Azure Compliance ControlsMicrosoft Defender for Cloud
Azure subscriptions should have Azure Defender for DNS enabled
Prowler checks that Microsoft Defender for DNS is configured at the `Standard` tier for the Azure subscription. The control concerns the Azure Defender for DNS setting, which should be enabled on the subscription and set to the `Standard` tier.
What this control checks
Defender for DNS is set to On (Standard pricing tier) for the subscription
Framework mappings
The clauses this control is mapped to in each framework.
- CC6.8: The entity implements controls to prevent or detect and act upon the introduction of unauthorized or malicious software to meet the entity's objectives.
- CC7.1: To meet its objectives, the entity uses detection and monitoring procedures to identify (1) changes to configurations that result in the introduction of new vulnerabilities, and (2) susceptibilities to newly discovered vulnerabilities.
- A.5.25 Assessment and decision on information security events
- A.5.28 Collection of evidence
- A.8.7 Protection against malware
- A.8.9 Configuration management
- 3 Incident handling
- 6 Security in network and information systems acquisition, development and maintenance
- AC-2(12) Account Monitoring for Atypical Usage
- AU-6 Audit Record Review, Analysis, and Reporting
- AU-6(4) Central Review And Analysis
- AU-6(5) Central Review And Analysis
- AU-12 Audit Record Generation
6 more clauses
- AU-12(1) System-Wide And Time-Correlated Audit Trial
- IR-4 Incident Handling
- IR-5 Incident Monitoring
- RA-5 Vulnerability Monitoring and Scanning
- SI-2 Flaw Remediation
- SI-4: System Monitoring
- 9.1.17 [LEGACY] Ensure That Microsoft Defender for DNS Is Set To 'On'
RBI Cyber Security Framework for UCBs
- Annex I (6)
- OPS-04.01B Policies and instructions with specifications for protection against malware are documented, communicated, and provided in accordance with SP-01 with respect to the following aspects: - Use of system-specific protection mechanisms;- Operating protection programmes on system components...
- 2.1.11 Ensure That Microsoft Defender for DNS Is Set To 'On'
- 2.1.11 Ensure That Microsoft Defender for DNS Is Set To 'On'
- 2.1.10 [LEGACY] Ensure That Microsoft Defender for DNS Is Set To 'On'
- 3.1.16 [LEGACY] Ensure That Microsoft Defender for DNS Is Set To 'On'
- 164.308(a)(1)(ii)(A) Risk analysis
Related controls
- Network security groups should limit inbound TCP port 53 access from the internet
- Network security groups should limit outbound access from the internet
- Network security groups should have flow logs configured
- Virtual machines should have a vulnerability assessment solution enabled
- Regions with newly created virtual networks should have Network Watcher deployed
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
securitycenter_azure_defender_on_for_dns - Powerpipe Control:
azure_compliance.control.securitycenter_azure_defender_on_for_dns - Prowler Check:
defender_ensure_defender_for_dns_is_on
Last reviewed: 2026-10-14