Enable File Integrity Monitoring in Microsoft Defender for Cloud

Sign in to the Microsoft Azure Portal.

Navigate to Microsoft Defender for Cloud available at https://portal.azure.com/#view/Microsoft_Azure_Security/SecurityMenuBlade/~/Overview.

In the left navigation panel, under Management, select Environment settings.

Select the Azure subscription that you want to examine from the Environment settings list.

In the left navigation panel, select Defender plans, then select Settings & monitoring.

On the Settings & monitoring page, ensure that Defender plans is set to All, then locate the row for File Integrity Monitoring and check the value set in the Status column:

- If the On/Off toggle button in the Status column is inactive, the Defender for Servers (Plan 2) subscription is not enabled for the selected subscription, so File Integrity Monitoring can't be turned on.

- If the toggle button is active and On is not selected, File Integrity Monitoring is not enabled for the selected Azure subscription.

- If On is selected, File Integrity Monitoring is enabled for the selected Azure subscription.

Repeat steps no. 4 – 6 for each Azure subscription available within your Microsoft Azure account.

Run account list command (Windows/macOS/Linux) to list all subscriptions in your Azure account:

az account list
--query '[*].[id,name]'
--output table

The command output should return a list of subscription IDs and names:

Id                                   Name
------------------------------------ ----------------------
12345678-1234-1234-1234-123456789abc  Production
87654321-4321-4321-4321-cba987654321  Development

For each subscription, run security pricing show command (Windows/macOS/Linux) with output query filters to check if File Integrity Monitoring is enabled:

az security pricing show
-n VirtualMachines
--subscription 12345678-1234-1234-1234-123456789abc
--query 'extensions[?name==`FileIntegrityMonitoring`].isEnabled | [0]'

The command output should return the File Integrity Monitoring enabled status:

True

If the output returns False, File Integrity Monitoring is not enabled for the selected Azure subscription.

Repeat steps no. 3 – 4 for each Azure subscription available within your Microsoft Azure account.

Sign in to the Microsoft Azure Portal.

Navigate to Microsoft Defender for Cloud available at https://portal.azure.com/#view/Microsoft_Azure_Security/SecurityMenuBlade/~/Overview.

In the left navigation panel, under Management, select Environment settings.

Select the Azure subscription that requires remediation (see Audit section to identify the right resource).

In the left navigation panel, select Defender plans, then select Settings & monitoring.

On the Settings & monitoring page, ensure that Defender plans is set to All, then locate the row for File Integrity Monitoring and check the Status column:

- If the On/Off toggle button in the Status column is inactive, ensure that Defender for Servers (Plan 2) is enabled for the selected subscription before proceeding.

- If the toggle button is active and On is not selected, select On to enable File Integrity Monitoring for the selected subscription.

Click Continue in the top left.

Click Save to apply the changes.

Wait for the configuration to complete. The File Integrity Monitoring component is now enabled for the selected subscription.

Repeat steps no. 4 – 9 for each Azure subscription available within your Microsoft Azure account.

Run monitor log-analytics workspace list command (Windows/macOS/Linux) to retrieve the Log Analytics workspace details required for File Integrity Monitoring configuration:

az monitor log-analytics workspace list
--query "[*].{id:id, name:name, resourceGroup:resourceGroup}"
--output table

From the output, note the resource group name and workspace name for the workspace you want to use with File Integrity Monitoring.

Run account set command (Windows/macOS/Linux) with the ID of the Azure cloud subscription that you want to configure as the identifier parameter, to set the selected subscription to be the current active subscription (see Audit section to identify the right subscription):

az account set
--subscription abcdabcd-1234-abcd-1234-abcdabcdabcd

Run security pricing create command (Windows/macOS/Linux) to enable File Integrity Monitoring for the VirtualMachines (Defender for Servers Plan 2) plan. File Integrity Monitoring requires a Log Analytics workspace ID and monitoring rules configuration. The following example enables FIM to monitor files in the /etc directory recursively:

az security pricing create
--name VirtualMachines
--tier Standard
--subplan P2
--extensions name=FileIntegrityMonitoring isEnabled=True additionalExtensionProperties='{"DefinedWorkspaceId":"/subscriptions/<subscription-id>/resourcegroups/<resource-group-name>/providers/microsoft.operationalinsights/workspaces/<workspace-name>","Rules":"[{\"ruleId\":\"<uuid>\",\"path\":\"<file-or-directory-path>\",\"isRecursive\":true,\"includeRegex\":\".*\",\"excludeRegex\":\"\"}]"}'

Replace the following placeholders:

- <subscription-id> — Your Azure subscription ID (from az account show --query id)

- <resource-group-name> — The resource group where the Log Analytics workspace resides (from Step 1 output)

- <workspace-name> — The name of your Log Analytics workspace (from Step 1 output)

- <uuid> — A unique identifier (GUID format, e.g., 12345678-1234-1234-1234-123456789abc — generate one using uuidgen command or an online UUID generator)

- <file-or-directory-path> — The file or directory path to monitor (e.g., /etc for Linux, C:\Windows\System32 for Windows)

The command output should confirm that File Integrity Monitoring is now enabled:

[
  {
    "isEnabled": "True",
    "name": "FileIntegrityMonitoring"
  }
]

Repeat steps no. 2 – 4 for each Azure subscription that requires File Integrity Monitoring in your Microsoft Azure account.