Azure subscriptions should have Microsoft Defender for Kubernetes enabled
Azure Defender for Kubernetes provides real-time threat protection for containerized environments and generates alerts for suspicious activities. Checkov CKV_AZURE_85 requires Azure Defender to be set to On for Kubernetes.
Azure Defender for Kubernetes provides real-time threat protection for containerized environments and generates alerts for suspicious activities.
What this control checks
Azure Defender for Kubernetes should be enabled
Common pitfalls
Check only applies to KubernetesService
It passes when resource_type is not KubernetesService. It fails when resource_type is KubernetesService and tier is not Standard.
Audit evidence
Evidence that deployed resources meet this control: PowerPipe control azure_compliance.control.securitycenter_azure_defender_on_for_k8s.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_AZURE_85.
Framework-specific interpretation
CIS Azure Benchmark v1.3.0: Mapped to 2.6 (Ensure that Azure Defender is set to On for Kubernetes).
CIS Azure Benchmark v1.4.0: Mapped to 2.6 (Ensure that Microsoft Defender for Kubernetes is set to 'On').
Framework mappings
The clauses this control is mapped to in each framework.
- 2.6 Ensure that Azure Defender is set to On for Kubernetes
- 2.6 Ensure that Microsoft Defender for Kubernetes is set to 'On'
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
securitycenter_azure_defender_on_for_k8s - Checkov Check:
CKV_AZURE_85 - Powerpipe Control:
azure_compliance.control.securitycenter_azure_defender_on_for_k8s
Last reviewed: 2026-10-14