Skip to main content

Description

Turning on Microsoft Defender for Key Vault enables threat detection for Key Vault, providing threat intelligence, anomaly detection, and behavior analytics in the Microsoft Defender for Cloud.

Rationale​

Enabling Microsoft Defender for Key Vault allows for greater defense-in-depth, with threat detection provided by the Microsoft Security Response Center (MSRC).

Impact​

Turning on Microsoft Defender for Key Vault incurs an additional cost per resource.

Audit​

This policy flags an Azure Subscription as INCOMPLIANT if the related Azure Defender Plan for Key Vaults has its Pricing Tier set to Free.

A Subscription is also marked as INCOMPLIANT if the Defender Plan for Key Vaults does not exist in the CMDB.

Default Value​

By default, Microsoft Defender plan is off.

References​

  1. https://docs.microsoft.com/en-us/azure/security-center/security-center-detection-capabilities
  2. https://docs.microsoft.com/en-us/rest/api/securitycenter/pricings/list
  3. https://docs.microsoft.com/en-us/rest/api/securitycenter/pricings/update
  4. https://docs.microsoft.com/en-us/powershell/module/az.security/get-azsecuritypricing
  5. https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-logging-threat-detection#lt-1-enable-threat-detection-capabilities