How to set Microsoft Defender (Security Center) settings via the Azure.ResourceManager SDK

Question

We have the following code that enables Microsoft Defender for Cloud for an Azure subscription using the Azure.ResourceManager C# SDK. However, when we view the settings for Defender in the Azure portal, a couple of items aren't turned on that we would like to be.

Under the Defender plan for "Servers", only "Endpoint protection" is turned on. We'd like to also turn on "Vulnerability assessment for machines" and "Agentless scanning for machines". And under the plan for "Databases", we want to turn on "Azure Monitoring Agent for SQL server on machines".

using Azure;
using Azure.Identity;
using Azure.ResourceManager;
using Azure.ResourceManager.Resources;
using Azure.ResourceManager.SecurityCenter;
using Azure.ResourceManager.SecurityCenter.Models;

public async Task<FrameworkData.Response<CloudResourceStatus?>> VerifySubscription(Request<Subscription> request)
{
    return await patterns.Try<CloudResourceStatus?>(request, async response =>
    {
        try
        {
            var subscriptionId = request.Value.Id.GetValueOrDefault();

            var subscriptionResource = await FetchSubscriptionResource(subscriptionId);

            // Ensure Microsoft Defender for Cloud is enabled for the services we use
            var standardTier = new SecurityCenterPricingTier("Standard");

            var services = new List<String>
            {
                "AppServices",
                "KeyVaults",
                "SqlServers",
                "SqlServerVirtualMachines",
                "StorageAccounts",
                "VirtualMachines",
            };

            foreach (var service in services)
            {
                var securityPricing = await subscriptionResource.GetSecurityCenterPricingAsync(service);
                var data = securityPricing.Value.Data;

                if (data.PricingTier is null || !data.PricingTier.Equals(standardTier))
                {
                    data.PricingTier = standardTier;
                    await securityPricing.Value.UpdateAsync(WaitUntil.Completed, data);
                }
            }

            return new() { State = CloudResourceStatus.States.Verified };
        }
        catch (Exception ex)
        {
            return new()
            {
                State = CloudResourceStatus.States.Error,
                Message = $"Unexpected exception. {ex.Message}",
            };
        }
    });
}

Answer 1

I am not familiar with using the SDK, but the recommended method is to use Azure policy. If you prefer to use the SDK, maybe look at the related policies as a reference. That may help to reveal additional options.

https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-storage-policy-enablement