Description:
Auto provisioning of Microsoft Defender for Containers components ensures that the required security extensions are installed. such as the Azure Policy add-on, Defender agent, and data collection components are automatically installed on supported Kubernetes clusters and container environments. These components enable vulnerability assessment, runtime threat detection, compliance evaluation, agentless scanning, and behavioral analytics. Enabling this setting ensures new container workloads are automatically onboarded into Microsoft Defender for Containers without manual configuration, reducing gaps in container security visibility.
Rationale:
If auto provisioning is disabled, new or existing AKS clusters may not have the Defender for Containers agent or required add-ons installed. This results in missing telemetry, unmonitored container workloads, undetected vulnerabilities, and weakened protection against runtime threats. Enabling auto provisioning ensures uniform security coverage, consistent onboarding, and reliable threat analytics across all containerized environments.
Impact:
Ensures all existing and future Kubernetes clusters have security coverage.
Prevents gaps in workload protection due to manual onboarding errors.
Improves detection for container vulnerabilities, image scanning, and runtime threats.
Strengthens cloud-native security posture.
Default Value:
Auto provisioning for Microsoft Defender for Containers is disabled by default until configured in Microsoft Defender for Cloud.
Pre-Requisites:
Log Analytics workspace configured for Defender data collection
AKS clusters must be connected to Azure Monitor / Azure Policy for add-on deployment
Test Plan:
Sign in to the Azure Portal https://portal.azure.com .
Search for and open Microsoft Defender for Cloud
Under the Management section, select Environment settings
Select the relevant subscription
Under the settings, Open Defender plans
Under the Cloud Workload Protection (CWPP), Locate Microsoft Defender for Containers
Verify Microsoft Defender for Containers is set to On, which enables automatic provisioning of required container security components
If Microsoft Defender for Containers is not set to On, follow the implementation steps
Implementation Steps:
Sign in to the Azure Portal at https://portal.azure.com
Search for and open Microsoft Defender for Cloud
Under the Management section, select Environment settings
Select the relevant subscription
Under Settings, open Defender plans
Locate Microsoft Defender for Containers
Set Microsoft Defender for Containers to On to enable automatic provisioning of container security components
Save the changes
Backout Plan:
Sign in to the Azure Portal https://portal.azure.com.
Search for and open Microsoft Defender for Cloud
Under the Management section, select Environment settings
Select the relevant subscription
Under Settings, open Defender plans
Locate Microsoft Defender for Containers
Set Microsoft Defender for Containers to Off
Save the changes
Reference: