Governance Policies Azure Security Defender

Defender

Governance policies for Defender

Domain: azure-security

Patterns

Name	Description
Defender for Cloud with full coverage	Enable Defender Standard tier on all resource types with auto-provisioning and alert routing

Anti-Patterns

Description	Instead
Do not use Free tier Defender in production	Enable Standard tier on all resource types used in the deployment
Do not skip security contact configuration	Configure security contact email with alert notifications enabled

References

• Microsoft Defender for Cloud documentation
• Defender for Cloud pricing tiers

---

Checks (4)

Check	Severity	Description
AZ-DEF-001	Required	Enable Microsoft Defender for Cloud on all resource types used in the deployment
AZ-DEF-002	Required	Enable auto-provisioning of security agents and vulnerability assessment
AZ-DEF-003	Required	Configure security contact for alert notifications
AZ-DEF-004	Recommended	Enable continuous export of Defender alerts to Log Analytics

---

AZ-DEF-001

Enable Microsoft Defender for Cloud on all resource types used in the deployment

Severity: Required
Rationale: Defender provides continuous threat detection, vulnerability assessment, and security recommendations
Agents: terraform-agent, bicep-agent, cloud-architect, security-reviewer

Targets

• Microsoft.Security/pricings

---

AZ-DEF-002

Enable auto-provisioning of security agents and vulnerability assessment

Severity: Required
Rationale: Auto-provisioning ensures all new resources are automatically protected
Agents: terraform-agent, bicep-agent, cloud-architect, security-reviewer

Targets

• Microsoft.Security/autoProvisioningSettings

---

AZ-DEF-003

Configure security contact for alert notifications

Severity: Required
Rationale: Security alerts must reach the operations team promptly for incident response
Agents: terraform-agent, bicep-agent, cloud-architect, security-reviewer

Targets

• Microsoft.Security/securityContacts

---

AZ-DEF-004

Enable continuous export of Defender alerts to Log Analytics

Severity: Recommended
Rationale: Continuous export enables SIEM integration, custom alerting, and long-term retention beyond Defender
Agents: terraform-agent, bicep-agent, cloud-architect, security-reviewer, monitoring-agent

Targets

• Microsoft.Security/pricings

---