Azure Compliance ControlsMicrosoft Defender for Cloud
Security Center should have Windows Defender ATP (WDATP) integration selected
Prowler check defender_ensure_wdatp_is_enabled checks that the Azure subscription integrates Microsoft Defender for Endpoint with Defender for Cloud via WDATP. The setting's presence and enabled state at the subscription scope are evaluated.
What this control checks
Defender for Endpoint (WDATP) integration with Defender for Cloud is enabled at subscription scope
Framework mappings
The clauses this control is mapped to in each framework.
- CC6.8: The entity implements controls to prevent or detect and act upon the introduction of unauthorized or malicious software to meet the entity's objectives.
- CC7.1: To meet its objectives, the entity uses detection and monitoring procedures to identify (1) changes to configurations that result in the introduction of new vulnerabilities, and (2) susceptibilities to newly discovered vulnerabilities.
- 3 Incident handling
- 6 Security in network and information systems acquisition, development and maintenance
- 9.1.3.3 Ensure that 'Endpoint protection' component status is set to 'On'
- 8.1.3.3 Ensure that 'Endpoint protection' component status is set to 'On'
RBI Cyber Security Framework for UCBs
- Annex I (7.4)
- OPS-04.01B Policies and instructions with specifications for protection against malware are documented, communicated, and provided in accordance with SP-01 with respect to the following aspects: - Use of system-specific protection mechanisms;- Operating protection programmes on system components...
- OPS-23.01B The cloud service provider regularly measures, analyses and assesses the procedures with which vulnerabilities and incidents are handled to verify their continued suitability, appropriateness and effectiveness.
- 2.9 Ensure that Windows Defender ATP (WDATP) integration with Security Center is selected
- 2.9 Ensure that Microsoft Defender for Endpoint (WDATP) integration with Microsoft Defender for Cloud is selected
- 2.4.2 Ensure that Microsoft Defender for Endpoint integration with Microsoft Defender for Cloud is selected
- 2.1.22 Ensure that Microsoft Defender for Endpoint integration with Microsoft Defender for Cloud is selected
- 2.1.21 Ensure that Microsoft Defender for Endpoint integration with Microsoft Defender for Cloud is selected
- 3.1.3.3 Ensure that 'Endpoint protection' component status is set to 'On'
- 164.308(a)(5)(ii)(B): Administrative Safeguards
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
securitycenter_wdatp_integration - Powerpipe Control:
azure_compliance.control.securitycenter_wdatp_integration - Prowler Check:
defender_ensure_wdatp_is_enabled
Last reviewed: 2026-10-15