Daily Defender News
Aboutmerill.net
Microsoft Defender for Cloud
Cloud and workloads

Enable Microsoft Defender for Azure Cosmos DB

4 September 2026Doc update+29 / −14 lines

In brief

The article now provides clearer prerequisite, portal, PowerShell, CLI, ARM template, and Azure Policy guidance. It also explains how to verify protection status and use sample alerts to test alerting, automation, and notification pipelines.

What Defender admins need to know

Administrators can more easily enable and validate Cosmos DB protection and its alert integrations.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Microsoft Defender for Azure Cosmos DB protection is available at both the subscription level and the resource level.

You can enable Microsoft Defender for Cloud on your subscription to protect all database types, including Microsoft Defender for Azure Cosmos DB. This optionEnabling protection at the subscription level is the recommended approach.

You can also enable Microsoft Defender for Azure Cosmos DB at the resource level to protect a specific Azure Cosmos DB account.

Prerequisites

Before you begin, make sure you have the following prerequisite:

Enable database protection at the subscription level

The subscription level enablement enablesEnable Microsoft Defender for Cloud protection forat the subscription level to protect all database types in your subscription (recommended).

You can enable Microsoft Defender for Cloud protection on your subscription to protect database types such as Azure Cosmos DB, Azure SQL Database, Azure SQL servers on machines, and open-source relational databases.

You can also select specific resource types to protect when you configure your plan.

When you enable Microsoft Defender for Cloud'sturn on enhanced security features onfor your subscription, Microsoft Defender for Azure Cosmos DB is automatically enabled for all of your Azure Cosmos DB accounts.

To enable database protection at the subscription level:

To select specific resource types to protect when you configure your plan:

  1. Repeat steps 1 through 4 in the previous procedure: signSign in to the Azure portal, goAzure portal.

  2. Navigate to Microsoft Defender for Cloud > Environment settings, select.

  3. Select the subscription,relevant subscription.

  4. Locate Databases and locatetoggle the switch to DatabasesOn.

  5. Select Select types

Enable Microsoft Defender for Azure Cosmos DB at the resource level

You can enable Microsoft Defender for CloudAzure Cosmos DB on a specific Azure Cosmos DB account throughby using the Azure portal, PowerShell, Azure CLI, an ARM template, or Azure Policy.

To enable Microsoft Defender for Cloud for a specific Azure Cosmos DB account:

Use one of the following methods.methods: Azure portal, PowerShell, ARM template, Azure CLI, or Azure Policy.

Azure portal

To enable Defender for Azure Cosmos DB from the Azure portal, perform the following steps:

  1. Sign in to the Azure portal.

  2. Navigate to your Azure Cosmos DB account > Settings.

PowerShell

To enable Defender for Azure Cosmos DB by using PowerShell, run the following steps:

  1. Install the Az.Security module.

  2. Call the Enable-AzSecurityAdvancedThreatProtection command. Enable-AzSecurityAdvancedThreatProtection -ResourceId "/subscriptions//resourceGroups/myResourceGroup/providers/Microsoft.DocumentDb/databaseAccounts/myCosmosDBAccount/"

  3. Verify the Microsoft Defender for Azure Cosmos DB setting for your Azure Cosmos DB account by usingcalling the Get-AzSecurityAdvancedThreatProtection command. 

    Get-AzSecurityAdvancedThreatProtection -ResourceId "/subscriptions/<Your subscription ID>/resourceGroups/myResourceGroup/providers/Microsoft.DocumentDb/databaseAccounts/myCosmosDBAccount/"

ARM template

Use an Azure Resource Manager template to deploy an Azure Cosmos DB account with Microsoft Defender for Azure Cosmos DB enabled. For more information,deployment details and a sample ARM template, see Create an Azure Cosmos DB account with Microsoft Defender for Azure Cosmos DB enabled.

Azure CLI

--is-enabled true


To check the Microsoftverify that Defender for Azure Cosmos DB setting for a single account via Azure CLI,is enabled on your account, call the [az security atp cosmosdb show](/cli/azure/security/atp/cosmosdb) command. This command displays the current protection state so you can confirm the feature is active. Remember to replace values in angle brackets with your own values:

```azurecli
az security atp cosmosdb show \

## Simulate security alerts from Microsoft Defender for Azure Cosmos DB

AFor a full list oflist, see [supported alerts](alerts-azure-cosmos-db.md) is available in the reference table of all Defender for Cloud security alerts.alert reference.

You can use sample Microsoft Defender for Azure Cosmos DB alerts to evaluatecheck alert quality and behavior.

Sample alerts also validate securityhelp you test alert configurations,settings, such as SIEM integrations,links, workflow automation, and email notifications.

Create sample alerts to verify that your alerting, automation, and notification pipelines work as expected.

**To create sample alerts from Microsoft Defender for Azure Cosmos DB**:


## Next steps

In this article, youYou learned how to enable Microsoft Defender for Azure Cosmos DB,DB and how to simulate security alerts.

> [!div class="nextstepaction"]
> [Automate responses to Microsoft Defender for Cloud triggers](workflow-automations.md).