Source
Azure Portal
Display name
Configure Microsoft Defender for Containers plan
Id
efd4031d-b232-4595-babf-ae817348e91b Copy Id Copy resourceId
Version
1.1.0 Details on versioning
Versioning
Versions supported for Versioning: 2 1.1.0 1.0.0 Built-in Versioning [Preview]
Category
Security Center Microsoft Learn
Description
New capabilities are continuously being added to Defender for Containers plan, which may require the user's explicit enablement. Use this policy to make sure all new capabilities will be enabled.
Cloud environments
AzureCloud = true AzureUSGovernment = unknown AzureChinaCloud = unknown
Available in AzUSGov
Unknown, no evidence if Policy definition is/not available in AzureUSGovernment
Mode
All
Type
BuiltIn
Preview
False
Deprecated
False
Effect
Default DeployIfNotExists
Allowed DeployIfNotExists, Disabled
RBAC role(s)
Rule aliases
THEN-ExistenceCondition (4)
Rule resource types
IF (1)
THEN-Deployment (1)
Compliance
Not a Compliance control
Initiatives usage
Records: 10 25 100 200 Use the filters above each column to filter and limit table data. Advanced searches can be performed by using the following operators:
< ,
<= ,
> ,
>= ,
= ,
* ,
! ,
{ ,
} ,
|| ,
&& ,
[empty] ,
[nonempty] ,
rgx: Learn more ? Page 1 of 1
Clear Security Center Clear GA Clear BuiltIn
Initiative DisplayName
Initiative Id
Initiative Category
State
Type
polSet in AzUSGov
Configure Microsoft Defender for Cloud plans
f08c57cd-dbd6-49a4-a85e-9ae77ac959b0
Security Center
GA BuiltIn
unknown
No results
History
Date/Time (UTC ymd) (i)
Change type
Change detail
2025-02-17 18:37:09
change
Minor (1.0.0 > 1.1.0)
2024-01-31 19:57:15
add
efd4031d-b232-4595-babf-ae817348e91b
JSON compareHide
compare mode:
side-by-side
line-by-line
version left: 1.0.0
version right: 1.1.0 1.0.0
@@ -3,9 +3,9 @@
3
"policyType": "BuiltIn",
4
"mode": "All",
5
"description": "New capabilities are continuously being added to Defender for Containers plan, which may require the user's explicit enablement. Use this policy to make sure all new capabilities will be enabled.",
6
"metadata": {
7
-
"version": "1.0.0",
8
"category": "Security Center"
9
},
10
"parameters": {
11
"effect": {
@@ -23,15 +23,51 @@
23
"isContainerRegistriesVulnerabilityAssessmentsEnabled": {
24
"type": "String",
25
"metadata": {
26
"displayName": "Container Registries Vulnerability Assessments Enabled",
27
-
"description": "Controls the container registries vulnerability assessments add-on"
28
},
29
"allowedValues": [
30
"true",
31
"false"
32
],
33
"defaultValue": "true"
34
}
35
},
36
"policyRule": {
37
"if": {
@@ -70,8 +106,62 @@
70
]
71
}
72
},
73
"equals": 1
74
}
75
]
76
},
77
"deployment": {
@@ -80,16 +170,34 @@
80
"mode": "incremental",
81
"parameters": {
82
"isContainerRegistriesVulnerabilityAssessmentsEnabled": {
83
"value": "[parameters('isContainerRegistriesVulnerabilityAssessmentsEnabled')]"
84
}
85
},
86
"template": {
87
"$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
88
"contentVersion": "1.0.0.0",
89
"parameters": {
90
"isContainerRegistriesVulnerabilityAssessmentsEnabled": {
91
"type": "String"
92
}
93
},
94
"resources": [
95
{
@@ -101,8 +209,20 @@
101
"extensions": [
102
{
103
"name": "ContainerRegistriesVulnerabilityAssessments",
104
"isEnabled": "[parameters('isContainerRegistriesVulnerabilityAssessmentsEnabled')]"
105
}
106
]
107
}
108
}
3
"policyType": "BuiltIn",
4
"mode": "All",
5
"description": "New capabilities are continuously being added to Defender for Containers plan, which may require the user's explicit enablement. Use this policy to make sure all new capabilities will be enabled.",
6
"metadata": {
7
+
"version": "1.1 .0",
8
"category": "Security Center"
9
},
10
"parameters": {
11
"effect": {
23
"isContainerRegistriesVulnerabilityAssessmentsEnabled": {
24
"type": "String",
25
"metadata": {
26
"displayName": "Container Registries Vulnerability Assessments Enabled",
27
+
"description": "Controls the container registries vulnerability assessments extension "
28
},
29
"allowedValues": [
30
"true",
31
"false"
32
],
33
"defaultValue": "true"
34
+
},
35
+
"isAgentlessDiscoveryForKubernetesEnabled": {
36
+
"type": "String",
37
+
"metadata": {
38
+
"displayName": "Agentless Discovery For Kubernetes Enabled",
39
+
"description": "Controls the agentless discovery for Kubernetes extension"
40
+
},
41
+
"allowedValues": [
42
+
"true",
43
+
"false"
44
+
],
45
+
"defaultValue": "true"
46
+
},
47
+
"isAgentlessVmScanningEnabled": {
48
+
"type": "String",
49
+
"metadata": {
50
+
"displayName": "Agentless VM Scanning Enabled",
51
+
"description": "Controls the agentless VM scanning extension"
52
+
},
53
+
"allowedValues": [
54
+
"true",
55
+
"false"
56
+
],
57
+
"defaultValue": "true"
58
+
},
59
+
"isContainerSensorEnabled": {
60
+
"type": "String",
61
+
"metadata": {
62
+
"displayName": "Container Sensor Enabled",
63
+
"description": "Controls the container sensor extension"
64
+
},
65
+
"allowedValues": [
66
+
"true",
67
+
"false"
68
+
],
69
+
"defaultValue": "true"
70
}
71
},
72
"policyRule": {
73
"if": {
106
]
107
}
108
},
109
"equals": 1
110
+
},
111
+
{
112
+
"count": {
113
+
"field": "Microsoft.Security/pricings/extensions[*]",
114
+
"where": {
115
+
"allOf": [
116
+
{
117
+
"field": "Microsoft.Security/pricings/extensions[*].name",
118
+
"equals": "AgentlessDiscoveryForKubernetes"
119
+
},
120
+
{
121
+
"field": "Microsoft.Security/pricings/extensions[*].isEnabled",
122
+
"equals": "[parameters('isAgentlessDiscoveryForKubernetesEnabled')]"
123
+
}
124
+
]
125
+
}
126
+
},
127
+
"equals": 1
128
+
},
129
+
{
130
+
"count": {
131
+
"field": "Microsoft.Security/pricings/extensions[*]",
132
+
"where": {
133
+
"allOf": [
134
+
{
135
+
"field": "Microsoft.Security/pricings/extensions[*].name",
136
+
"equals": "AgentlessVmScanning"
137
+
},
138
+
{
139
+
"field": "Microsoft.Security/pricings/extensions[*].isEnabled",
140
+
"equals": "[parameters('isAgentlessVmScanningEnabled')]"
141
+
}
142
+
]
143
+
}
144
+
},
145
+
"equals": 1
146
+
},
147
+
{
148
+
"count": {
149
+
"field": "Microsoft.Security/pricings/extensions[*]",
150
+
"where": {
151
+
"allOf": [
152
+
{
153
+
"field": "Microsoft.Security/pricings/extensions[*].name",
154
+
"equals": "ContainerSensor"
155
+
},
156
+
{
157
+
"field": "Microsoft.Security/pricings/extensions[*].isEnabled",
158
+
"equals": "[parameters('isContainerSensorEnabled')]"
159
+
}
160
+
]
161
+
}
162
+
},
163
+
"equals": 1
164
}
165
]
166
},
167
"deployment": {
170
"mode": "incremental",
171
"parameters": {
172
"isContainerRegistriesVulnerabilityAssessmentsEnabled": {
173
"value": "[parameters('isContainerRegistriesVulnerabilityAssessmentsEnabled')]"
174
+
},
175
+
"isAgentlessDiscoveryForKubernetesEnabled": {
176
+
"value": "[parameters('isAgentlessDiscoveryForKubernetesEnabled')]"
177
+
},
178
+
"isAgentlessVmScanningEnabled": {
179
+
"value": "[parameters('isAgentlessVmScanningEnabled')]"
180
+
},
181
+
"isContainerSensorEnabled": {
182
+
"value": "[parameters('isContainerSensorEnabled')]"
183
}
184
},
185
"template": {
186
"$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
187
"contentVersion": "1.0.0.0",
188
"parameters": {
189
"isContainerRegistriesVulnerabilityAssessmentsEnabled": {
190
"type": "String"
191
+
},
192
+
"isAgentlessDiscoveryForKubernetesEnabled": {
193
+
"type": "String"
194
+
},
195
+
"isAgentlessVmScanningEnabled": {
196
+
"type": "String"
197
+
},
198
+
"isContainerSensorEnabled": {
199
+
"type": "String"
200
}
201
},
202
"resources": [
203
{
209
"extensions": [
210
{
211
"name": "ContainerRegistriesVulnerabilityAssessments",
212
"isEnabled": "[parameters('isContainerRegistriesVulnerabilityAssessmentsEnabled')]"
213
+
},
214
+
{
215
+
"name": "AgentlessDiscoveryForKubernetes",
216
+
"isEnabled": "[parameters('isAgentlessDiscoveryForKubernetesEnabled')]"
217
+
},
218
+
{
219
+
"name": "AgentlessVmScanning",
220
+
"isEnabled": "[parameters('isAgentlessVmScanningEnabled')]"
221
+
},
222
+
{
223
+
"name": "ContainerSensor",
224
+
"isEnabled": "[parameters('isContainerSensorEnabled')]"
225
}
226
]
227
}
228
}
JSON
api-version=2021-06-01
Copy definition Copy definition 4 EPAC EPAC
{ 7 items displayName: "Configure Microsoft Defender for Containers plan" , policyType: "BuiltIn" , mode: "All" , description: "New capabilities are continuously being added to Defender for Containers plan, which may require the user's explicit enablement. Use this policy to make sure all new capabilities will be enabled." , metadata: { 2 items version: "1.1.0" , category: "Security Center" } , parameters: { 5 items effect: { 4 items type: "String" , metadata: { 2 items displayName: "Effect" , description: "Enable or disable the execution of the policy" } , allowedValues: [ 2 items "DeployIfNotExists" , "Disabled" ] , defaultValue: "DeployIfNotExists" } , isContainerRegistriesVulnerabilityAssessmentsEnabled: { 4 items type: "String" , metadata: { 2 items displayName: "Container Registries Vulnerability Assessments Enabled" , description: "Controls the container registries vulnerability assessments extension" } , allowedValues: [ 2 items ] , defaultValue: "true" } , isAgentlessDiscoveryForKubernetesEnabled: { 4 items type: "String" , metadata: { 2 items displayName: "Agentless Discovery For Kubernetes Enabled" , description: "Controls the agentless discovery for Kubernetes extension" } , allowedValues: [ 2 items ] , defaultValue: "true" } , isAgentlessVmScanningEnabled: { 4 items } , isContainerSensorEnabled: { 4 items } } , policyRule: { 2 items if: { 2 items field: "type" , equals: "Microsoft.Resources/subscriptions" } , then: { 2 items effect: "[parameters('effect')]" , details: { 7 items type: "Microsoft.Security/pricings" , name: "Containers" , deploymentScope: "subscription" , existenceScope: "subscription" , roleDefinitionIds: [ 1 item "/providers/Microsoft.Authorization/roleDefinitions/8e3af657-a8ff-443c-a75c-2fe8c4bcb635" Owner ] , existenceCondition: { 1 item allOf: [ 5 items { 2 items field: "Microsoft.Security/pricings/pricingTier" , equals: "Standard" } , { 2 items count: { 2 items field: "Microsoft.Security/pricings/extensions[*]" , where: { 1 item allOf: [ 2 items { 2 items field: "Microsoft.Security/pricings/extensions[*].name" , equals: "ContainerRegistriesVulnerabilityAssessments" } , { 2 items field: "Microsoft.Security/pricings/extensions[*].isEnabled" , equals: "[parameters('isContainerRegistriesVulnerabilityAssessmentsEnabled')]" } ] } } , equals: 1 } , { 2 items count: { 2 items field: "Microsoft.Security/pricings/extensions[*]" , where: { 1 item allOf: [ 2 items { 2 items field: "Microsoft.Security/pricings/extensions[*].name" , equals: "AgentlessDiscoveryForKubernetes" } , { 2 items field: "Microsoft.Security/pricings/extensions[*].isEnabled" , equals: "[parameters('isAgentlessDiscoveryForKubernetesEnabled')]" } ] } } , equals: 1 } , { 2 items count: { 2 items field: "Microsoft.Security/pricings/extensions[*]" , where: { 1 item allOf: [ 2 items { 2 items field: "Microsoft.Security/pricings/extensions[*].name" , equals: "AgentlessVmScanning" } , { 2 items field: "Microsoft.Security/pricings/extensions[*].isEnabled" , equals: "[parameters('isAgentlessVmScanningEnabled')]" } ] } } , equals: 1 } , { 2 items count: { 2 items field: "Microsoft.Security/pricings/extensions[*]" , where: { 1 item allOf: [ 2 items { 2 items field: "Microsoft.Security/pricings/extensions[*].name" , equals: "ContainerSensor" } , { 2 items field: "Microsoft.Security/pricings/extensions[*].isEnabled" , equals: "[parameters('isContainerSensorEnabled')]" } ] } } , equals: 1 } ] } , deployment: { 2 items location: "westeurope" , properties: { 3 items mode: "incremental" , parameters: { 4 items } , template: { 4 items $schema: "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#" , contentVersion: "1.0.0.0" , parameters: { 4 items } , resources: [ 1 item { 4 items type: "Microsoft.Security/pricings" , apiVersion: "2023-01-01" , name: "Containers" , properties: { 2 items pricingTier: "Standard" , extensions: [ 4 items { 2 items name: "ContainerRegistriesVulnerabilityAssessments" , isEnabled: "[parameters('isContainerRegistriesVulnerabilityAssessmentsEnabled')]" } , { 2 items name: "AgentlessDiscoveryForKubernetes" , isEnabled: "[parameters('isAgentlessDiscoveryForKubernetesEnabled')]" } , { 2 items name: "AgentlessVmScanning" , isEnabled: "[parameters('isAgentlessVmScanningEnabled')]" } , { 2 items name: "ContainerSensor" , isEnabled: "[parameters('isContainerSensorEnabled')]" } ] } } ] } } } } } } }