04 Apr 2024

Enabling the Defender for Containers on Microsoft Defender for Cloud through the Azure CLI

Enable the base plan (through the pricing setting)

az login
az provider register --namespace Microsoft.Security

az security pricing create -n Containers --tier standard --extensions name=ContainerRegistriesVulnerabilityAssessments isEnabled=True --extensions name=AgentlessDiscoveryForKubernetes isEnabled=True

This will enable the base plan, together with the 2 extensions. However this will leave the UI still in a “Partial” state. We need to deploy some policies to enable the 2 remaining components.

Policy deployment

Use the following AZ CLI commands to enable the Defender for Sensors and the Azure Policy for Kubernetes components.

az policy assignment create --name 'config-arc-extension' --display-name 'config arc extension' --scope subscriptions/{subscription_guid} --policy 708b60a6-d253-4fe0-9114-4be4c00f012c --description '[Preview]: Configure Azure Arc enabled Kubernetes clusters to install Microsoft Defender for Cloud extension' --location eastus --mi-system-assigned

az policy assignment create --name 'config-arc-extension2' --display-name 'config arc extension2' --scope subscriptions/{subscription_guid} --policy 64def556-fbad-4622-930e-72d1d5589bf5 --description 'Configure Azure Kubernetes Service clusters to enable Defender profile' --location eastus --mi-system-assigned


az policy assignment create --name 'azure-pol-add-on-k8' --display-name 'azure pol add-on k8' --scope subscriptions/{subscription_guid} --policy 0a15ec92-a229-4763-bb14-0ea34a568f8d --description 'Azure Policy Add-on for Kubernetes service (AKS) should be installed and enabled on your clusters' --location eastus --mi-system-assigned

az policy assignment create --name 'azure-pol-add-on-k8-2' --display-name 'azure pol add-on k8 - 2' --scope subscriptions/{subscription_guid} --policy a8eff44f-8c92-45c3-a3fb-9880802d67a7  --description 'Deploy Azure Policy Add-on to Azure Kubernetes Service clusters' --location eastus --mi-system-assigned

az policy assignment create --name 'azure-pol-add-on-k8-3' --display-name 'azure pol add-on k8 - 3' --scope subscriptions/{subscription_guid} --policy 0adc5395-9169-4b9b-8687-af838d69410a  --description 'Configure Azure Arc enabled Kubernetes clusters to install the Azure Policy extension'  --location eastus --mi-system-assigned