Control: Ensure Microsoft Defender CSPM is set to 'On'

powerpipe control run azure_compliance.control.security_center_defender_for_cloudposture_enabled

powerpipe login
powerpipe control run azure_compliance.control.security_center_defender_for_cloudposture_enabled --share

select
  p.id as resource,
  case
    when p.pricing_tier = 'Standard' then 'ok'
    else 'alarm'
  end as status,
  case
    when p.pricing_tier = 'Standard' then 'Microsoft Defender for CloudPosture is enabled with ' || p.pricing_tier || ' tier.'
    when p.name = 'CloudPosture' then 'Microsoft Defender for CloudPosture is disabled, current tier: ' || p.pricing_tier || '.'
    else 'Microsoft Defender for CloudPosture pricing not found.'
  end as reason
  
  , sub.display_name as subscription
from
  azure_security_center_subscription_pricing p
  right join azure_subscription sub on p.subscription_id = sub.subscription_id
where
  p.name = 'CloudPosture';