Azure Compliance ControlsMicrosoft Defender for Cloud
ASC Default policy settings should not have any setting set to 'Disabled'
None of the settings offered by ASC Default policy should be set to effect "Disabled". The powerpipe check is titled "Ensure any of the ASC Default policy setting is not set to "Disabled"".
What this control checks
Fails if any ASC Default policy setting is set to Disabled
Framework mappings
The clauses this control is mapped to in each framework.
- 2.12 Ensure any of the ASC Default policy setting is not set to \"Disabled\"
- 2.12 Ensure Any of the ASC Default Policy Setting is Not Set to 'Disabled'
- 2.6 Ensure Any of the ASC Default Policy Settings are Not Set to 'Disabled'
- 2.1.14 Ensure Any of the ASC Default Policy Settings are Not Set to 'Disabled'
Related controls
- Azure subscriptions should have Microsoft Defender for Servers enabled
- Azure subscriptions should have Microsoft Defender for container registries enabled
- Azure subscriptions should have Microsoft Defender for Azure Cosmos DB enabled
- Security Center should have Windows Defender ATP (WDATP) integration selected
- Kubernetes clusters should have the Azure Policy add-on enabled
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
securitycenter_asc_default_setting_not_disabled - Powerpipe Control:
azure_compliance.control.securitycenter_asc_default_setting_not_disabled
Last reviewed: 2026-10-14