> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Enable Microsoft Defender for Cloud for Virtual Machines

### More Info:

Enable Microsoft Defender for Cloud for Virtual Machines

### Risk Level

High

### Address

Operational Maturity, Security

### Compliance Standards

* CIS AZURE
* Cloudanix Best Practice
* HITRUST CSF

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To remediate the misconfiguration "Enable Microsoft Defender for Cloud for Virtual Machines" for Azure using Azure console, follow the below steps:

        1. Login to the Azure portal ([https://portal.azure.com/](https://portal.azure.com/))
        2. Select the Virtual Machine on which you want to enable Microsoft Defender for Cloud
        3. Under the "Settings" section, select "Security + Compliance"
        4. Click on "Security Center" to open the Security Center blade
        5. On the Security Center blade, click on "Recommendations"
        6. Look for the recommendation "Enable Microsoft Defender for Cloud for Virtual Machines" and click on it
        7. Click on the "Remediate" button to enable Microsoft Defender for Cloud for the selected Virtual Machine
        8. Once the remediation is complete, verify that Microsoft Defender for Cloud is enabled for the Virtual Machine by going to the "Security + Compliance" section and checking the status of the Microsoft Defender for Cloud.

        Note: It is recommended to enable Microsoft Defender for Cloud for all Virtual Machines in the Azure environment to ensure comprehensive security coverage.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To enable Microsoft Defender for Cloud for Virtual Machines in Azure, follow the below steps using Azure CLI:

        1. Open the Azure CLI and login to your Azure account using the command:

           ```
           az login
           ```

        2. Once you are logged in, set the subscription to the one you want to work with using the command:

           ```
           az account set --subscription <subscription_id>
           ```

        3. Next, enable the Microsoft Defender for Cloud for Virtual Machines using the command:

           ```
           az security vm enable-defense --name <virtual_machine_name> --resource-group <resource_group_name>
           ```

           Replace `<virtual_machine_name>` with the name of the virtual machine you want to enable Microsoft Defender for Cloud and `<resource_group_name>` with the name of the resource group where the virtual machine is located.

        4. Wait for a few minutes for the changes to take effect. Once the changes are applied, you can verify the status of Microsoft Defender for Cloud for Virtual Machines using the command:

           ```
           az security vm show --name <virtual_machine_name> --resource-group <resource_group_name> --query 'defenderStatus.status'
           ```

           This command will return the status of Microsoft Defender for Cloud for Virtual Machines for the specified virtual machine.

        That's it! You have successfully enabled Microsoft Defender for Cloud for Virtual Machines in Azure using Azure CLI.
      </Accordion>

      <Accordion title="Using Python">
        To enable Microsoft Defender for Cloud for Virtual Machines in Azure using Python, follow these steps:

        1. Install the Azure SDK for Python using the following command:

        ```
        pip install azure-mgmt-compute
        ```

        2. Authenticate with Azure using the Azure CLI or by providing your credentials directly in the code.

        3. Use the following Python code to enable Microsoft Defender for Cloud for Virtual Machines:

        ```
        from azure.mgmt.compute import ComputeManagementClient
        from azure.mgmt.compute.models import VirtualMachineExtension

        # Replace the values in the following variables with your own values
        subscription_id = '<your-subscription-id>'
        resource_group_name = '<your-resource-group-name>'
        vm_name = '<your-vm-name>'
        location = '<your-vm-location>'
        workspace_id = '<your-workspace-id>'
        workspace_key = '<your-workspace-key>'

        # Create a ComputeManagementClient object
        compute_client = ComputeManagementClient(credentials, subscription_id)

        # Create a VirtualMachineExtension object
        extension = VirtualMachineExtension(
            location=location,
            publisher='Microsoft.Azure.Security',
            virtual_machine_extension_type='IaaSAntimalware',
            type_handler_version='1.15',
            auto_upgrade_minor_version=True,
            settings={
                "AntimalwareEnabled": True,
                "RealtimeProtectionEnabled": True,
                "ScheduledScanSettings": {
                    "isEnabled": True,
                    "day": "1",
                    "time": "120",
                    "scanType": "Quick"
                },
                "Exclusions": {
                    "Extensions": ".log;.bak",
                    "Paths": "/var/log;/var/lib/docker"
                },
                "AdvancedThreatProtection": {
                    "isEnabled": True
                }
            },
            protected_settings={
                "storageAccountName": "<your-storage-account-name>",
                "storageAccountKey": "<your-storage-account-key>",
                "workspaceConfig": {
                    "workspaceId": workspace_id,
                    "workspaceKey": workspace_key
                }
            }
        )

        # Create the extension on the virtual machine
        compute_client.virtual_machine_extensions.create_or_update(
            resource_group_name,
            vm_name,
            'IaaSAntimalware',
            extension
        )
        ```

        4. Replace the values in the variables with your own values.

        5. Run the Python code to enable Microsoft Defender for Cloud for Virtual Machines in Azure. This will create an extension on the virtual machine that enables Microsoft Defender for Cloud and configures it with the specified settings.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        resource "azurerm_security_center_subscription_pricing" "defender_for_vms" {
          # Enable Microsoft Defender for Cloud for Virtual Machines on this subscription
          resource_type = "VirtualMachines"
          tier          = "Standard" # "Standard" enables Defender; "Free" would disable it

          # Optional: link to a specific subscription if you manage multiple; otherwise
          # this defaults to the provider's current subscription.
          subscription_id = "SUBSCRIPTION_ID" # replace with the Azure Subscription ID
        }
        ```

        Changing `tier` between `Free` and `Standard` is an in‑place update and does not force resource replacement.

        For verification, `terraform plan` should show creation of `azurerm_security_center_subscription_pricing.defender_for_vms` (if new) or an in‑place update with `tier` changing to `"Standard"`.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>