last sync: 2025-Jul-28 17:33:33 UTC

Configure Microsoft Defender for Containers plan

Azure BuiltIn Policy definition

Source Azure Portal
Display name Configure Microsoft Defender for Containers plan
Id efd4031d-b232-4595-babf-ae817348e91b
Version 1.1.0
Details on versioning
Versioning Versions supported for Versioning: 2
1.1.0
1.0.0
Built-in Versioning [Preview]
Category Security Center
Microsoft Learn
Description New capabilities are continuously being added to Defender for Containers plan, which may require the user's explicit enablement. Use this policy to make sure all new capabilities will be enabled.
Cloud environments AzureCloud = true
AzureUSGovernment = unknown
AzureChinaCloud = unknown
Available in AzUSGov Unknown, no evidence if Policy definition is/not available in AzureUSGovernment
Mode All
Type BuiltIn
Preview False
Deprecated False
Effect Default
DeployIfNotExists
Allowed
DeployIfNotExists, Disabled
RBAC role(s)
Role Name Role Id
Owner 8e3af657-a8ff-443c-a75c-2fe8c4bcb635
Rule aliases THEN-ExistenceCondition (4)
Alias Namespace ResourceType Path PathIsDefault DefaultPath Modifiable
Microsoft.Security/pricings/extensions[*] Microsoft.Security pricings properties.extensions[*] True True
Microsoft.Security/pricings/extensions[*].isEnabled Microsoft.Security pricings properties.extensions[*].isEnabled True True
Microsoft.Security/pricings/extensions[*].name Microsoft.Security pricings properties.extensions[*].name True False
Microsoft.Security/pricings/pricingTier Microsoft.Security pricings properties.pricingTier True False
Rule resource types IF (1)
THEN-Deployment (1)
Compliance Not a Compliance control
Initiatives usage
Rows: 1-1 / 1
Records:
Use the filters above each column to filter and limit table data. Advanced searches can be performed by using the following operators:
<, <=, >, >=, =, *, !, {, }, ||,&&, [empty], [nonempty], rgx:
Learn more

TableFilter v0.7.3

https://www.tablefilter.com/
©2015-2025 Max Guglielmi
?
Page of 1
Initiative DisplayName Initiative Id Initiative Category State Type polSet in AzUSGov
Configure Microsoft Defender for Cloud plans f08c57cd-dbd6-49a4-a85e-9ae77ac959b0 Security Center GA BuiltIn unknown
History
Date/Time (UTC ymd) (i) Change type Change detail
2025-02-17 18:37:09 change Minor (1.0.0 > 1.1.0)
2024-01-31 19:57:15 add efd4031d-b232-4595-babf-ae817348e91b
JSON compare
compare mode: version left: version right:
1.0.0 → 1.1.0 RENAMED
@@ -3,9 +3,9 @@
3
  "policyType": "BuiltIn",
4
  "mode": "All",
5
  "description": "New capabilities are continuously being added to Defender for Containers plan, which may require the user's explicit enablement. Use this policy to make sure all new capabilities will be enabled.",
6
  "metadata": {
7
- "version": "1.0.0",
8
  "category": "Security Center"
9
  },
10
  "parameters": {
11
  "effect": {
@@ -23,15 +23,51 @@
23
  "isContainerRegistriesVulnerabilityAssessmentsEnabled": {
24
  "type": "String",
25
  "metadata": {
26
  "displayName": "Container Registries Vulnerability Assessments Enabled",
27
- "description": "Controls the container registries vulnerability assessments add-on"
28
  },
29
  "allowedValues": [
30
  "true",
31
  "false"
32
  ],
33
  "defaultValue": "true"
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
34
  }
35
  },
36
  "policyRule": {
37
  "if": {
@@ -70,8 +106,62 @@
70
  ]
71
  }
72
  },
73
  "equals": 1
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
74
  }
75
  ]
76
  },
77
  "deployment": {
@@ -80,16 +170,34 @@
80
  "mode": "incremental",
81
  "parameters": {
82
  "isContainerRegistriesVulnerabilityAssessmentsEnabled": {
83
  "value": "[parameters('isContainerRegistriesVulnerabilityAssessmentsEnabled')]"
 
 
 
 
 
 
 
 
 
84
  }
85
  },
86
  "template": {
87
  "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
88
  "contentVersion": "1.0.0.0",
89
  "parameters": {
90
  "isContainerRegistriesVulnerabilityAssessmentsEnabled": {
91
  "type": "String"
 
 
 
 
 
 
 
 
 
92
  }
93
  },
94
  "resources": [
95
  {
@@ -101,8 +209,20 @@
101
  "extensions": [
102
  {
103
  "name": "ContainerRegistriesVulnerabilityAssessments",
104
  "isEnabled": "[parameters('isContainerRegistriesVulnerabilityAssessmentsEnabled')]"
 
 
 
 
 
 
 
 
 
 
 
 
105
  }
106
  ]
107
  }
108
  }
 
3
  "policyType": "BuiltIn",
4
  "mode": "All",
5
  "description": "New capabilities are continuously being added to Defender for Containers plan, which may require the user's explicit enablement. Use this policy to make sure all new capabilities will be enabled.",
6
  "metadata": {
7
+ "version": "1.1.0",
8
  "category": "Security Center"
9
  },
10
  "parameters": {
11
  "effect": {
 
23
  "isContainerRegistriesVulnerabilityAssessmentsEnabled": {
24
  "type": "String",
25
  "metadata": {
26
  "displayName": "Container Registries Vulnerability Assessments Enabled",
27
+ "description": "Controls the container registries vulnerability assessments extension"
28
  },
29
  "allowedValues": [
30
  "true",
31
  "false"
32
  ],
33
  "defaultValue": "true"
34
+ },
35
+ "isAgentlessDiscoveryForKubernetesEnabled": {
36
+ "type": "String",
37
+ "metadata": {
38
+ "displayName": "Agentless Discovery For Kubernetes Enabled",
39
+ "description": "Controls the agentless discovery for Kubernetes extension"
40
+ },
41
+ "allowedValues": [
42
+ "true",
43
+ "false"
44
+ ],
45
+ "defaultValue": "true"
46
+ },
47
+ "isAgentlessVmScanningEnabled": {
48
+ "type": "String",
49
+ "metadata": {
50
+ "displayName": "Agentless VM Scanning Enabled",
51
+ "description": "Controls the agentless VM scanning extension"
52
+ },
53
+ "allowedValues": [
54
+ "true",
55
+ "false"
56
+ ],
57
+ "defaultValue": "true"
58
+ },
59
+ "isContainerSensorEnabled": {
60
+ "type": "String",
61
+ "metadata": {
62
+ "displayName": "Container Sensor Enabled",
63
+ "description": "Controls the container sensor extension"
64
+ },
65
+ "allowedValues": [
66
+ "true",
67
+ "false"
68
+ ],
69
+ "defaultValue": "true"
70
  }
71
  },
72
  "policyRule": {
73
  "if": {
 
106
  ]
107
  }
108
  },
109
  "equals": 1
110
+ },
111
+ {
112
+ "count": {
113
+ "field": "Microsoft.Security/pricings/extensions[*]",
114
+ "where": {
115
+ "allOf": [
116
+ {
117
+ "field": "Microsoft.Security/pricings/extensions[*].name",
118
+ "equals": "AgentlessDiscoveryForKubernetes"
119
+ },
120
+ {
121
+ "field": "Microsoft.Security/pricings/extensions[*].isEnabled",
122
+ "equals": "[parameters('isAgentlessDiscoveryForKubernetesEnabled')]"
123
+ }
124
+ ]
125
+ }
126
+ },
127
+ "equals": 1
128
+ },
129
+ {
130
+ "count": {
131
+ "field": "Microsoft.Security/pricings/extensions[*]",
132
+ "where": {
133
+ "allOf": [
134
+ {
135
+ "field": "Microsoft.Security/pricings/extensions[*].name",
136
+ "equals": "AgentlessVmScanning"
137
+ },
138
+ {
139
+ "field": "Microsoft.Security/pricings/extensions[*].isEnabled",
140
+ "equals": "[parameters('isAgentlessVmScanningEnabled')]"
141
+ }
142
+ ]
143
+ }
144
+ },
145
+ "equals": 1
146
+ },
147
+ {
148
+ "count": {
149
+ "field": "Microsoft.Security/pricings/extensions[*]",
150
+ "where": {
151
+ "allOf": [
152
+ {
153
+ "field": "Microsoft.Security/pricings/extensions[*].name",
154
+ "equals": "ContainerSensor"
155
+ },
156
+ {
157
+ "field": "Microsoft.Security/pricings/extensions[*].isEnabled",
158
+ "equals": "[parameters('isContainerSensorEnabled')]"
159
+ }
160
+ ]
161
+ }
162
+ },
163
+ "equals": 1
164
  }
165
  ]
166
  },
167
  "deployment": {
 
170
  "mode": "incremental",
171
  "parameters": {
172
  "isContainerRegistriesVulnerabilityAssessmentsEnabled": {
173
  "value": "[parameters('isContainerRegistriesVulnerabilityAssessmentsEnabled')]"
174
+ },
175
+ "isAgentlessDiscoveryForKubernetesEnabled": {
176
+ "value": "[parameters('isAgentlessDiscoveryForKubernetesEnabled')]"
177
+ },
178
+ "isAgentlessVmScanningEnabled": {
179
+ "value": "[parameters('isAgentlessVmScanningEnabled')]"
180
+ },
181
+ "isContainerSensorEnabled": {
182
+ "value": "[parameters('isContainerSensorEnabled')]"
183
  }
184
  },
185
  "template": {
186
  "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
187
  "contentVersion": "1.0.0.0",
188
  "parameters": {
189
  "isContainerRegistriesVulnerabilityAssessmentsEnabled": {
190
  "type": "String"
191
+ },
192
+ "isAgentlessDiscoveryForKubernetesEnabled": {
193
+ "type": "String"
194
+ },
195
+ "isAgentlessVmScanningEnabled": {
196
+ "type": "String"
197
+ },
198
+ "isContainerSensorEnabled": {
199
+ "type": "String"
200
  }
201
  },
202
  "resources": [
203
  {
 
209
  "extensions": [
210
  {
211
  "name": "ContainerRegistriesVulnerabilityAssessments",
212
  "isEnabled": "[parameters('isContainerRegistriesVulnerabilityAssessmentsEnabled')]"
213
+ },
214
+ {
215
+ "name": "AgentlessDiscoveryForKubernetes",
216
+ "isEnabled": "[parameters('isAgentlessDiscoveryForKubernetesEnabled')]"
217
+ },
218
+ {
219
+ "name": "AgentlessVmScanning",
220
+ "isEnabled": "[parameters('isAgentlessVmScanningEnabled')]"
221
+ },
222
+ {
223
+ "name": "ContainerSensor",
224
+ "isEnabled": "[parameters('isContainerSensorEnabled')]"
225
  }
226
  ]
227
  }
228
  }
JSON
api-version=2021-06-01
EPAC
{7 items}