1. Log in to the Azure portal and navigate to the Security Center.
2. Click on the “Security policy” tab on the left-hand side menu.
3. Scroll down to the “Endpoint protection” section and click on the “Edit” button.
4. Under the “Antivirus protection” section, ensure that the “Monitor endpoint protection” setting is enabled.
5. If the setting is not enabled, click on the toggle switch to turn it on.
6. Click “Save” to apply the changes.
7. Wait for the changes to propagate, which may take a few minutes.
8. Verify that the “Monitor endpoint protection” setting is now enabled by checking the “Endpoint protection” section in the Security policy tab.

​

1. Open the Azure CLI and log in to your Azure account.
2. Run the following command to enable the endpoint protection setting for your Azure virtual machines:
   az vm update --name <vm-name> --resource-group <resource-group-name> --set diagnosticsProfile.bootDiagnostics.enabled=true
   
   Replace <vm-name> with the name of your virtual machine and <resource-group-name> with the name of the resource group where the virtual machine is located.
3. Once the command is executed successfully, the endpoint protection setting will be enabled for your Azure virtual machine.
4. To verify the configuration, run the following command:
   az vm show --name <vm-name> --resource-group <resource-group-name> --query 'diagnosticsProfile.bootDiagnostics.enabled'
   
   This command will return the value “true” if the endpoint protection setting is enabled for your virtual machine.

1. Import the necessary modules:

from azure.identity import DefaultAzureCredential
from azure.mgmt.security import SecurityCenter

2. Authenticate with Azure using the DefaultAzureCredential class:

credential = DefaultAzureCredential()

3. Instantiate a SecurityCenter client object:

security_center_client = SecurityCenter(security_center_subscription_id, credential)

4. Get the subscription ID for the target subscription:

subscription_id = security_center_client.subscriptions.get().id

5. Get the security policy for the subscription:

policy = security_center_client.policies.get(subscription_id, 'default')

6. Check if the “Monitor Endpoint Protection” setting is enabled:

setting = next((s for s in policy.settings if s.name == 'MonitorEndpointProtection'), None)
if setting.value == 'Off':
    setting.value = 'On'

7. Update the security policy with the new setting:

security_center_client.policies.create_or_update(subscription_id, 'default', policy)

resource "azurerm_policy_assignment" "monitor_endpoint_protection" {
  name                 = "monitor-endpoint-protection"
  display_name         = "Monitor Endpoint Protection on Virtual Machines"
  description          = "Enable Endpoint Protection recommendations for virtual machines in Defender for Cloud."
  scope                = "/subscriptions/${data.azurerm_client_config.current.subscription_id}" # or a specific resource group/management group scope
  policy_definition_id = "POLICY_DEFINITION_ID_FOR_MONITOR_ENDPOINT_PROTECTION"               # replace with the built‑in policy/initiative ID from the portal

  # Parameters depend on the specific built-in policy/initiative you use.
  # Use the exact parameter names and allowed values from that definition.
  parameters = jsonencode({
    # Example – adjust to match the chosen policy/initiative:
    "effect" = {
      "value" = "AuditIfNotExists" # or "DeployIfNotExists" if required by your standard
    }
    # Add any other required parameters here, for example:
    # "listOfLocations" = { "value" = ["westeurope", "eastus"] }
  })

  # Optional: ensure policy enforcement is on
  enforce = true
}

data "azurerm_client_config" "current" {}

• + creation of azurerm_policy_assignment.monitor_endpoint_protection, or
• ~ an update to the existing policy assignment, changing policy_definition_id, parameters, and/or enforce to the desired values.