Azure subscriptions should have Microsoft Defender for APIs set to 'On'
Checks Azure subscriptions for Microsoft Defender for APIs, which brings new discovery, protection, detection, & response coverage to monitor for common API based attacks & security misconfigurations across the APIs in scope.
Microsoft Defender for APIs brings new discovery, protection, detection, & response coverage to monitor for common API based attacks & security misconfigurations.
What this control checks
Microsoft Defender for APIs pricing tier must be Standard on the subscription
Common pitfalls
Effect defaults to AuditIfNotExists
The effect parameter defaults to AuditIfNotExists. Its allowed values are AuditIfNotExists and Disabled.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Microsoft Defender for APIs should be enabled" (7926a6d1-b268-4586-8197-e8ae90c877d7); PowerPipe control azure_compliance.control.security_center_defender_for_api_enabled.
Framework-specific interpretation
CIS Azure Benchmark v5.0.0: Mapped to 8.1.2.1 (Ensure Microsoft Defender for APIs is set to 'On').
Framework mappings
The clauses this control is mapped to in each framework.
- 8.1.2.1 Ensure Microsoft Defender for APIs is set to 'On'
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
security_center_defender_for_api_enabled - Powerpipe Control:
azure_compliance.control.security_center_defender_for_api_enabled - Azure Policy Definition:
7926a6d1-b268-4586-8197-e8ae90c877d7
Last reviewed: 2026-10-14