Description:
Microsoft Defender for Resource Manager is part of Microsoft Defender for Cloud and provides enhanced security monitoring and threat protection for Azure Resource Manager (ARM). ARM is the deployment and management service for Azure resources, and enabling Microsoft Defender for Resource Manager ensures that security threats related to resource management activities, such as deployments and access control, are detected and mitigated.
By setting Microsoft Defender for Resource Manager to 'On', you enable monitoring for potential misconfigurations, access control violations, and other security threats related to the deployment and management of Azure resources via Resource Manager.
Rationale:
Enabling Microsoft Defender for Resource Manager helps:
Improve security by detecting malicious or unauthorized activities during resource deployment or management.
Ensure better governance by monitoring changes to Azure resources and identifying any suspicious activity or misconfigurations.
Enhance compliance with security standards and best practices by ensuring that all resource management activities are secure and monitored.
Proactively prevent attacks by detecting issues such as misconfigured access permissions, insecure deployments, or unauthorized attempts to manage resources.
Impact:
Setting Microsoft Defender for Resource Manager to 'On' will:
Increase security by enabling continuous monitoring of resource management activities for potential vulnerabilities and unauthorized access.
Generate security alerts that help administrators quickly detect and respond to issues related to resource management and deployment activities.
Improve compliance by ensuring all resource management activities are subject to security monitoring, in line with regulatory requirements.
Provide actionable security insights through real-time alerts and recommendations.
Default Value:
By default, Microsoft Defender for Resource Manager is not enabled. You must manually configure it to 'On' to start monitoring and protecting your Azure resources through Resource Manager.
Pre-requisites:
Azure subscription with Microsoft Defender for Cloud enabled.
Global Administrator or Security Administrator permissions to enable Microsoft Defender for Resource Manager.
Audit:
Sign in to Azure portal as a Global Administrator or Security Administrator.
Navigate to Microsoft Defender for Cloud > Environment settings.
Ensure that Microsoft Defender for Resource Manager is set to 'On' for the relevant Azure environment.
Implementation Steps (Automated):
Sign in to Azure portal:
Use an account with Global Administrator or Security Administrator permissions.
Navigate to Microsoft Defender for Cloud:
In the Azure portal, go to Microsoft Defender for Cloud.
Go to Environment Settings:
Under Microsoft Defender for Cloud, select Environment settings.
Enable Microsoft Defender for Resource Manager:
In the Environment settings pane, locate the option for Microsoft Defender for Resource Manager.
Set this option to 'On' to enable monitoring and protection for Resource Manager and the resources managed via it.
Save the Configuration:
After setting Microsoft Defender for Resource Manager to 'On', click Save to apply the changes.Verify the Setting:
After saving, verify that Microsoft Defender for Resource Manager is enabled and actively monitoring activities related to Azure Resource Manager.
Check the Microsoft Defender for Cloud dashboard to ensure that security alerts related to resource management are being generated.
Monitor Alerts and Security Insights:
Start monitoring Defender for Resource Manager for security alerts, vulnerability assessments, and threat detection related to resource management.
Use Azure Monitor or Microsoft Defender for Cloud dashboards to track security insights, misconfigurations, and threats in your Azure resources.
Test the Configuration:
To test, simulate potential threats or misconfigurations during a resource deployment and verify that Microsoft Defender generates relevant alerts and security insights.
Communicate to Relevant Teams:
Notify relevant teams (e.g., DevOps, Security Operations, or Azure Admins) about the new monitoring and alerts provided by Microsoft Defender for Resource Manager.
Backout Plan (Automated):
Sign in to Azure portal:
Use an account with Global Administrator or Security Administrator permissions.
Navigate to Microsoft Defender for Cloud:
Go to Microsoft Defender for Cloud.
Go to Environment Settings:
Under Environment settings, find Microsoft Defender for Resource Manager.
Disable Microsoft Defender for Resource Manager:
Set the option to 'Off' to disable monitoring and protection for Azure Resource Manager.
Save the Configuration:
After disabling the setting, click Save to apply the changes.
Test the Reverted Configuration:
Verify that Microsoft Defender for Resource Manager is no longer monitoring activities related to resource management by checking the absence of security alerts in the Defender for Cloud dashboard.
Monitor the Reversion:
Ensure that the configuration has been successfully reverted by confirming that no further Defender for Resource Manager alerts are triggered.