Description:
Microsoft Defender for DNS is part of Microsoft Defender for Cloud and helps detect suspicious DNS activities such as data exfiltration, command-and-control communication, and malware-based DNS queries. Enabling this service improves threat visibility and strengthens protection for Azure resources.
Rationale:
DNS-based attacks are commonly used in malware communication and data exfiltration. Enabling Microsoft Defender for DNS allows Azure to continuously monitor DNS traffic and alert administrators about potentially malicious behavior, helping reduce the risk of breaches and unauthorized data transfer.
Impact:
Enabling Defender for DNS may increase costs, work only with Azure DNS, and require regular alert monitoring to ensure threats are detected and addressed promptly.
Pre-requisites:
You must have at least a Security Admin, Contributor, or Owner role on the subscription.
Microsoft Defender for Cloud must be enabled on the subscription.
A supported Azure subscription plan is active (Defender for DNS is a paid plan).
DNS traffic must flow through Azure-provided DNS to be fully monitored.
Remediation:
Test plan:
Sign in to the Azure Portal.
Search for and open Microsoft Defender for Cloud.
Select Environment settings from the left menu.
Click on your Subscription.
Open Defender plans.
Locate DNS in the list.
Verify the status shows ON or OFF
Compliant: Status is On
on-compliant: Status is Off
Remediation Steps:
Open Microsoft Defender for Cloud in the Azure Portal.
In Management, go to Environment settings.
Select the relevant Subscription.
Open Defender plans.
Find DNS.
Toggle the setting to On.
Click Save.
Backout Plan:
Sign in to the Azure Portal.
Open Microsoft Defender for Cloud.
In Management, go to Environment settings.
Select the affected Subscription.
Click Defender plans.
Locate DNS.
Toggle the setting to Off.
Click Save to apply the change.
References: