Enable Azure Defender for Virtual Machine Servers

01 Sign in to the Azure Management Console.

02 Navigate to Azure Security Center blade at https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/.

03 In the blade navigation panel, under Management, choose Pricing & Settings.

04 On the Pricing & Settings page, click on the name of the Azure subscription that you want to examine, to access the Azure Security Center pricing and settings.

05 In the left navigation panel, under Settings, choose Azure Defender plans to view the Azure Defender pricing plans available for your subscription.

06 Select Azure Defender on to make sure that the security feature is enabled for the selected subscription, and check the Azure Defender pricing plan status for Servers, available in the Plan column. If the pricing plan status for Servers is set to Off, Azure Defender is not enabled for the Azure virtual machine (VM) servers provisioned in the selected subscription.

07 Repeat step no. 4 – 6 for each Microsoft Azure subscription available within your cloud account.

01 Run account get-access-token command (Windows/macOS/Linux) with custom query filters to describe the name of the Azure Defender pricing plan configured for Azure virtual machines (VMs) within the current subscription:

az account get-access-token
  --query "{subscription:subscription,accessToken:accessToken}"
  --out tsv | xargs -L1 bash -c 'curl -X GET -H "Authorization: Bearer $1" -H "Content-Type: application/json" https://management.azure.com/subscriptions/$0/providers/Microsoft.Security/pricings?api-version=2018-06-01' | jq '.|.value[] | select(.name=="VirtualMachines")'|jq '.properties.pricingTier'

02 The command output should return the name of the configured pricing tier:

"Free"

03 Repeat step no. 1 and 2 for each Microsoft Azure subscription available in your cloud account.

01 Sign in to the Azure Management Console.

02 Navigate to Azure Security Center blade at https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/.

03 In the blade navigation panel, under Management, choose Pricing & Settings.

04 On the Pricing & Settings page, click on the name of the Azure cloud subscription that you want to access.

05 In the left navigation panel, under Settings, choose Azure Defender plans to view the Azure Defender pricing plans available for the selected subscription.

06 Select Azure Defender on to make sure that the security feature is enabled for your subscription, then choose On for the Servers pricing plan listed in the Plan column, to enable Azure Defender for Azure virtual machine (VM) servers. Choose Save from the blade main menu to apply the changes.

07 Repeat step no. 4 – 6 for each Microsoft Azure subscription available within your cloud account.

01 Define the specifications required for the account get-access-token command, where the Azure Defender pricing plan for the Azure virtual machines is enabled by setting the feature pricing tier to "Standard". Replace the highlighted information, i.e. <azure-subscription-id>, with your own Azure subscription ID and save the following content to a JSON file named enable-defender-for-vm-servers.json:

{
  "id": "/subscriptions/<azure-subscription-id>/providers/Microsoft.Security/pricings/VirtualMachines",
  "name": "VirtualMachines",
  "type": "Microsoft.Security/pricings",
  "properties": {
    "pricingTier": "Standard"
  }
}

02 Run account get-access-token command (Windows/macOS/Linux) using the specifications defined at the previous step (i.e. enable-defender-for-vm-servers.json file) to turn on Azure Defender for Azure virtual machine (VM) servers in the selected subscription:

az account get-access-token
  --query "{subscription:subscription,accessToken:accessToken}"
  --out tsv | xargs -L1 bash -c 'curl -X PUT -H "Authorization: Bearer $1" -H "Content-Type: application/json" https://management.azure.com/subscriptions/$0/providers/Microsoft.Security/pricings/VirtualMachines?api-version=2018-06-01 -d@"enable-defender-for-vm-servers.json"'

03 The command output should return the information available for the enabled pricing tier:

{
  "id": "/subscriptions/<azure-subscription-id>/providers/Microsoft.Security/pricings/VirtualMachines",
  "name": "VirtualMachines",
  "type": "Microsoft.Security/pricings",
  "properties": {
  "pricingTier": "Standard",
  "freeTrialRemainingTime": "PT0S"
  }
}

04 Repeat steps no. 1 – 3 for each Microsoft Azure subscription available in your cloud account.