🛡️ Azure Subscription Microsoft Defender for AI is not enabled🟢

• Contextual name: 🛡️ Subscription Microsoft Defender for AI is not enabled🟢
• ID: /ce/ca/azure/subscription/microsoft-defender-for-ai
• Tags:
  • 🟢 Policy with categories
  • 🟢 Policy with type
  • 🟢 Production policy
• Policy Type: COMPLIANCE_POLICY
• Policy Categories: SECURITY

Stats

not available

Logic

• 🧠 prod.logic.yaml🟢
  • 📗 Azure Subscription
  • 🔌 Azure Defender Plan - object.extracts.yaml
  • 🧪 test-data.json

Description

Open File

Description

Turning on Microsoft Defender for AI Services enables threat protection for Azure OpenAI and Azure AI model inference workloads in Microsoft Foundry, providing runtime detection of threats such as prompt injection attacks, data leakage, and credential theft in Microsoft Defender for Cloud.

Rationale

Enabling Microsoft Defender for AI Services allows for greater defense-in-depth. It continuously analyzes activity on supported Azure OpenAI and Azure AI model inference deployments and generates context-based security alerts for threats such as jailbreak, data leakage, and credential theft, drawing on Microsoft threat intelligence and Azure AI Content Safety Prompt Shields.

Audit

This policy marks an Azure Subscription as INCOMPLIANT if no current AI Defender plan satisfies Pricing Tier Standard.

A qualifying AI plan is COMPLIANT.

Remediation

Open File

Remediation

Enable Microsoft Defender for AI Services on the affected subscription by setting the AI plan to the Standard pricing tier.

Review the Defender for AI Services pricing and expected workload usage before enabling the plan. Standard pricing incurs additional charges. Record the current AI plan settings and confirm that you are updating the intended subscription.

From Azure Portal

1. Go to Microsoft Defender for Cloud.
2. Under Management, select Environment settings.
3. Select the affected subscription.
4. Select Defender plans.
5. Set Status to On for AI services.
6. Select Save.

Repeat these steps for each subscription requiring remediation.

From Azure CLI

Replace {{subscription-id}} with the affected subscription ID and enable the AI plan.

az security pricing create \
    --name AI \
    --tier Standard \
    --subscription "{{subscription-id}}"

From PowerShell

Select the affected subscription and enable the AI plan.

Set-AzContext -Subscription "{{subscription-id}}" -ErrorAction Stop

... [see more](remediation.md)

policy.yaml

Open File

Linked Framework Sections

Section	Sub Sections	Internal Rules	Policies	Flags	Compliance
💼 CIS Azure v7.0.0 → 💼 8.1.10.1 Ensure That Microsoft Defender for AI Services Is Set To 'On' (Automated)			1		no data
💼 Cloudaware Framework → 💼 Microsoft Defender Configuration			31		no data