Azure Compliance ControlsMicrosoft Defender for Cloud
Azure subscriptions should have Microsoft Defender CSPM set to 'On'
Microsoft Defender CSPM should be enabled. Defender CSPM provides enhanced posture capabilities and a new intelligent cloud security graph to help identify, prioritize, and reduce risk. The check looks at the subscription.
What this control checks
Prowler check defender_ensure_defender_cspm_is_on evaluates the Cloud Security Posture Management (CSPM) plan for standard tier activation.
Framework mappings
The clauses this control is mapped to in each framework.
- A.8.16 Monitoring activities
- 8.1.1.1 Ensure Microsoft Defender CSPM is set to 'On'
Related controls
- Security contacts should have attack path email notifications enabled at the configured minimum risk level
- Azure subscriptions should have Microsoft Defender for Kubernetes enabled
- Azure subscriptions should have Microsoft Defender for Azure SQL Database servers enabled
- Azure subscriptions should have an Activity Log Alert configured for Create or Update Security Solution
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
security_center_defender_for_cloudposture_enabled - Powerpipe Control:
azure_compliance.control.security_center_defender_for_cloudposture_enabled - Prowler Check:
defender_ensure_defender_cspm_is_on - Azure Policy Definitions:
1f90fc71-a595-4066-8974-d4d0802e8ef0,689f7782-ef2c-4270-a6d0-7664869076bd
Last reviewed: 2026-10-14