Azure subscriptions should have Microsoft Defender for container registries enabled
Azure Defender for container registries provides vulnerability scanning of any images pulled within the last 30 days, pushed to your registry, or imported. It exposes detailed findings per image.
Azure Defender for container registries provides vulnerability scanning of any images pulled within the last 30 days, pushed to your registry, or imported, and exposes detailed findings per image.
What this control checks
Azure Defender for container registries must be enabled (tier set to Standard)
Common pitfalls
Non-Standard tier fails only for ContainerRegistry
The check fails when resource_type is ContainerRegistry and tier is not Standard. It passes when resource_type is not ContainerRegistry.
Audit evidence
Evidence that deployed resources meet this control: PowerPipe control azure_compliance.control.securitycenter_azure_defender_on_for_containerregistry.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_AZURE_86.
Framework-specific interpretation
CIS Azure Benchmark v4.0.0: Mapped to 9.1.4.1 (Ensure That Microsoft Defender for Containers Is Set To 'On').
CIS Azure Benchmark v5.0.0: Mapped to 8.1.4.1 (Ensure That Microsoft Defender for Containers Is Set To 'On').
CIS Azure Benchmark v1.3.0: Mapped to 2.7 (Ensure that Azure Defender is set to On for Container Registries).
CIS Azure Benchmark v1.4.0: Mapped to 2.7 (Ensure that Microsoft Defender for Container Registries is set to 'On').
CIS Azure Benchmark v1.5.0: Mapped to 2.1.8 (Ensure That Microsoft Defender for Containers Is Set To 'On').
CIS Azure Benchmark v2.0.0: Mapped to 2.1.8 (Ensure That Microsoft Defender for Containers Is Set To 'On').
CIS Azure Benchmark v2.1.0: Mapped to 2.1.8 (Ensure That Microsoft Defender for Containers Is Set To 'On').
CIS Azure Benchmark v3.0.0: Mapped to 3.1.4.1 (Ensure That Microsoft Defender for Containers Is Set To 'On').
Framework mappings
The clauses this control is mapped to in each framework.
- 9.1.4.1 Ensure That Microsoft Defender for Containers Is Set To 'On'
- 8.1.4.1 Ensure That Microsoft Defender for Containers Is Set To 'On'
- 2.7 Ensure that Azure Defender is set to On for Container Registries
- 2.7 Ensure that Microsoft Defender for Container Registries is set to 'On'
- 2.1.8 Ensure That Microsoft Defender for Containers Is Set To 'On'
- 2.1.8 Ensure That Microsoft Defender for Containers Is Set To 'On'
- 2.1.8 Ensure That Microsoft Defender for Containers Is Set To 'On'
- 3.1.4.1 Ensure That Microsoft Defender for Containers Is Set To 'On'
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
securitycenter_azure_defender_on_for_containerregistry - Checkov Check:
CKV_AZURE_86 - Powerpipe Control:
azure_compliance.control.securitycenter_azure_defender_on_for_containerregistry
Last reviewed: 2026-10-14