Azure subscriptions should have Microsoft Defender CSPM set to 'On'
Microsoft Defender CSPM should be enabled. Defender CSPM provides enhanced posture capabilities and a new intelligent cloud security graph to help identify, prioritize, and reduce risk. The check looks at the subscription.
Without Defender CSPM, the subscription relies on foundational CSPM (free tier) which lacks attack path analysis, agentless vulnerability scanning, and security governance. Advanced threats exploiting misconfiguration chains go undetected.
What this control checks
The subscription's CloudPosture pricing must have pricingTier set to Standard (Defender CSPM.
Common pitfalls
Defender CSPM is separate from the free foundational tier
Defender CSPM is available in addition to the free foundational security posture capabilities turned on by default in Defender for Cloud.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definitions "Microsoft Defender CSPM should be enabled" (1f90fc71-a595-4066-8974-d4d0802e8ef0) and "Configure Microsoft Defender CSPM to be enabled" (689f7782-ef2c-4270-a6d0-7664869076bd); Prowler check defender_ensure_defender_cspm_is_on (prowler azure --checks defender_ensure_defender_cspm_is_on); PowerPipe control azure_compliance.control.security_center_defender_for_cloudposture_enabled.
Framework-specific interpretation
ISO/IEC 27001:2022: Mapped to A.8.16 (Monitoring Activities).
Framework mappings
The clauses this control is mapped to in each framework.
- A.8.16 Monitoring activities
- 8.1.1.1 Ensure Microsoft Defender CSPM is set to 'On'
Related controls
- Security contacts should have attack path email notifications enabled at the configured minimum risk level
- Azure subscriptions should have Microsoft Defender for Kubernetes enabled
- Azure subscriptions should have Microsoft Defender for Azure SQL Database servers enabled
- Azure subscriptions should have an Activity Log Alert configured for Create or Update Security Solution
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
security_center_defender_for_cloudposture_enabled - Powerpipe Control:
azure_compliance.control.security_center_defender_for_cloudposture_enabled - Prowler Check:
defender_ensure_defender_cspm_is_on - Azure Policy Definitions:
1f90fc71-a595-4066-8974-d4d0802e8ef0,689f7782-ef2c-4270-a6d0-7664869076bd
Last reviewed: 2026-10-14