Enable Microsoft Defender for Cloud for Azure Containers

Using Console

To enable Microsoft Defender for Cloud for Azure Containers, please follow the below steps:

Go to the Azure portal and log in with your credentials.
Navigate to the “Security Center” from the left-hand side menu.
Click on “Security Center” and then select “Azure Defender” from the top menu.
Click on “Container Security” and then select “On” to enable Microsoft Defender for Cloud for Azure Containers.
Review the pricing tier options and select the one that suits your requirements.
Click on “Save” to apply the changes.
Once the changes are saved, you will see the status change to “Enabled” under the “Azure Defender” dashboard.

By following these steps, you will have successfully enabled Microsoft Defender for Cloud for Azure Containers.

Using CLI

To enable Microsoft Defender for Cloud for Azure Containers using AZURE CLI, follow these steps:

Open the Azure CLI command prompt and log in to your Azure account.
Run the following command to check if the Azure Defender for Container Registries is enabled:
az security atp storage show --resource-type Microsoft.Containerregistry/registries --ids <registry-id>
Replace <registry-id> with the ID of the registry you want to enable Azure Defender for.
If the Azure Defender for Container Registries is not enabled, run the following command to enable it:
az security atp storage update --resource-type Microsoft.Containerregistry/registries --ids <registry-id> --is-enabled true
Replace <registry-id> with the ID of the registry you want to enable Azure Defender for.
Run the following command to check if the Azure Defender for Container Images is enabled:
az security atp container show --resource-type Microsoft.Containerregistry/registries --ids <registry-id>
Replace <registry-id> with the ID of the registry you want to enable Azure Defender for.
If the Azure Defender for Container Images is not enabled, run the following command to enable it:
az security atp container update --resource-type Microsoft.Containerregistry/registries --ids <registry-id> --is-enabled true
Replace <registry-id> with the ID of the registry you want to enable Azure Defender for.
Finally, run the following command to check the status of the Azure Defender for Container Images:
az security atp container show --resource-type Microsoft.Containerregistry/registries --ids <registry-id>
Replace <registry-id> with the ID of the registry you want to check the status for.

That’s it! You have successfully enabled Microsoft Defender for Cloud for Azure Containers using AZURE CLI.

Using Python

To enable Microsoft Defender for Cloud for Azure Containers using Python, you can follow the below steps:Step 1: Install the Azure SDK for Python using the following command:

pip install azure-mgmt-containerregistry

Step 2: Authenticate with Azure using the following code:

from azure.common.credentials import ServicePrincipalCredentials
from azure.mgmt.containerregistry import ContainerRegistryManagementClient

tenant_id = 'TENANT_ID'
client_id = 'CLIENT_ID'
client_secret = 'CLIENT_SECRET'
subscription_id = 'SUBSCRIPTION_ID'

credentials = ServicePrincipalCredentials(
    client_id=client_id,
    secret=client_secret,
    tenant=tenant_id
)

client = ContainerRegistryManagementClient(credentials, subscription_id)

Step 3: Get the resource group and container registry where you want to enable Microsoft Defender for Cloud. You can use the following code to get the resource group and container registry:

resource_group_name = 'RESOURCE_GROUP_NAME'
registry_name = 'CONTAINER_REGISTRY_NAME'

registry = client.registries.get(resource_group_name, registry_name)

Step 4: Enable Microsoft Defender for Cloud for Azure Containers using the following code:

from azure.mgmt.containerregistry.models import RegistryUpdateParameters

registry_update_params = RegistryUpdateParameters(
    policies=registry.policies,
    storage_account=registry.storage_account,
    identity=registry.identity,
    admin_user_enabled=registry.admin_user_enabled,
    public_network_access_enabled=registry.public_network_access_enabled,
    network_rule_set=registry.network_rule_set,
    encryption=registry.encryption,
    retention_policy=registry.retention_policy,
    trust_policy=registry.trust_policy,
    data_endpoint_enabled=True,
    data_endpoint_dns_name=None
)

client.registries.update(resource_group_name, registry_name, registry_update_params)

After running the above code, Microsoft Defender for Cloud for Azure Containers will be enabled for the specified container registry.

Using Terraform

# Enable Microsoft Defender for Cloud (Standard tier) for AKS
resource "azurerm_security_center_subscription_pricing" "kubernetes_service_defender" {
  resource_type = "KubernetesService"
  tier          = "Standard"
}

# Enable Microsoft Defender for Cloud (Standard tier) for Container Registries
resource "azurerm_security_center_subscription_pricing" "container_registry_defender" {
  resource_type = "ContainerRegistry"
  tier          = "Standard"
}

These changes do not force resource replacement; they update the Defender pricing plan on the subscription.Verification: terraform plan should show azurerm_security_center_subscription_pricing.kubernetes_service_defender and .container_registry_defender being created or updated with tier = "Standard" and the corresponding resource_type values.

Azure Introduction

Azure Pricing

Azure Threats

Azure Misconfigurations

Enable Microsoft Defender for Cloud for Azure Containers

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​