| name | cis-azure-foundations-8.1.1.1 |
| description | Ensure Microsoft Defender CSPM is set to 'On' |
| category | cis-azure-foundations |
| version | 5.0.0 |
| author | cyberstrike-official |
| tags | ["cis","azure","security","defender","cspm"] |
| cis_id | 8.1.1.1 |
| cis_benchmark | CIS Microsoft Azure Foundations Benchmark v5.0.0 |
| tech_stack | ["azure"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
8.1.1.1 Ensure Microsoft Defender CSPM is set to 'On' (Automated)
Description
Enable Microsoft Defender CSPM to continuously assess cloud resources for security misconfigurations, compliance risks, and exposure to threats.
Rationale
Microsoft Defender CSPM provides detailed visibility into the security state of assets and workloads and offers hardening guidance to help improve security posture.
Impact
Enabling Microsoft Defender CSPM incurs hourly charges for each billable compute, database, and storage resource. This can lead to significant costs in larger environments. Careful planning and cost analysis are recommended before enabling the service.
Audit Procedure
From Azure Portal:
- Go to
Microsoft Defender for Cloud.
- Under
Management, click Environment settings.
- Click the name of a subscription.
- Select the
Defender plans blade.
- Under
Cloud Security Posture Management (CSPM), in the row for Defender CSPM, ensure Status is set to On.
From Azure CLI:
az security pricing show --name CloudPosture --query pricingTier
Ensure "Standard" is returned.
From PowerShell:
Get-AzSecurityPricing -Name CloudPosture | Select-Object PricingTier
Ensure Standard is returned.
From Azure Policy:
- Policy ID:
1f90fc71-a595-4066-8974-d4d0802e8ef0 - Name: 'Microsoft Defender CSPM should be enabled'
Expected Result
The pricing tier for CloudPosture should be Standard.
Remediation
From Azure Portal:
- Go to
Microsoft Defender for Cloud.
- Under
Management, click Environment settings.
- Click the name of a subscription.
- Select the
Defender plans blade.
- Under
Cloud Security Posture Management (CSPM), in the row for Defender CSPM, set the toggle switch for Status to On.