Azure Compliance ControlsAzure Policy
Microsoft Defender for Cloud policy assignments should have enforcement mode set to Default
Defender for Cloud default policy assignment (`SecurityCenterBuiltIn`) uses enforcement mode `Default` rather than `DoNotEnforce`. With `DoNotEnforce`, policy effects like `deny` and `deployIfNotExists` aren't applied.
What this control checks
SecurityCenterBuiltIn uses enforcement mode Default rather than DoNotEnforce
Framework mappings
The clauses this control is mapped to in each framework.
- 10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- 10.4.1: Audit logs are reviewed to identify anomalies or suspicious activity.
- 10.4.1.1: Audit logs are reviewed to identify anomalies or suspicious activity.
- 10.4.2: Audit logs are reviewed to identify anomalies or suspicious activity.
- 10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
4 more clauses
- 10.7.1: Failures of critical security control systems are detected, reported, and responded to promptly.
- 10.7.2: Failures of critical security control systems are detected, reported, and responded to promptly.
- A3.3.1: PCI DSS is incorporated into business-as-usual (BAU) activities.
- A3.5.1: Suspicious events are identified and responded to.
- 9.1.11 Ensure that Microsoft Cloud Security Benchmark policies are not set to 'Disabled'
- 8.1.11 Ensure that Microsoft Cloud Security Benchmark policies are not set to 'Disabled'
- 2.1.14 Ensure Any of the ASC Default Policy Settings are Not Set to 'Disabled'
- 2.1.13 Ensure that Microsoft Cloud Security Benchmark policies are not set to 'Disabled'
- 3.1.11 Ensure that Microsoft Cloud Security Benchmark policies are not set to 'Disabled'
- 164.308(a)(1)(ii)(A) Risk analysis
- 164.308(a)(8) Evaluation
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
azure_policy_ensure_asc_enforcement_enabled - Prowler Check:
policy_ensure_asc_enforcement_enabled
Last reviewed: 2026-10-11