Description:
Microsoft Defender for Resource Manager is part of Microsoft Defender for Cloud and provides enhanced security monitoring and threat protection for Azure Resource Manager (ARM). ARM is the core service used to deploy, configure, and manage Azure resources.
This includes monitoring for:
Misconfigurations in resources
Unauthorized access attempts
Changes to deployments or access policies
Potential security violations during resource management
Rationale:
Enabling Microsoft Defender for Resource Manager helps organizations to:
Enhance security: Detect malicious or unauthorized activities in resource deployment and management.
Strengthen governance: Monitor all changes to Azure resources and identify suspicious activity or misconfigurations.
Ensure compliance: Maintain adherence to security standards and best practices by securing all resource management operations.
Proactively prevent attacks: Identify misconfigured permissions, insecure deployments, or unauthorized attempts to manage resources.
Impact:
Setting Microsoft Defender for Resource Manager to ‘On’ will:
Increase security: Continuous monitoring of management-plane activities reduces the risk of unauthorized access or malicious changes.
Generate alerts: Administrators receive real-time notifications to detect and respond to security issues promptly.
Support compliance: Ensures all ARM operations are monitored in line with regulatory and organizational standards.
Default Value:
By default, Microsoft Defender for Resource Manager is disabled (OFF). It must be manually enabled per subscription.
Pre-requisites:
Azure subscription with Microsoft Defender for Cloud enabled.
Global Administrator or Security Administrator permissions to enable and configure Microsoft Defender forzure Resources.
Test Plan:
Sign in to the Azure Portal.
Search for Microsoft Defender for Cloud.
Under the management section, select the Environment settings, then choose the subscription where your Resource Group is located.
Under the settings, click Defender Plan
Under Cloud Workload Protection (CWPP), locate the Resource Group and check if it is ON or OFF.
If it is OFF, follow the Implementation Plan
Implementation Plan:
Sign in to the Azure Portal.
Search for Microsoft Defender for Cloud.
Under the management section, select the Environment settings, then choose the subscription where your Resource Group is located.
Under the settings, click Defender Plan
Under Cloud Workload Protection (CWPP), locate the Resource Group and Turn ON Microsoft Defender for Cloud for the Resource Group.
Save it.
Backout Plan:
Sign in to the Azure Portal.
Search for Microsoft Defender for Cloud.
Under the management section, select the Environment settings, then choose the subscription where your Resource Group is located.
Under the settings, click Defender Plan
Under Cloud Workload Protection (CWPP), locate the Resource Group and Turn OFF Microsoft Defender for Cloud for the Resource Group.
Reference: