Azure subscriptions should have Microsoft Defender for Kubernetes enabled
Azure Defender for Kubernetes provides real-time threat protection for containerized environments and generates alerts for suspicious activities. Checkov CKV_AZURE_85 requires Azure Defender to be set to On for Kubernetes.
What this control checks
Checkov CKV_AZURE_85 checks azurerm_security_center_subscription_pricing and evaluates resource_type and tier. It passes when resource_type is not KubernetesService or when tier is Standard. It fails when resource_type is KubernetesService and tier is not Standard. Powerpipe securitycenter_azure_defender_on_for_k8s is titled "Azure Defender for Kubernetes should be enabled".
Framework mappings
The clauses this control is mapped to in each framework.
- 2.6 Ensure that Azure Defender is set to On for Kubernetes
- 2.6 Ensure that Microsoft Defender for Kubernetes is set to 'On'
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
securitycenter_azure_defender_on_for_k8s - Checkov Check:
CKV_AZURE_85 - Powerpipe Control:
azure_compliance.control.securitycenter_azure_defender_on_for_k8s
Last reviewed: 2026-10-14