how do I use Azure Policy to enable 'Agentless scanning for machines (preview)' setting for Defender for CSPM

Question

I cant seem to find a policy that enables the 'Agentless scanning for machines (preview)' setting in Defender for Cloud. How do i do it then?

Answer 1

To enable 'Agentless scanning for machines (preview)' setting for Defender for Cloud Security Posture Management (CSPM) using Azure Policy, you can follow these steps:

1. Open the Azure Portal and go to the Azure Policy service.
2. Click on the "Definitions" tab and click on the "Create definition" button.
3. Fill in the required fields for the new policy definition, such as the name, description, and category.
4. In the "Policy rule" section, click on the "Add condition" button and select "Microsoft Defender for Cloud Security Posture Management".
5. Select the "Agentless machine scan (Preview)" setting and set it to "Enabled".
6. Click on the "Review + create" button to review the policy definition and then click on "Create" to create the policy.
7. Assign the policy to the desired scope, such as a resource group or subscription.

After the policy is created and assigned, it will enforce the 'Agentless scanning for machines (preview)' setting for Defender for CSPM across the assigned scope. Note that it may take some time for the policy to take effect and for the setting to be enabled for all relevant resources.

Answer 2

Agentless scanning is available through both the Defender Cloud Security Posture Management (CSPM) plan and Defender for Servers P2 plan, and accordingly there are built-in Azure Policies to deploy and configure these plans for new and existing Subscriptions.

To enable Agentless scanning with Azure Policy:

(1) Create a new Initiative scoped to the tenant root group. Add one of these policies:

• Configure Microsoft Defender CSPM plan
  id: 72f8cee7-2937-403d-84a1-a4e3e57f3c21
• Configure Microsoft Defender for Servers plan
  id: 5eb6d64a-4086-4d7a-92da-ec51aed0332d

When creating the Initiative, it is important to review the Policy parameters section by unchecking the checkbox which says "Only show parameters that need input or review"! This is where you can configure the individual Defender features that you want. If you only want Agentless scanning, disable the others.

(2) Next, assign the Initiative to the tenant root group. It will create a Managed Identity with the role assignments required (Security Admin, User Access Administrator).

(3) Finally, you can create a Remediation Task that will apply the setting to existing Subscriptions. New Subscriptions will be enrolled automatically.

Before you use either of these, make sure you understand the cost of enabling Defender for Cloud plans and features on your Subscriptions!

I'm glad to see Copilot doesn't know everything about Azure Policy yet, so my job is safe!