# 2.6 Ensure that Azure Defender is set to On for Kubernetes

- Source: https://support.icompaas.com/support/solutions/articles/62000219749-2-6-ensure-that-azure-defender-is-set-to-on-for-kubernetes
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Azure CIS Benchmark Level 1 & Level 2](https://support.icompaas.com/support/solutions/62000112163) › [2. Security Center](https://support.icompaas.com/support/solutions/folders/62000167545)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

## **Description:**

Turning on Azure Defender enables threat detection for Kubernetes, providing threat intelligence, anomaly detection, and behavior analytics in the Azure Security Center.

  

## **Rationale:**

Enabling Azure Defender for Kubernetes allows for greater defense-in-depth, with threat detection provided by the Microsoft Security Response Center (MSRC).

  

## **Impact:**

Turning on Azure Defender in Azure Security Center incurs an additional cost per resource.

  

## **Default Value:**

By default, Azure Defender off is selected.

  

## **Audit:**

1.  Signin into your Azure account.
    
2.  Go to Security Center
    
3.  Select Pricing & settings blade
    
4.  Click on the appropriate subscription name for which you wanted to turned on the defender on
    
5.  Select the Azure Defender plans blade
    
6.  Review the chosen pricing tier. For the **Kubernetes** resource type **Plan** should be set to **On**  
    **![](https://support.icompaas.com/assets/kb/05859e09bef21b63.png)**
    

## Using Azure Command Line Interface 2.0

Ensure the output of the below command is Standard

az account get-access-token --query "{subscription:subscription,accessToken:accessToken}" --out tsv | xargs -L1 bash -c 'curl -X GET -H "Authorization: Bearer $1" -H "Content-Type: application/json" https://management.azure.com/subscriptions/$0/providers/Microsoft.Security/pr icings?api-version=2018-06-01' | jq '.|.value\[\] | select(.name=="KubernetesService")'|jq '.properties.pricingTier'

## Using Powershell:

Get-AzAccount
Get-AzSecurityPricing | Where-Object {$\_.Name -eq 'KubernetesService'} | Select-Object Name, PricingTier

## **Remediation:**

### Pre-requisites:

1.  An Azure account
    
2.  An Azure Defender plan for Enhanced security plan (Azure Defender is _free for the first 30 days_. At the end of 30 days, if you choose to continue using the service, you’ll automatically charged for usage).
    

### Implementation Steps:

1.  Go to **Security Center**
    
2.  Select **Pricing & settings** blade  
    ![](https://support.icompaas.com/assets/kb/67ef4d78e58b785e.png)
    
3.  Click on the _subscription name_
    
4.  Select the **Azure Defender plans** blade  
    ![](https://support.icompaas.com/assets/kb/a6ab949e68939614.png)
    
5.  On the line in the table for **Kubernetes** Select **On** under **Plan** and click on **save**  
    

  

### Backout Plan:

1.  Go to **Security Center**
    
2.  Select **Pricing & settings** blade
    
3.  Click on the _subscription name_
    
4.  Select the **Azure Defender plans** blade
    
5.  Ensure that Azure Defender is set to OFF for Kubernetes(how we can revoke the changes)
    

  

## Using Azure Command-Line Interface 2.0

Use the below command to enable Standard pricing tier for Storage

az account get-access-token --query "{subscription:subscription,accessToken:accessToken}" --out tsv | xargs -L1 bash -c 'curl -X PUT -H "Authorization: Bearer $1" -H "Content-Type: application/json" 
https://management.azure.com/subscriptions/$0/providers/Microsoft.Security/pr icings/StorageAccounts?api-version=2018-06-01 -d@"input.json"'

Where input.json contains the Request body json data as mentioned below.

{
"id": "/subscriptions/<Your\_Subscription\_Id>/providers/Microsoft.Security/pricings/ StorageAccounts",
"name": "KubernetesService",
"type": "Microsoft.Security/pricings", "properties": {
"pricingTier": "Standard"
}
}

  

## **References:**

1.  [![](https://support.icompaas.com/assets/kb/bd1283cdac7485b0.png)](https://docs.microsoft.com/en-us/rest/api/securitycenter/pricings/list)[Pricings - List - REST API (Azure Security Center)](https://docs.microsoft.com/en-us/rest/api/securitycenter/pricings/list) 
    
2.  [![](https://support.icompaas.com/assets/kb/f1f70b31e721a81e.png)Pricings - Update - REST API (Azure Security Center)](https://docs.microsoft.com/en-us/rest/api/securitycenter/pricings/update) 
    
3.  [https://docs.microsoft.com/en-us/azure/security-center/security-center- detection-capabilities](https://docs.microsoft.com/en-us/azure/security-center/security-center-detection-capabilities "https://docs.microsoft.com/en-us/azure/security-center/security-center-detection-capabilities")
    
4.  [https://docs.microsoft.com/en-us/powershell/module/az.security/get- azsecuritypricing](https://docs.microsoft.com/en-us/powershell/module/az.security/get-azsecuritypricing "https://docs.microsoft.com/en-us/powershell/module/az.security/get-azsecuritypricing")[](https://docs.microsoft.com/en-us/powershell/module/az.security/get-azsecuritypricing "https://docs.microsoft.com/en-us/powershell/module/az.security/get-azsecuritypricing")**[](https://docs.microsoft.com/en-us/powershell/module/az.security/get-azsecuritypricing "https://docs.microsoft.com/en-us/powershell/module/az.security/get-azsecuritypricing")**

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.