Microsoft Defender for APIs should be enabled

What does the recommendation "Microsoft Defender for APIs should be enabled" check?

Flags any subscription where the Microsoft Defender for APIs plan is not turned on. The check looks only at the plan toggle on the subscription, set through 'az security pricing' for the resource named 'Api', so a healthy result means the plan is active rather than that any given API is actually protected. Defender for APIs covers REST APIs published in Azure API Management. It does not inspect function apps, App Service web APIs, container-hosted APIs or any traffic that does not pass through API Management, and turning the plan on does nothing for an API until that API is separately onboarded.

Why does "Microsoft Defender for APIs should be enabled" matter?

API Management instances usually front the highest-value traffic an organisation has: payment flows, partner integrations, mobile back ends and internal data services. Without Defender for APIs there is no runtime detection for the attacks that actually target these endpoints, such as enumeration of object identifiers, anomalous data exfiltration through a single token, suspected credential abuse and exploitation of unauthenticated or shadow APIs. The first signal you get is often the breach itself, surfacing in a customer complaint or a regulator's letter rather than an alert you could have acted on. Enabling the plan gives security operations the inventory, posture findings and real-time threat alerts needed to prioritise and contain API attacks before they become a reportable data loss.

How do I fix "Microsoft Defender for APIs should be enabled"?

1. Enable the plan on the subscription: run 'az security pricing create -n Api --tier Standard --subplan P1', choosing the subplan whose monthly API-call entitlement matches your measured API Management traffic so you do not incur overages.
2. Onboard the APIs you want protected: in Defender for Cloud open Recommendations, find 'Azure API Management APIs should be onboarded to Defender for APIs', select the unhealthy API Management resources and choose Fix. The plan toggle alone protects nothing until this onboarding step completes, after which insights appear under Workload protections, API security.
3. Make the plan the default for every subscription through policy. Look the audit policy up by name rather than pasting a GUID: pid=$(az policy definition list --query "[?displayName=='Microsoft Defender for APIs should be enabled'].name" -o tsv); az policy assignment create --name defender-apis-on --policy "$pid" --scope /subscriptions/<id>. Avoid the older 'Configure Microsoft Defender for APIs should be enabled' deploy policy, which Microsoft has deprecated because it does not complete the onboarding step.

# Enable the three high-value Defender plans on the current subscription.
# Servers on Plan 2 (adds JIT access, FIM and vulnerability scanning).
az security pricing create --name VirtualMachines \
  --tier Standard --subplan P2

# Storage on the current per-account plan.
az security pricing create --name StorageAccounts --tier Standard

# Azure SQL Database servers (VA + Advanced Threat Protection).
az security pricing create --name SqlServers --tier Standard

# Verify what is now active on this subscription.
az security pricing list \
  --query "value[?pricingTier=='Standard'].name" -o tsv

# Ratchet it shut for the estate: assign the built-in DeployIfNotExists
# policies that turn each plan on for any subscription where it is missing.
# Servers (built-in 'Configure Azure Defender for servers to be enabled').
az policy assignment create \
  --name enable-defender-servers \
  --policy 8e86a5b6-b9bd-49d1-8e21-4bb8a0862222 \
  --scope "/providers/Microsoft.Management/managementGroups/contoso-root"

# Look up the matching Storage and SQL policies by display name rather than
# hard-coding a GUID, then assign each the same way at the same scope.
az policy definition list \
  --query "[?contains(displayName, 'Configure Microsoft Defender for Storage') || contains(displayName, 'Configure Azure Defender to be enabled on SQL servers')].{name:name, displayName:displayName}" \
  -o table