Daily Defender News
Aboutmerill.net
Microsoft Defender for Cloud
Cloud and workloads

Disable and remove Defender for Containers

4 September 2026Doc update+47 / −6 lines

In brief

The documentation adds commands and procedures for disabling Defender for Containers and removing Defender components, extensions, Azure Policy integrations, and related AWS or GCP resources from AKS, EKS, GKE, and Arc-connected clusters. It also adds checks to confirm plans, extensions, and Defender pods are removed.

What Defender admins need to know

Administrators removing Defender for Containers can use the expanded procedures to complete cleanup and avoid leaving components behind or interrupting data collection by deleting runtime-protection resources prematurely.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Disable and remove Defender for Containers

This article explains how to disable Microsoft Defender for Containers and remove its components by environment.

Turning off the Defender for Containers plan or disabling automatic provisioning stops future deployments, but doesn't uninstall Defender components that are already deployed to clusters. ThoseDefender components already deployed to clusters are removed separately.

Disable Defender for Containers plan

To disable the Defender for Containers plan for the subscription that contains your AKS clusters:

  1. Sign in to the Azure portal.

  2. Go to Microsoft Defender for Cloud > Environment settings.

Remove Defender extensions from AKS clusters

After disabling the plan, remove the Defender-related components from each AKS cluster.

Remove the Defender for Containers profile from the AKS cluster

Run the following command to remove the Defender for Containers profile from the AKS cluster: 

az aks update \
  --name <cluster-name> \

### Disable Azure Policy add-on

If Azure Policy was enabled for this cluster, run the following command to disable the add-on:

```azurecli
az aks disable-addons \
  --addons azure-policy \

## Verify removal

Use the following checks to confirm that Defender for Containers has been fully removed from your AKS cluster.

### Check AKS cluster pods

Run the following command to check all namespaces for remaining Defender pods and confirm that the uninstall completed successfully:

```bash
kubectl get pods -A | grep defender

Verify plan status

Run the following command to confirm that the Containers plan is disabled for the subscription:

az security pricing show --name 'Containers'

Remove the Defender extension

Run the following command to remove the Defender extension from the connected EKS cluster: 

az k8s-extension delete \
  --name microsoft.azuredefender.kubernetes \

### Remove the Azure Policy extension (if installed)

If the Azure Policy extension is installed on the EKS cluster, run the following command to remove it:

```azurecli
az k8s-extension delete \
  --name azurepolicy \

## Disable Defender for Containers plan on the AWS connector

To disable the Defender for Containers plan on the AWS connector:

1. Sign in to the [Azure portal](https://portal.azure.com).

1. Go to **Microsoft Defender for Cloud** > **Environment settings**.

## Remove AWS resources created for runtime protection (optional)

Remove these resourcesthe S3 bucket, SQS queue, and Kinesis Data Firehose delivery stream only if runtime threat protection for EKS was enabled and you no longer use Defender for Containers for that cluster.

- [Delete the S3 bucket created for the cluster](https://docs.aws.amazon.com/AmazonS3/latest/userguide/delete-bucket.html).

- [Delete the Kinesis Data Firehose delivery stream created for the cluster](https://docs.aws.amazon.com/firehose/latest/APIReference/API_DeleteDeliveryStream.html).

Remove AWS IAM roles and identity providers (optional)

Check Azure Arc extensions

Run the following command to list the installed Arc extensions for your cluster and confirm that the Defender extension is no longer present: 

az k8s-extension list \
  --cluster-type connectedClusters \

### Check EKS cluster pods

Run the following command to verify that no Defender pods remain in the `mdc` namespace on your EKS cluster:

```bash
kubectl get pods -n mdc

Remove Defender extensions from GKE clusters

Use the following steps to remove Defender-related extensions from the GKE cluster.

Remove the Defender extension

Run the following command to delete the Microsoft Defender for Containers extension from your Arc-connected GKE cluster: 

az k8s-extension delete \
  --name microsoft.azuredefender.kubernetes \

### Remove the Azure Policy extension (if installed)

Azure Policy is installed as a separate Arc extension on the cluster. If it was deployed, delete it to fully remove Defender-related cluster integrations:

```azurecli
az k8s-extension delete \
  --name azurepolicy \

## Disable Defender for Containers plan on the GCP connector

To disable the Defender for Containers plan for the GCP connector:

1. Sign in to the [Azure portal](https://portal.azure.com).

1. Go to **Microsoft Defender for Cloud** > **Environment settings**.

## Delete the GCP connector (optional)

If you no longer need the GCP connector, use the following steps to delete it:

1. Go to **Microsoft Defender for Cloud** > **Environment settings**.

1. Find your GCP connector.

## Remove GCP resources created for runtime protection (optional)

Remove the Pub/Sub topic and subscription and the Cloud Logging sink only if runtime threat protection for GKE was enabled and you no longer use Defender for Containers for that project.

- Delete the Pub/Sub topic and subscription that use the `MicrosoftDefender-` prefix.

* `MDCGkeClusterWriteRole`

Verify removal

Check Azure Arc extensions

Run the following command to confirm that the Defender extension is no longer installed on the GKE cluster: 

az k8s-extension list \
  --cluster-type connectedClusters \

### Check GKE cluster pods

Run the following command to verify that the `mdc` namespace no longer contains any Defender pods on your GKE cluster:

```bash
kubectl get pods -n mdc

Check Arc-enabled cluster pods

Run the following command to verify that no Defender pods remain in the mdc namespace on your Arc-enabled cluster:

kubectl get pods -n mdc