Information
Microsoft Defender for Resource Manager scans incoming administrative requests to change your infrastructure from both CLI and the Azure portal.
Rationale:
Scanning resource requests lets you be alerted every time there is suspicious activity in order to prevent a security threat from being introduced.
Impact:
Enabling Microsoft Defender for Resource Manager requires enabling Microsoft Defender for your subscription. Both will incur additional charges.
Solution
From Azure Portal
Go to Microsoft Defender for Cloud
Select Environment Settings blade
Click on the subscription name
Select the Defender plans blade
On the line in the table for Resource Manager Select On under Plan.
Select 'Save
From Azure CLI
Use the below command to enable Standard pricing tier for Defender for Resource Manager
az security pricing create -n 'Arm' --tier 'Standard'
From PowerShell
Use the below command to enable Standard pricing tier for Defender for Resource Manager
Set-AzSecurityPricing -Name 'Arm' -PricingTier 'Standard'
Default Value:
By default, Microsoft Defender for Resource Manager is not enabled.