# Ensure That Microsoft Defender for Azure Cosmos DB Is Set To 'On'

- Source: https://support.icompaas.com/support/solutions/articles/62000229841-ensure-that-microsoft-defender-for-azure-cosmos-db-is-set-to-on-
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [General](https://support.icompaas.com/support/solutions/62000037933) › [Azure Compliance / Control / Check](https://support.icompaas.com/support/solutions/folders/62000168797)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

Description:

Microsoft Defender for Azure Cosmos DB adds extra security to your Cosmos DB databases by detecting threats, monitoring for suspicious activity, and identifying risks or misconfigurations. Turning it “On” ensures your databases are continuously protected and that you receive alerts if any potential security issues arise.

  

Rationale:

Enabling Microsoft Defender for Azure Cosmos DB provides continuous monitoring, detects vulnerabilities and suspicious activities, improves threat protection, and helps maintain compliance. This reduces security risks and keeps your Cosmos DB environment protected.

  

Impact:

Enabling Microsoft Defender for Azure Cosmos DB improves security by providing continuous monitoring, real-time threat alerts, and vulnerability detection. It helps administrators respond quickly to unauthorized access or misconfigurations and offers recommendations to fix issues. This enhances overall protection and supports compliance with security best practices.

  

Default Value:

Microsoft Defender for Azure Cosmos DB is Off by default. It must be manually enabled at the subscription level in Microsoft Defender for Cloud.

  

Pre-requisites:

-   At least one Azure Cosmos DB account is deployed in the subscription.
    
-   Appropriate permissions (such as Security Admin, Owner, or Contributor) to enable Defender plans.
    
-   Defender for Cloud Billing is enabled for the subscription, as Microsoft Defender for Azure Cosmos DB is a paid plan.
    

  

Test Plan:

1.  Sign in to the Azure portal at [https://portal.azure.com](https://portal.azure.com/).
    
2.  In the portal, search for Microsoft Defender for Cloud.
    
3.  Under Management, open Environment settings.
    
4.  Select the target subscription and go to Defender plans.
    
5.  Under Cloud Workload Protection (CWPP), select Databases to view the resource types.
    
6.  Locate Azure Cosmos DB and verify that its toggle is set to On.
    

![](https://support.icompaas.com/assets/kb/d785dc692e66e663.png)

7.  If it is off, follow the implementation Plan.
    

  

Implementation Plan:

1.  Sign in to the Azure Portal at [https://portal.azure.com](https://portal.azure.com/), 
    
2.  In the portal, search for Microsoft Defender for Cloud.
    
3.  Under Management, open Environment settings.
    
4.  Select the target subscription, and go to Defender plans.
    

                                ![](https://support.icompaas.com/assets/kb/e9afb46c4ed4db4e.png)

5.  Under Cloud Workload Protection (CWPP), select Databases to view the resource types.
    

                          ![](https://support.icompaas.com/assets/kb/e33faeb932ba5db0.png)

6.  locate Azure Cosmos DB, and verify that its toggle is set to On.
    

![](https://support.icompaas.com/assets/kb/a9a376cea39d5457.png)

7.  Click Save to apply.
    

  

Backout Plan:

1.  Sign in to the Azure portal at [https://portal.azure.com](https://portal.azure.com/).
    
2.  In the portal, search for Microsoft Defender for Cloud.
    
3.  Under Management, open Environment settings.
    
4.  Select the target subscription and go to Defender plans.
    
5.  Under Cloud Workload Protection (CWPP), select Databases to view the resource types.
    
6.  Locate Azure Cosmos DB and toggle it back to On.
    
7.  Click Save to apply the previous configuration.  
    

Reference:

-   [https://learn.microsoft.com/azure/defender-for-cloud/defender-for-cosmos-db-introduction](https://learn.microsoft.com/azure/defender-for-cloud/defender-for-cosmos-db-introduction)
    
-   [https://learn.microsoft.com/azure/defender-for-cloud/enable-enhanced-security](https://learn.microsoft.com/azure/defender-for-cloud/enable-enhanced-security)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.