Skip to main content

Description

Turning on Microsoft Defender for App Service enables threat detection for App Service, providing threat intelligence, anomaly detection, and behavior analytics in the Microsoft Defender for Cloud.

Rationale​

Enabling Microsoft Defender for App Service allows for greater defense-in-depth, with threat detection provided by the Microsoft Security Response Center (MSRC).

Impact​

Turning on Microsoft Defender for App Service incurs an additional cost per resource.

Audit​

This policy flags an Azure Subscription as INCOMPLIANT if the related Azure Defender Plan for App Services has its Pricing Tier set to Free.

A Subscription is also marked as INCOMPLIANT if the Defender Plan for App Services does not exist in the CMDB.

Default Value​

By default, Microsoft Defender plan is off.

References​

  1. https://docs.microsoft.com/en-us/azure/security-center/security-center-detection-capabilities
  2. https://docs.microsoft.com/en-us/rest/api/securitycenter/pricings/list
  3. https://docs.microsoft.com/en-us/rest/api/securitycenter/pricings/update
  4. https://docs.microsoft.com/en-us/powershell/module/az.security/get-azsecuritypricing
  5. https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-logging-threat-detection#lt-1-enable-threat-detection-capabilities