Azure Compliance ControlsMicrosoft Defender for Cloud
Azure subscriptions should have Microsoft Defender for container registries enabled
Azure Defender for container registries provides vulnerability scanning of any images pulled within the last 30 days, pushed to your registry, or imported, and exposes detailed findings per image.
What this control checks
Azure Defender for container registries must be enabled (tier set to Standard)
Framework mappings
The clauses this control is mapped to in each framework.
- 9.1.4.1 Ensure That Microsoft Defender for Containers Is Set To 'On'
- 8.1.4.1 Ensure That Microsoft Defender for Containers Is Set To 'On'
- 2.7 Ensure that Azure Defender is set to On for Container Registries
- 2.7 Ensure that Microsoft Defender for Container Registries is set to 'On'
- 2.1.8 Ensure That Microsoft Defender for Containers Is Set To 'On'
- 2.1.8 Ensure That Microsoft Defender for Containers Is Set To 'On'
- 2.1.8 Ensure That Microsoft Defender for Containers Is Set To 'On'
- 3.1.4.1 Ensure That Microsoft Defender for Containers Is Set To 'On'
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
securitycenter_azure_defender_on_for_containerregistry - Checkov Check:
CKV_AZURE_86 - Powerpipe Control:
azure_compliance.control.securitycenter_azure_defender_on_for_containerregistry
Last reviewed: 2026-10-14