Enable Microsoft Defender for Cloud for App Service Instances

More Info:

Ensure that Microsoft Defender for Cloud is enabled for Azure App Service instances.

Risk Level

High

Address

Operational Maturity, Security

Compliance Standards

• CIS AZURE
• Cloudanix Best Practice
• HITRUST CSF

Triage and Remediation

Remediation

Remediation

Using Console

To remediate the misconfiguration “Enable Microsoft Defender for Cloud for App Service Instances” in Azure using the Azure console, please follow these steps:

1. Open the Azure portal and navigate to the App Service instance for which you want to enable Microsoft Defender for Cloud.

2. Click on “Security” from the left-hand menu and then click on “Security Center” from the sub-menu.

3. In the Security Center, click on “Recommendations” from the left-hand menu.

4. Search for the recommendation “Enable Microsoft Defender for Cloud for App Service Instances” in the list of recommendations.

5. Click on the recommendation to view the details.

6. Click on the “Remediate” button to remediate the recommendation.

7. In the “Remediate” pane, select the subscription, resource group, and App Service instance for which you want to enable Microsoft Defender for Cloud.

8. Click on the “Remediate” button to enable Microsoft Defender for Cloud for the selected App Service instance.

9. Once the remediation is complete, the recommendation status will change to “Compliant”.

By following these steps, you can successfully remediate the misconfiguration “Enable Microsoft Defender for Cloud for App Service Instances” in Azure using the Azure console.

Using CLI

To enable Microsoft Defender for Cloud for App Service Instances in Azure using Azure CLI, you can follow these steps:

1. Open the Azure CLI command prompt.

2. Log in to your Azure account using the following command:

   az login
   

3. Select the subscription that contains the App Service Instance you want to enable Microsoft Defender for Cloud for using the following command:

   az account set --subscription <subscription_id>
   

4. Enable Microsoft Defender for Cloud for the App Service Instance using the following command:

   az webapp update --name <app_service_instance_name> --resource-group <resource_group_name> --set properties.siteAuthEnabled=true
   

   This command sets the siteAuthEnabled property of the App Service Instance to true, which enables Microsoft Defender for Cloud.

5. Verify that Microsoft Defender for Cloud is enabled for the App Service Instance using the following command:

   az webapp show --name <app_service_instance_name> --resource-group <resource_group_name> --query 'properties.siteAuthEnabled'
   

   This command returns the value true if Microsoft Defender for Cloud is enabled for the App Service Instance.

That’s it! You have successfully enabled Microsoft Defender for Cloud for the App Service Instance in Azure using Azure CLI.

Using Python

To enable Microsoft Defender for Cloud for App Service Instances in Azure using Python, follow these steps:

1. Import the necessary libraries:

from azure.identity import DefaultAzureCredential
from azure.mgmt.web import WebSiteManagementClient
from azure.mgmt.web.models import SiteConfigResource

2. Authenticate using Azure credentials:

credential = DefaultAzureCredential()
subscription_id = 'your-subscription-id'
resource_group_name = 'your-resource-group-name'
webapp_name = 'your-webapp-name'

web_client = WebSiteManagementClient(credential, subscription_id)

3. Get the current site configuration:

site_config = web_client.web_apps.get_configuration(resource_group_name, webapp_name)

4. Enable Microsoft Defender for Cloud by setting the webSiteManagementEndpointEnabled property to True:

site_config.site_auth_enabled = True
site_config.windows_fx_version = "DOCKER|mcr.microsoft.com/azure-security/defender-appsvc:latest"
site_config.app_command_line = "java -jar /home/site/wwwroot/defender/defender.jar"
site_config.linux_fx_version = "DOCKER|mcr.microsoft.com/azure-security/defender-appsvc:latest"
site_config.webSiteManagementEndpointEnabled = True

5. Update the site configuration:

web_client.web_apps.update_configuration(resource_group_name, webapp_name, site_config)

After executing these steps, Microsoft Defender for Cloud will be enabled for the App Service Instance in Azure.

Using Terraform

provider "azurerm" {
  features {}
  # Configure this provider with the SUBSCRIPTION that should have Defender enabled
  # subscription_id = "SUBSCRIPTION_ID"
}

# Enable Microsoft Defender for Cloud for App Service instances at the subscription level
resource "azurerm_security_center_subscription_pricing" "defender_app_services" {
  # Optional: set explicitly if the provider is not already scoped to the target subscription
  # subscription_id = "SUBSCRIPTION_ID"

  resource_type = "AppServices"
  tier          = "Standard" # "Standard" enables Microsoft Defender; "Free" disables it
}

Changing subscription_id on this resource would force replacement; changing tier between Free and Standard is an in-place update.

Verification: terraform plan should show an update (or creation) of azurerm_security_center_subscription_pricing.defender_app_services with resource_type = "AppServices" and tier changing from Free (or absent) to Standard.