Control: 8.1.1.1 Ensure Microsoft Defender CSPM is set to 'On'

Description

Enable Microsoft Defender CSPM to continuously assess cloud resources for security misconfigurations, compliance risks, and exposure to threats.

Microsoft Defender CSPM provides detailed visibility into the security state of assets and workloads and offers hardening guidance to help improve security posture.

Remediation

Remediate from Azure Portal

Go to Microsoft Defender for Cloud.
Under Management, click Environment settings.
Click the name of a subscription.
Select the Defender plans blade.
Under Cloud Security Posture Management (CSPM), in the row for Defender CSPM, set the toggle switch for Status to On.
Click Save.

Remediate from Azure CLI

Run the following command to enable Defender CSPM:

az security pricing create --name CloudPosture --tier Standard --extensions name=ApiPosture isEnabled=true

Remediate from PowerShell

Run the following command to enable Defender CSPM:

Set-AzSecurityPricing -Name CloudPosture -PricingTier Standard -Extension '[{"name":"ApiPosture","isEnabled":"True"}]'

Default Value

Defender CSPM is disabled by default.

Usage

Run the control in your terminal:

powerpipe control run azure_compliance.control.cis_v500_8_1_1_1

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run azure_compliance.control.cis_v500_8_1_1_1 --share

SQL

This control uses a named query:

select
  p.id as resource,
  case
    when p.pricing_tier = 'Standard' then 'ok'
    else 'alarm'
  end as status,
  case
    when p.pricing_tier = 'Standard' then 'Microsoft Defender for CloudPosture is enabled with ' || p.pricing_tier || ' tier.'
    when p.name = 'CloudPosture' then 'Microsoft Defender for CloudPosture is disabled, current tier: ' || p.pricing_tier || '.'
    else 'Microsoft Defender for CloudPosture pricing not found.'
  end as reason
  
  , sub.display_name as subscription
from
  azure_security_center_subscription_pricing p
  right join azure_subscription sub on p.subscription_id = sub.subscription_id
where
  p.name = 'CloudPosture';