Description:
Enable automatic provisioning of the monitoring agent to collect security data.
Rationale:
When the Automatic provisioning of the monitoring agent is turned on, Azure Security Center provisions the Microsoft Monitoring Agent on all existing supported Azure virtual machines and any new ones that are created. The Microsoft Monitoring Agent scans for various security-related configurations and events such as system updates, OS vulnerabilities, endpoint protection, and provides alerts.
Default Value:
By default, Automatic provisioning of the monitoring agent is set to On.
Audit:
Sign in to your Azure account.
Go to Security Center
Select Pricing & settings blade
- Click on the subscription name
- Ensure that Automatic provisioning is set to On
If not follow the Implementation steps
Using Azure Command Line Interface 2.0
Ensure the output of the below command is On
az account get-access-token --query
"{subscription:subscription,accessToken:accessToken}" --out tsv | xargs -L1 bash -c 'curl -X GET -H "Authorization: Bearer $1" -H "Content-Type: application/json"
https://management.azure.com/subscriptions/$0/providers/Microsoft.Security/au toProvisioningSettings?api-version=2017-08-01-preview' | jq '.|.value[] | select(.name=="default")'|jq '.properties.autoProvision'Using PowerShell
Connect-AzAccount
Get-AzSecurityAutoProvisioningSettingEnsure output for Id Name AutoProvision' is /subscriptions//providers/Microsoft.Security/autoProvisioningSettings/default default On
Remediation:
Pre-Requisite:
An Azure Defender plan for Enhanced security plan (Azure Defender is free for the first 30 days. At the end of 30 days, if you choose to continue using the service, you’ll automatically charged for usage).
Implementation Steps:
Go to Security Center
Select Pricing & settings blade
Click on the subscription name
Set Automatic provisioning to On
Click save
Backout Plan:
Go to Security Center
Click on Pricing & Settings
Click on a subscription
Click on Data Collection
Ensure that Automatic provisioning is set to On(how we can revoke the changes)
Using Azure Command-Line Interface 2.0
Use the below command to set Automatic provisioning of monitoring agent to On.
az account get-access-token --query
"{subscription:subscription,accessToken:accessToken}" --out tsv | xargs -L1 bash -c 'curl -X PUT -H "Authorization: Bearer $1" -H "Content-Type: application/json"
https://management.azure.com/subscriptions/$0/providers/Microsoft.Security/au toProvisioningSettings/default?api-version=2017-08-01-preview - d@"input.json"'Where input.json contains the Request body json data as mentioned below.
{
"id": "/subscriptions/<Your_Subscription_Id>/providers/Microsoft.Security/autoProvi sioningSettings/default",
"name": "default",
"type": "Microsoft.Security/autoProvisioningSettings", "properties": {
"autoProvision": "On"
}
}Note:
Excluding any of the entries in input.json may disable the specific setting by default
Microsoft has recently changed APIs to get and Update the Automatic Provisioning Setting. This recommendation is updated accordingly.