Defender Plans¶
Microsoft Defender for Cloud has two parts. Posture management (CSPM) finds misconfigurations and produces the Secure Score. Workload protection plans detect threats against specific resource types: servers, storage, Key Vault, databases, containers and more. Posture management is partly free. Workload plans are paid per resource and switched on per subscription.
Status: partly in place
Foundational CSPM (free) and a security contact are set on every subscription by policy. Workload protection plans are mostly off. The last governance analysis found about 11% of plan instances on the Standard tier (14 of 126).
What's in place¶
The EPAC assignment psa-sec-defender-001 (initiative Security - Defender for Cloud) is assigned at mg-intermediate-root. It keeps:
- Foundational CSPM enabled on every subscription. This gives recommendations, the Secure Score and asset inventory.
- A security contact email set, so Defender alerts reach someone.
It uses DeployIfNotExists, and like every assignment today it runs as DoNotEnforce. New subscriptions therefore need a remediation run. See Azure Policy (EPAC).
Subscriptions left directly under the Tenant Root Group are outside mg-intermediate-root and are not covered. Set the tenant's default management group to one inside the governed hierarchy, so new subscriptions land there.
Choosing workload plans¶
Enable plans according to what runs in a subscription, not everywhere by default. Each plan is billed per protected resource.
| Plan | Protects | Enable when | Priority |
|---|---|---|---|
| Defender for Resource Manager | Suspicious control-plane operations: unusual deployments, permission changes, access from unusual locations | Always. Every subscription has a control plane. | High |
| Defender for Key Vault | Unusual secret access, access from suspicious IP addresses | The subscription has Key Vaults | High |
| Defender for Storage | Malware uploads, unusual data access, data exfiltration | Storage accounts hold business or state data. The Terraform state accounts are the priority. | High |
| Defender for Servers (Plan 1 or 2) | Endpoint detection and response, vulnerability assessment, file integrity monitoring (Plan 2) | The subscription runs VMs or Arc-connected servers | When VMs exist |
| Defender for App Service | Attacks against web apps | App Service is in use. Static Web Apps are not covered by this plan. | When relevant |
| Defender for Databases | Threats against SQL, PostgreSQL, MySQL and Cosmos DB | Databases hold data | When relevant |
| Defender for Containers | Kubernetes and registry threats, image vulnerabilities | AKS or container registries exist | When relevant |
| Defender CSPM (paid) | Attack path analysis, cloud security explorer, agentless scanning | Enough estate that attack paths matter | Later |
A sensible first step
Enable Resource Manager, Key Vault and Storage on the management subscription first. It holds Terraform state, the central workspace and the platform's secrets, so it's the most valuable target in the tenant.
Managing plans as code¶
Plans are a per-subscription setting (Microsoft.Security/pricings). Two ways to manage them:
- Policy: add
DeployIfNotExistsmembers for each plan to the Defender initiative, with parameters per management group. For example, enable Servers only undermg-landingzones. This covers new subscriptions automatically once enforced. - Terraform:
azurerm_security_center_subscription_pricingin subscription vending, so each subscription gets its plans when it is created.
Choose one approach per plan, not both, to avoid the two fighting over the setting.
Effect on the Secure Score¶
Enabling a plan adds recommendations that didn't count before, so the Secure Score usually drops when a plan is switched on. This is expected, and it's why the Secure Score page says to explain every swing.