Governance Policies Azure Security Defender - Azure/az-prototype GitHub Wiki

Defender

Governance policies for Defender

Domain: azure-security

Patterns

Name Description
Defender for Cloud with full coverage Enable Defender Standard tier on all resource types with auto-provisioning and alert routing

Anti-Patterns

Description Instead
Do not use Free tier Defender in production Enable Standard tier on all resource types used in the deployment
Do not skip security contact configuration Configure security contact email with alert notifications enabled

References

Checks (4)

Check Severity Description
AZ-DEF-001 Required Enable Microsoft Defender for Cloud on all resource types used in the deployment
AZ-DEF-002 Required Enable auto-provisioning of security agents and vulnerability assessment
AZ-DEF-003 Required Configure security contact for alert notifications
AZ-DEF-004 Recommended Enable continuous export of Defender alerts to Log Analytics

AZ-DEF-001

Enable Microsoft Defender for Cloud on all resource types used in the deployment

Severity: Required
Rationale: Defender provides continuous threat detection, vulnerability assessment, and security recommendations
Agents: terraform-agent, bicep-agent, cloud-architect, security-reviewer

Targets

  • Microsoft.Security/pricings

AZ-DEF-002

Enable auto-provisioning of security agents and vulnerability assessment

Severity: Required
Rationale: Auto-provisioning ensures all new resources are automatically protected
Agents: terraform-agent, bicep-agent, cloud-architect, security-reviewer

Targets

  • Microsoft.Security/autoProvisioningSettings

AZ-DEF-003

Configure security contact for alert notifications

Severity: Required
Rationale: Security alerts must reach the operations team promptly for incident response
Agents: terraform-agent, bicep-agent, cloud-architect, security-reviewer

Targets

  • Microsoft.Security/securityContacts

AZ-DEF-004

Enable continuous export of Defender alerts to Log Analytics

Severity: Recommended
Rationale: Continuous export enables SIEM integration, custom alerting, and long-term retention beyond Defender
Agents: terraform-agent, bicep-agent, cloud-architect, security-reviewer, monitoring-agent

Targets

  • Microsoft.Security/pricings
⚠️ **GitHub.com Fallback** ⚠️