Microsoft Defender for App Service should be enabled

What does the recommendation "Microsoft Defender for App Service should be enabled" check?

Flags any subscription where the Microsoft Defender for App Service plan is left on the free tier rather than set to Standard. When enabled, Defender inspects the request telemetry that already passes through the App Service infrastructure and raises alerts for web shells, reconnaissance, suspicious outbound traffic and dangling DNS entries left behind when a site is decommissioned. Detection works on both Windows and Linux App Service and on the dedicated plan tiers, Standard, Premium and App Service Environment, that the protection supports. Importantly, it is a subscription-level pricing toggle, not a per-app switch: it does not scan your application code for vulnerabilities, it does not patch the runtime, and its dangling DNS detection only covers App Service custom domains, not Traffic Manager, AKS or bare public IPs, and only once Defender has seen traffic to the site.

Why does "Microsoft Defender for App Service should be enabled" matter?

App Service hosts internet-facing web apps and APIs, the part of your estate attackers reach first and probe constantly. Without the plan enabled you have no managed runtime threat detection on that tier: a planted web shell or an exploited injection flaw can run for weeks before anyone notices, and a custom domain orphaned after a site is torn down can be silently taken over to serve phishing or malware under your own brand and certificates. Because Defender reads the gateway logs the platform already produces, the cost of switching it on is a per-app-service-plan fee rather than engineering effort. Turning the plan on gives security operations actionable, prioritised alerts with no agent to install and no code change, so an active compromise surfaces in hours instead of being found during incident clean-up, when the data is already gone and the regulatory clock is running.

How do I fix "Microsoft Defender for App Service should be enabled"?

1. Enable the plan on the subscription with 'az security pricing create --name AppServices --tier Standard', then confirm it with 'az security pricing show --name AppServices'.
2. Roll the same setting out across every subscription with the built-in policy 'Azure Defender for App Service should be enabled': look up its id by display name and assign it, for example pid=$(az policy definition list --query "[?displayName=='Azure Defender for App Service should be enabled'].name" -o tsv); az policy assignment create --name defender-appservice --policy "$pid" --scope /subscriptions/<sub-id>.
3. Wire the resulting alerts into your workflow by exporting Defender for Cloud to your SIEM or setting an email notification rule so App Service detections reach the on-call team, not just the portal.

# Enable the three high-value Defender plans on the current subscription.
# Servers on Plan 2 (adds JIT access, FIM and vulnerability scanning).
az security pricing create --name VirtualMachines \
  --tier Standard --subplan P2

# Storage on the current per-account plan.
az security pricing create --name StorageAccounts --tier Standard

# Azure SQL Database servers (VA + Advanced Threat Protection).
az security pricing create --name SqlServers --tier Standard

# Verify what is now active on this subscription.
az security pricing list \
  --query "value[?pricingTier=='Standard'].name" -o tsv

# Ratchet it shut for the estate: assign the built-in DeployIfNotExists
# policies that turn each plan on for any subscription where it is missing.
# Servers (built-in 'Configure Azure Defender for servers to be enabled').
az policy assignment create \
  --name enable-defender-servers \
  --policy 8e86a5b6-b9bd-49d1-8e21-4bb8a0862222 \
  --scope "/providers/Microsoft.Management/managementGroups/contoso-root"

# Look up the matching Storage and SQL policies by display name rather than
# hard-coding a GUID, then assign each the same way at the same scope.
az policy definition list \
  --query "[?contains(displayName, 'Configure Microsoft Defender for Storage') || contains(displayName, 'Configure Azure Defender to be enabled on SQL servers')].{name:name, displayName:displayName}" \
  -o table