# Ensure That Microsoft Defender for DNS Is Set To 'On'

- Source: https://support.icompaas.com/support/solutions/articles/62000229842-ensure-that-microsoft-defender-for-dns-is-set-to-on
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [General](https://support.icompaas.com/support/solutions/62000037933) › [Azure Compliance / Control / Check](https://support.icompaas.com/support/solutions/folders/62000168797)
- Last updated: 2026-06-10
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

Description:

Microsoft Defender for DNS is part of Microsoft Defender for Cloud and helps detect suspicious DNS activities such as data exfiltration, command-and-control communication, and malware-based DNS queries. Enabling this service improves threat visibility and strengthens protection for Azure resources.

  

Rationale:

DNS-based attacks are commonly used in malware communication and data exfiltration. Enabling Microsoft Defender for DNS allows Azure to continuously monitor DNS traffic and alert administrators about potentially malicious behavior, helping reduce the risk of breaches and unauthorized data transfer.

  

Impact:

Enabling Defender for DNS may increase costs, work only with Azure DNS, and require regular alert monitoring to ensure threats are detected and addressed promptly.

  

Pre-requisites:

-   You must have at least a Security Admin, Contributor, or Owner role on the subscription.
    
-   Microsoft Defender for Cloud must be enabled on the subscription.
    
-   A supported Azure subscription plan is active (Defender for DNS is a paid plan).
    
-   DNS traffic must flow through Azure-provided DNS to be fully monitored.  
      
    

Remediation:

Test plan:

1.  Sign in to the Azure Portal.
    
2.  Search for and open Microsoft Defender for Cloud.
    
3.  Select Environment settings from the left menu.
    
4.  Click on your Subscription.
    
5.  Open Defender plans.
    
6.  Locate DNS in the list.
    
7.  Verify the status shows ON or OFF  
    Compliant: Status is On  
    on-compliant: Status is Off
    

  

Remediation Steps:

1.  Open Microsoft Defender for Cloud in the Azure Portal.
    
2.  In Management, go to Environment settings.
    

  

3.  Select the relevant Subscription.
    
4.  Open Defender plans.
    

5.  Find DNS.
    
6.  Toggle the setting to On.
    
7.  Click Save.
    

  

Backout Plan:

1.  Sign in to the Azure Portal.
    
2.  Open Microsoft Defender for Cloud.
    
3.  In Management, go to Environment settings.
    
4.  Select the affected Subscription.
    
5.  Click Defender plans.
    
6.  Locate DNS.
    
7.  Toggle the setting to Off.
    
8.  Click Save to apply the change.
    

  

References:

-   [https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-cloud-introduction](https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-cloud-introduction)
    
-   [https://learn.microsoft.com/en-us/azure/defender-for-cloud/enable-enhanced-security](https://learn.microsoft.com/en-us/azure/defender-for-cloud/enable-enhanced-security)
    
-   [https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-dns](https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-dns)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.