Other Articles

Cosmos DB – Enable Microsoft Defender

This check ensures that Microsoft Defender is enabled for Azure Cosmos DB accounts to provide continuous threat detection, anomaly monitoring, and protection against malicious database activities.

Check Details

  • Resource: Azure Cosmos DB Account
  • Check: Ensure Microsoft Defender Is Enabled
  • Risk: If Microsoft Defender is not enabled, Cosmos DB accounts may lack advanced threat protection, anomaly detection, and monitoring capabilities, increasing the risk of unauthorized access, data exfiltration, and undetected malicious activity.

Remediation via Azure Portal

  1. Log in to the Azure Portal. Azure Portal dashboard
  2. Navigate to Microsoft Defender for Cloud. Microsoft Defender for Cloud overview
  3. Select Environment settings under Management. Microsoft Defender Environment Settings
  4. Choose the appropriate Subscription.
  5. Under Defender plans, locate Azure Cosmos DB under Databases. Microsoft Defender plans
  6. Ensure the Defender plan for Azure Cosmos DB is set to On. Defender plan for Cosmos DB
  7. Click Save to apply the configuration.

Remediation via Azure CLI

  1. Open Azure Cloud Shell or a local terminal with Azure CLI installed. Azure Cloud Shell
  2. Enable Microsoft Defender plan for Azure Cosmos DB: 
    az security pricing create \
 --name CosmosDbs \
 --tier standard
  3. Verify Defender plan status: 
    az security pricing show \
 --name CosmosDbs \
 --query pricingTier

The output should return "Standard", which confirms that Microsoft Defender for Azure Cosmos DB is enabled.