Turning off Defender in Azure VM...won't stay off

Question

We have several Azure VMs (for the sake of argument, let's say 5), and at the Azure subscription level, Azure defender is turned off. Of the 5 VMs, 2 of them have "Microsoft Defender for Servers" OFF. 3 of them are ON:

When Azure Defender for Servers is ON, it adds an Audit and Extended event. We are trying to turn OFF Defender on the 3 servers, but something is automatically turning it back on. We want to turn off defender because we are trying to do some performance testing by turning off the Extended Event and Audit, but Defender keeps re-enabling them (the XE and Audit).

So, the question is, what might be turning Defender back on (how do we keep it off)?

Answer 1

Hi @Scott Klein ,

Thanks for contacting Microsoft Q&A.

Azure Security Center has security policies that can be set at various scopes, including subscription, resource group, and individual resource (e.g., VM). These policies can enforce certain security configurations, and they may override your manual settings. Here's what you can do:

a. Check Azure Security Center Policies: Go to the Azure Security Center in the Azure portal and review your security policies. Ensure that there are no policies at the subscription or resource group level that are automatically enabling Microsoft Defender for Servers.

b. Modify or Disable Policies: If you find policies that are affecting your VMs, you can modify or disable them as needed to prevent automatic re-enabling of Microsoft Defender for Servers.

Hope this helps you.