I regularly come across Azure environments where the Microsoft Defender plans are not enabled, which is desired. In many cases, the cause can be found in manually managing the environment settings (former ‘Pricing Settings’), where all plans must be enabled for each new subscription. And thus be forgotten when a new subscription becomes available.

Many don’t know that you can easily manage these settings at scale using Azure Policy, so that the desired configuration is automatically set when you request a new subscription. All you have to do is assign the policies below on the scope – a Management Group in this case – under which all subscriptions should have Microsoft Defender enabled automatically.

See below an overview of all the built-in policies that Microsoft has published for the various Microsoft Defender plans in Microsoft Defender for Cloud and the recommendation they resolve:

Note: With the November ’21 edition of Ignite, Microsoft has announced that several well-known security products will now go through life under a new name. Therefore, not all of the above products may look familiar to you. “Azure Security Center” (ASC) and “Azure Defender” are now jointly renamed “Microsoft Defender for Cloud”, while all “Azure Defender Plans” continue as “Microsoft Defender Plans”. As you can see in the table above, Microsoft has not yet renamed everything within Azure.
Learn more about the recent renaming of Microsoft security services.