azure-defender-disable-autoprovisioning
Write auto-provisioning settings (Microsoft.Security/autoProvisioningSettings/write); disabling auto-provisioning prevents automatic deployment of the Log Analytics agent and Microsoft Defender for Endpoint on newly created or reimaged VMs and Arc-connected machines, leaving them unmonitored by Defender for Cloud.
match (effective permission)
{
"action": "Microsoft.Security/autoProvisioningSettings/write",
"scope_type": "subscription"
}
where
principal effectively holds Security Admin, Contributor, Owner, or a custom role granting Microsoft.Security/autoProvisioningSettings/write at subscription scope
emit
| source type | Identity |
|---|---|
| target type | ConfigurationService |
| source | <principal> |
| target | <Defender auto-provisioning settings node (ConfigurationService) in the subscription> |
| permissions | Microsoft.Security/autoProvisioningSettings/write |
| state logic | ACTIVE when the effective permission is confirmed at subscription scope. BLOCKED if a deny assignment covers autoProvisioningSettings/write at effective scope. NOTE: Disabling auto-provisioning leaves newly deployed VMs unmonitored — they will not receive the Log Analytics agent or MDE agent until manually provisioned or the setting is re-enabled. This is a DETECTIVE-CONTROL tampering edge; it does not affect access controls or set BLOCKED on any resource-access edge. |
Narrative
{principal.name} can modify Defender auto-provisioning settings for subscription {target.name} (Microsoft.Security/autoProvisioningSettings/write). Disabling auto-provisioning prevents automatic installation of the Log Analytics agent and Microsoft Defender for Endpoint on newly created VMs and Arc-connected machines, leaving them unmonitored by Defender for Cloud until agents are manually provisioned.
Raw rule rules/derived/azure/defender.yaml
id: azure-defender-disable-autoprovisioning
emits: CanModify
description: Write auto-provisioning settings (Microsoft.Security/autoProvisioningSettings/write); disabling
auto-provisioning prevents automatic deployment of the Log Analytics agent and Microsoft Defender for
Endpoint on newly created or reimaged VMs and Arc-connected machines, leaving them unmonitored by Defender
for Cloud.
match_effective_permission:
action: Microsoft.Security/autoProvisioningSettings/write
scope_type: subscription
where:
- principal effectively holds Security Admin, Contributor, Owner, or a custom role granting Microsoft.Security/autoProvisioningSettings/write
at subscription scope
emit:
source_type: Identity
target_type: ConfigurationService
source: <principal>
target: <Defender auto-provisioning settings node (ConfigurationService) in the subscription>
permissions:
- Microsoft.Security/autoProvisioningSettings/write
conditions: []
state_logic: "ACTIVE when the effective permission is confirmed at subscription scope. BLOCKED if a\
\ deny assignment covers autoProvisioningSettings/write at effective scope. NOTE: Disabling auto-provisioning\
\ leaves newly deployed VMs unmonitored \u2014 they will not receive the Log Analytics agent or MDE\
\ agent until manually provisioned or the setting is re-enabled. This is a DETECTIVE-CONTROL tampering\
\ edge; it does not affect access controls or set BLOCKED on any resource-access edge."
confidence: 0.94
derived_from:
- HasPermission(Identity, ConfigurationService:autoProvisioningSettings, Microsoft.Security/autoProvisioningSettings/write)
false_positive_note: "autoProvisioningSettings/write allows modification of auto-provisioning policies\
\ for Log Analytics agents, MDE agents, and vulnerability assessment extensions. Disabling auto-provisioning\
\ affects only newly deployed resources; existing agents on already-deployed VMs are not removed.\
\ This is narrower in scope than pricings/write (which affects all resources of a type) but can be\
\ persistent \u2014 organizations disabling auto-provisioning must manually provision agents, increasing\
\ operational overhead and leaving a window of unmonitored deployments."
narrative: '{principal.name} can modify Defender auto-provisioning settings for subscription {target.name}
(Microsoft.Security/autoProvisioningSettings/write). Disabling auto-provisioning prevents automatic
installation of the Log Analytics agent and Microsoft Defender for Endpoint on newly created VMs and
Arc-connected machines, leaving them unmonitored by Defender for Cloud until agents are manually provisioned.'