Azure subscriptions should have Azure Defender for DNS enabled
Prowler checks that Microsoft Defender for DNS is configured at the `Standard` tier for the Azure subscription. The control concerns the Azure Defender for DNS setting, which should be enabled on the subscription and set to the `Standard` tier.
Absent Defender for DNS, query telemetry isn't inspected, allowing C2 callbacks, DNS tunneling, and malicious domains to bypass detection. This increases risks to confidentiality (exfiltration), integrity (malware/DGA), and availability (poisoned or hijacked resolution).
What this control checks
Defender for DNS is set to On (Standard pricing tier) for the subscription
Audit evidence
Evidence that deployed resources meet this control: Prowler check defender_ensure_defender_for_dns_is_on (prowler azure --checks defender_ensure_defender_for_dns_is_on); PowerPipe control azure_compliance.control.securitycenter_azure_defender_on_for_dns.
Framework-specific interpretation
SOC 2: Mapped to CC6.8 (The entity implements controls to prevent or detect and act upon the introduction of unauthorized or malicious software...) and CC7.1 (To meet its objectives, the entity uses detection and monitoring procedures to identify (1) changes to configurations...).
ISO/IEC 27001:2022: Mapped to A.5.25 (Assessment And Decision On Information Security Events), A.5.28 (Collection Of Evidence), A.8.7 (Protection Against Malware) and 1 more clause.
NIS2 Directive (EU 2022/2555): Mapped to 3.6.2 (The relevant entities shall ensure that post-incident reviews contribute to improving their approach to network and...), 6.7.2.i (establish communication between distinct systems only through trusted channels that are isolated using logical...), 6.7.2.l (apply best practices for the security of the DNS, and for Internet routing security and routing hygiene of traffic...) and 1 more clause.
NIST SP 800-53 Rev 5: Mapped to AC-2(12) (Account Monitoring for Atypical Usage), AU-12 (Audit Record Generation), AU-12(1) (System-wide and Time-correlated Audit Trail) and 8 more clauses.
Framework mappings
The clauses this control is mapped to in each framework.
- CC6.8: The entity implements controls to prevent or detect and act upon the introduction of unauthorized or malicious software to meet the entity's objectives.
- CC7.1: To meet its objectives, the entity uses detection and monitoring procedures to identify (1) changes to configurations that result in the introduction of new vulnerabilities, and (2) susceptibilities to newly discovered vulnerabilities.
- A.5.25 Assessment and decision on information security events
- A.5.28 Collection of evidence
- A.8.7 Protection against malware
- A.8.9 Configuration management
- 3 Incident handling
- 6 Security in network and information systems acquisition, development and maintenance
- AC-2(12) Account Monitoring for Atypical Usage
- AU-6 Audit Record Review, Analysis, and Reporting
- AU-6(4) Central Review And Analysis
- AU-6(5) Central Review And Analysis
- AU-12 Audit Record Generation
6 more clauses
- AU-12(1) System-Wide And Time-Correlated Audit Trial
- IR-4 Incident Handling
- IR-5 Incident Monitoring
- RA-5 Vulnerability Monitoring and Scanning
- SI-2 Flaw Remediation
- SI-4: System Monitoring
- 9.1.17 [LEGACY] Ensure That Microsoft Defender for DNS Is Set To 'On'
RBI Cyber Security Framework for UCBs
- Annex I (6)
- OPS-04.01B Policies and instructions with specifications for protection against malware are documented, communicated, and provided in accordance with SP-01 with respect to the following aspects: - Use of system-specific protection mechanisms;- Operating protection programmes on system components...
- 2.1.11 Ensure That Microsoft Defender for DNS Is Set To 'On'
- 2.1.11 Ensure That Microsoft Defender for DNS Is Set To 'On'
- 2.1.10 [LEGACY] Ensure That Microsoft Defender for DNS Is Set To 'On'
- 3.1.16 [LEGACY] Ensure That Microsoft Defender for DNS Is Set To 'On'
- 164.308(a)(1)(ii)(A) Risk analysis
Related controls
- Network security groups should limit inbound TCP port 53 access from the internet
- Network security groups should limit outbound access from the internet
- Network security groups should have flow logs configured
- Virtual machines should have a vulnerability assessment solution enabled
- Regions with newly created virtual networks should have Network Watcher deployed
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
securitycenter_azure_defender_on_for_dns - Powerpipe Control:
azure_compliance.control.securitycenter_azure_defender_on_for_dns - Prowler Check:
defender_ensure_defender_for_dns_is_on
Last reviewed: 2026-10-14