azure-defender-disable-plan
Write the Defender pricing tier for a subscription (Microsoft.Security/pricings/write); setting any plan to 'Free' disables threat-detection for that resource type subscription-wide. This blinds Defender without altering any resource access controls.
match (effective permission)
[
{
"action": "Microsoft.Security/pricings/write",
"scope_type": "subscription"
},
{
"action": "Microsoft.Security/pricings/write",
"scope_type": "managementGroup"
}
]
where
principal effectively holds Security Admin, Contributor, Owner, or a custom role granting Microsoft.Security/pricings/write at subscription or management-group scope
emit
| source type | Identity |
|---|---|
| target type | SecurityService |
| source | <principal> |
| target | <Defender pricing tier node (SecurityService) for the target scope> |
| permissions | Microsoft.Security/pricings/write |
| state logic | ACTIVE when the effective permission is confirmed at subscription or management-group scope. BLOCKED if a deny assignment covers Microsoft.Security/pricings/write, or if an Azure Policy with a deny effect prevents the pricing-tier write. Security Reader and any role lacking pricings/write does NOT qualify. NOTE: This is a DETECTIVE-CONTROL tampering edge. It reduces visibility into threats; it does NOT grant access to resources protected by Defender plans, and MUST NOT chain to CanEnterSubscription, CanExecuteAs, or CanEscalateTo. Do not set BLOCKED on resource-access edges as a consequence — Defender plans are detective, not preventive. SCOPE: Subscription-scoped pricings/write affects a single subscription. Management-group scoped pricings/write cascades to all child subscriptions inheriting that scope — verify which subscriptions fall within the management-group hierarchy affected by the edge. |
Narrative
{principal.name} can write the Defender pricing tier for subscription {target.name} (Microsoft.Security/pricings/write). Setting any Defender plan to 'Free' disables threat-detection for that resource type subscription-wide - for example, turning off Defender for Servers eliminates anomalous-process, fileless-attack, and lateral-movement alerts for all VMs in the subscription. This is a cover-tracks primitive: it reduces SOC visibility without granting access to the underlying resources.
Raw rule rules/derived/azure/defender.yaml
id: azure-defender-disable-plan
emits: CanModify
description: Write the Defender pricing tier for a subscription (Microsoft.Security/pricings/write); setting
any plan to 'Free' disables threat-detection for that resource type subscription-wide. This blinds Defender
without altering any resource access controls.
match_effective_permission:
- action: Microsoft.Security/pricings/write
scope_type: subscription
- action: Microsoft.Security/pricings/write
scope_type: managementGroup
where:
- principal effectively holds Security Admin, Contributor, Owner, or a custom role granting Microsoft.Security/pricings/write
at subscription or management-group scope
emit:
source_type: Identity
target_type: SecurityService
source: <principal>
target: <Defender pricing tier node (SecurityService) for the target scope>
permissions:
- Microsoft.Security/pricings/write
conditions: []
state_logic: "ACTIVE when the effective permission is confirmed at subscription or management-group\
\ scope. BLOCKED if a deny assignment covers Microsoft.Security/pricings/write, or if an Azure Policy\
\ with a deny effect prevents the pricing-tier write. Security Reader and any role lacking pricings/write\
\ does NOT qualify. NOTE: This is a DETECTIVE-CONTROL tampering edge. It reduces visibility into threats;\
\ it does NOT grant access to resources protected by Defender plans, and MUST NOT chain to CanEnterSubscription,\
\ CanExecuteAs, or CanEscalateTo. Do not set BLOCKED on resource-access edges as a consequence \u2014\
\ Defender plans are detective, not preventive. SCOPE: Subscription-scoped pricings/write affects\
\ a single subscription. Management-group scoped pricings/write cascades to all child subscriptions\
\ inheriting that scope \u2014 verify which subscriptions fall within the management-group hierarchy\
\ affected by the edge."
confidence: 0.97
derived_from:
- HasPermission(Identity, SecurityService:pricings, Microsoft.Security/pricings/write)
false_positive_note: "pricings/write enables the caller to set pricingTier to \"Free\" for any Defender\
\ plan (Servers, Containers, StorageAccounts, KeyVaults, SqlServers, AppServices, Arm, Dns, CosmosDbs,\
\ DevOps, OpenSourceRelationalDatabases, etc.). Each plan disablement removes threat-detection for\
\ that resource type subscription-wide. At management-group scope the write can cascade to all child\
\ subscriptions (broader blast radius \u2014 note this in scope). Do NOT treat this as privilege escalation:\
\ an attacker who disables Defender for Servers has NOT gained access to those servers; they have\
\ only reduced the likelihood of detection. Confirm the principal's effective RBAC scope \u2014 pricings/write\
\ at resource-group scope does not exist (pricings is subscription-level only)."
narrative: "{principal.name} can write the Defender pricing tier for subscription {target.name} (Microsoft.Security/pricings/write).\
\ Setting any Defender plan to 'Free' disables threat-detection for that resource type subscription-wide\
\ \u2014 for example, turning off Defender for Servers eliminates anomalous-process, fileless-attack,\
\ and lateral-movement alerts for all VMs in the subscription. This is a cover-tracks primitive: it\
\ reduces SOC visibility without granting access to the underlying resources."