Microsoft Defender for Key Vault should be enabled

What does the recommendation "Microsoft Defender for Key Vault should be enabled" check?

Flags any subscription where the Microsoft Defender for Key Vault plan is not set to the Standard tier in Defender for Cloud. When the plan is on, Defender analyses the control-plane and data-plane telemetry from every vault in the subscription and raises alerts on anomalous access, for example access from a suspicious IP, an unusual application or user reading secrets, or an abnormal volume of operations, judged against a learned baseline of normal access. The check is purely about whether this detection plan is enabled at the subscription level. It does not verify a vault's RBAC or access policies, its firewall and private-endpoint configuration, or whether soft-delete and purge protection are on, and Defender itself detects and alerts rather than blocking the access, so it complements those controls instead of replacing them.

Why does "Microsoft Defender for Key Vault should be enabled" matter?

A key vault concentrates the secrets, certificates and keys that unlock the rest of your estate: database connection strings, signing keys, TLS certificates. If a credential is phished or an over-permissioned service principal is abused, an attacker can quietly enumerate and exfiltrate every secret, and without threat detection the first sign is often the downstream breach the stolen secret enabled. With the Defender plan off you have no behavioural alerting on that access at all, so suspicious reads blend into normal traffic. Enabling it surfaces an unusual identity or IP touching the vault within minutes, which is frequently the only early warning before a credential is reused at scale. The business consequence of missing it is a full secret-store compromise that cascades into connected databases and applications.

How do I fix "Microsoft Defender for Key Vault should be enabled"?

1. Enable the plan for the whole subscription: az security pricing create -n KeyVaults --tier standard, then confirm with az security pricing show -n KeyVaults --query pricingTier. Repeat per subscription, since the plan is scoped to a subscription, not a management group.
2. Route the alerts to a human: in Defender for Cloud under Environment settings, Email notifications, set notifications to On for high-severity alerts so a suspicious-access alert reaches the security team rather than sitting in the portal.
3. Make it the default across subscriptions by assigning the built-in policy 'Azure Defender for Key Vault should be enabled' (looked up by display name rather than a hardcoded id): pid=$(az policy definition list --query "[?displayName=='Azure Defender for Key Vault should be enabled'].name" -o tsv); az policy assignment create --name defender-keyvault --policy "$pid" --scope /subscriptions/<sub-id>.

# Enable the three high-value Defender plans on the current subscription.
# Servers on Plan 2 (adds JIT access, FIM and vulnerability scanning).
az security pricing create --name VirtualMachines \
  --tier Standard --subplan P2

# Storage on the current per-account plan.
az security pricing create --name StorageAccounts --tier Standard

# Azure SQL Database servers (VA + Advanced Threat Protection).
az security pricing create --name SqlServers --tier Standard

# Verify what is now active on this subscription.
az security pricing list \
  --query "value[?pricingTier=='Standard'].name" -o tsv

# Ratchet it shut for the estate: assign the built-in DeployIfNotExists
# policies that turn each plan on for any subscription where it is missing.
# Servers (built-in 'Configure Azure Defender for servers to be enabled').
az policy assignment create \
  --name enable-defender-servers \
  --policy 8e86a5b6-b9bd-49d1-8e21-4bb8a0862222 \
  --scope "/providers/Microsoft.Management/managementGroups/contoso-root"

# Look up the matching Storage and SQL policies by display name rather than
# hard-coding a GUID, then assign each the same way at the same scope.
az policy definition list \
  --query "[?contains(displayName, 'Configure Microsoft Defender for Storage') || contains(displayName, 'Configure Azure Defender to be enabled on SQL servers')].{name:name, displayName:displayName}" \
  -o table