Onboard agentless containers for CSPM

Enable agentless container posture in Defender CSPM to gain visibility into Kubernetes clusters and container images without deploying agents.

Agentless container posture is available for Azure, AWS, and GCP environments.

Prerequisites

• Defender CSPM plan is enabled for your environment.

How to onboard agentless container posture in Defender CSPM

Azure

1. Sign in to the Azure portal.

2. Go to Microsoft Defender for Cloud > Environment settings.

3. Select the relevant subscription.

4. Under Defender plans, locate Defender CSPM.

5. Select Settings.

6. Enable the following settings:

   • Kubernetes API access
   • Registry access

7. Select Continue.

8. Select Save.

AWS

1. Sign in to the Azure portal.

2. Go to Microsoft Defender for Cloud > Environment settings.

3. Select the relevant AWS connector.

4. Under Defender plans, locate Defender CSPM.

5. Select Settings.

6. Enable the following settings:

   • Kubernetes API access
   • Registry access

   

7. Select Continue.

8. Select Save.

9. Select Next: Configure access.

10. Redeploy the CloudFormation or Terraform template.

11. Select Next: Review and generate.

12. Select Update.

GCP

1. Sign in to the Azure portal.

2. Go to Microsoft Defender for Cloud > Environment settings.

3. Select the relevant GCP connector.

4. Under Defender plans, locate Defender CSPM.

5. Select Settings.

6. Enable the following settings:

   • Kubernetes API access
   • Registry access

   

7. Select Continue.

8. Select Save.

9. Select Next: Configure access.

10. Redeploy the Cloud Shell or Terraform template.

11. Select Next: Review and generate.

12. Select Update.

Note

Kubernetes API access uses AKS trusted access. For more information about AKS trusted access, see Enable Azure resources to access Azure Kubernetes Service (AKS) clusters using Trusted Access.

Related content

• Enable Defender CSPM

• Agentless container posture capabilities

• View and remediate vulnerability assessment findings for registry images

• View and remediate vulnerabilities for images running on AKS clusters