Azure Kubernetes Service clusters should have Defender profile enabled

What does the recommendation "Azure Kubernetes Service clusters should have Defender profile enabled" check?

Flags any AKS cluster where the Defender security profile is off, meaning 'securityProfile.defender.securityMonitoring.enabled' is not set to true. With the profile enabled, the Defender sensor runs as a DaemonSet on every node and streams runtime security events, such as suspicious process execution, container drift and known attack patterns, to Microsoft Defender for Containers. The check only confirms the sensor is deployed on the cluster. It does not verify that the Defender for Containers plan is enabled on the subscription, that a Log Analytics workspace is wired up, or that agentless discovery, registry scanning or admission control are configured. Each of those is a separate recommendation, so a cluster can pass this control yet still have no plan paying for the alerts it generates.

Why does "Azure Kubernetes Service clusters should have Defender profile enabled" matter?

Without the Defender profile, a cluster has no runtime threat detection: a compromised container can spawn a crypto miner, run reconnaissance against the Kubernetes API or move laterally, and none of it surfaces as an alert. AKS is a high-value target because a single foothold often reaches secrets, service-account tokens and the wider VNet. The profile is the only component that sees inside running pods at the kernel level, so leaving it off means your first signal of a breach is likely to be a cloud bill spike or a third party, not Defender. Enabling it turns silent runtime activity into actionable alerts your SOC can triage, with the context Defender needs to tie a pod-level event back to the node, image and namespace it came from. For regulated workloads, the gap also shows up as an audit finding, since most container security baselines expect runtime monitoring on production Kubernetes.

How do I fix "Azure Kubernetes Service clusters should have Defender profile enabled"?

1. Confirm the Defender for Containers plan is on for the subscription, then enable the profile on the cluster with az aks update --resource-group <rg> --name <cluster> --enable-defender, which sets securityProfile.defender.securityMonitoring.enabled to true and rolls out the sensor DaemonSet.
2. In Bicep or Terraform, set the same property on the managed cluster resource (securityProfile.defender.securityMonitoring.enabled = true, pointing at your Log Analytics workspace) so the sensor is baked into the cluster definition rather than bolted on afterwards.
3. Enforce it at scale by looking up the built-in audit policy and assigning it: pid=$(az policy definition list --query "[?displayName=='Azure Kubernetes Service clusters should have Defender profile enabled'].name" -o tsv); az policy assignment create --name aks-defender-profile --policy "$pid" --scope /subscriptions/<sub-id>.

# Enable the three high-value Defender plans on the current subscription.
# Servers on Plan 2 (adds JIT access, FIM and vulnerability scanning).
az security pricing create --name VirtualMachines \
  --tier Standard --subplan P2

# Storage on the current per-account plan.
az security pricing create --name StorageAccounts --tier Standard

# Azure SQL Database servers (VA + Advanced Threat Protection).
az security pricing create --name SqlServers --tier Standard

# Verify what is now active on this subscription.
az security pricing list \
  --query "value[?pricingTier=='Standard'].name" -o tsv

# Ratchet it shut for the estate: assign the built-in DeployIfNotExists
# policies that turn each plan on for any subscription where it is missing.
# Servers (built-in 'Configure Azure Defender for servers to be enabled').
az policy assignment create \
  --name enable-defender-servers \
  --policy 8e86a5b6-b9bd-49d1-8e21-4bb8a0862222 \
  --scope "/providers/Microsoft.Management/managementGroups/contoso-root"

# Look up the matching Storage and SQL policies by display name rather than
# hard-coding a GUID, then assign each the same way at the same scope.
az policy definition list \
  --query "[?contains(displayName, 'Configure Microsoft Defender for Storage') || contains(displayName, 'Configure Azure Defender to be enabled on SQL servers')].{name:name, displayName:displayName}" \
  -o table