=self.metadata(),
                    resource=policies["SecurityCenterBuiltIn"],
                )
                report.subscription = subscription_id
                report.status = "PASS"
                report.status_extended = f"Policy assigment '{policies['SecurityCenterBuiltIn'].id}' from subscription {subscription_name} ({subscription_id}) is configured with enforcement mode '{policies['SecurityCenterBuiltIn'].enforcement_mode}'."
                if policies["SecurityCenterBuiltIn"].enforcement_mode != "Default":
                    report.status = "FAIL"
                    report.status_extended = f"Policy assigment '{policies['SecurityCenterBuiltIn'].id}' from subscription {subscription_name} ({subscription_id}) is not configured with enforcement mode Default."

                findings.append(report)

        return findings

References