Microsoft Defender for Cloud

Kubernetes data plane hardening

4 September 2026Doc update+15 / −8 lines

In brief

The article now explains Azure Policy for Kubernetes more precisely, describes resource-exclusion parameters, clarifies recommendation-based installation by cluster type, updates deployment links, and adds compliant and intentionally noncompliant workload examples.

What Defender admins need to know

Administrators can use the expanded guidance to configure Kubernetes hardening recommendations and validate workload security settings more effectively.

Summaries are generated from the documentation change itself.

Documentation change

View full page diff

View on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Configure Kubernetes data plane hardening in Defender for Cloud

Kubernetes data plane hardening helps enforce secure configurations for workloads running in your cluster, such as restricting privileged containers, enforcing resource limits, and limiting network access.

In Microsoft Defender for Cloud, data plane hardening is implemented by using Azure Policy for Kubernetes ~~for Kubernetes~~ to evaluate and enforce these configurations. Azure Policy is deployed as part of Defender for Containers when automatic provisioning is enabled.

If Azure Policy for Kubernetes is turned off in the Defender for Containers plan settings, you can deploy it by remediating the relevant recommendation. You can also deploy Azure Policy manually by using Azure CLI to deploy Defender for Containers components or Helm to deploy Defender for Containers components if you disabled automatic provisioning during enablement or excluded specific clusters from automatic provisioning.

After Azure Policy for Kubernetes is deployed, Defender for Cloud generates data plane hardening recommendations based on your cluster configuration. This page shows how to review these recommendations, configure policy parameters, and enforce them on your clusters.

Enable Azure Policy for Kubernetes by remediating recommendations

If Azure Policy for Kubernetes isn't deployed or was turned off in the Defender for Containers plan settings, you can install it by remediating the ~~relevant~~ recommendation that matches your cluster type in Defender for Cloud.

Configure policy parameters

Some recommendations include parameters that limit the Kubernetes resources evaluated by the underlying Azure Policy. For example, the policy for Immutable (read-only) root filesystem should be enforced for containers includes the excludedContainers, excludedImages, and excludedNamespaces parameters. Container exclusions match container names. Image exclusions support prefix matching when the value ends in *, such as myregistry.azurecr.io/istio:*. Use a fully qualified image name to avoid unintentionally excluding an image from an untrusted registry.

Other recommendations require parameter configuration to be effective. For example, the recommendation Container images should be deployed from trusted registries only requires you to define a list of trusted registries.

If required parameters aren't configured, resources are shown as unhealthy.

Compliant deployment example

The following deployment uses a trusted container registry, enforces CPU and memory limits, and applies a restrictive security context that disables privilege escalation and runs as a non-root user.

apiVersion: apps/v1
kind: Deployment

### Noncompliant deployment example

The following deployment intentionally violates multiple data plane hardening policies, including running a privileged container as root, enabling host networking and shared namespaces, and mounting a host path volume.

```yml
apiVersion: apps/v1
kind: Deployment
    targetPort: 9001

Learn moreRelated content

Deploy Defender for Containers components using Azure CLI

[!div class="nextstepaction"] Enable Defender for Containers in Microsoft Defender for Cloud

@@ -1,19 +1,20 @@ --- title: Kubernetes data plane hardening-description: Learn how to use Microsoft Defender for Cloud's set of Kubernetes data plane hardening security recommendations+description: Review Kubernetes data plane hardening recommendations in Microsoft Defender for Cloud, configure Azure Policy parameters, and enforce secure workload settings across your clusters. ms.topic: how-to-ms.date: 05/28/2026+ms.date: 08/07/2026 #customer intent: As a security administrator, I want to configure Kubernetes data plane hardening in Defender for Cloud so that I can enforce secure workload policies across clusters. ai-usage: ai-assisted+ms.custom: msecd-doc-authoring-1015 ---  # Configure Kubernetes data plane hardening in Defender for Cloud  Kubernetes data plane hardening helps enforce secure configurations for workloads running in your cluster, such as restricting privileged containers, enforcing resource limits, and limiting network access. -In Microsoft Defender for Cloud, data plane hardening is implemented by using [Azure Policy](defender-for-cloud-glossary.md#azure-policy-for-kubernetes) for Kubernetes to evaluate and enforce these configurations. Azure Policy is deployed as part of Defender for Containers when automatic provisioning is enabled.+In Microsoft Defender for Cloud, data plane hardening is implemented by using [Azure Policy for Kubernetes](defender-for-cloud-glossary.md#azure-policy-for-kubernetes) to evaluate and enforce these configurations. Azure Policy is deployed as part of Defender for Containers when automatic provisioning is enabled. -If Azure Policy for Kubernetes is turned off in the Defender for Containers plan settings, you can deploy it by remediating the relevant recommendation. You can also deploy Azure Policy manually by using [Azure CLI](defender-for-containers-deploy-azure-cli.md) or [Helm](deploy-helm.md) if you disabled automatic provisioning during enablement or excluded specific clusters from automatic provisioning.+If Azure Policy for Kubernetes is turned off in the Defender for Containers plan settings, you can deploy it by remediating the relevant recommendation. You can also deploy Azure Policy manually by using [Azure CLI to deploy Defender for Containers components](defender-for-containers-deploy-azure-cli.md) or [Helm to deploy Defender for Containers components](deploy-helm.md) if you disabled automatic provisioning during enablement or excluded specific clusters from automatic provisioning.  After Azure Policy for Kubernetes is deployed, Defender for Cloud generates data plane hardening recommendations based on your cluster configuration. This page shows how to review these recommendations, configure policy parameters, and enforce them on your clusters. @@ -29,7 +30,7 @@ To begin, make sure that:  ## Enable Azure Policy for Kubernetes by remediating recommendations -If Azure Policy for Kubernetes isn't deployed or was turned off in the Defender for Containers plan settings, you can install it by remediating the relevant recommendation in Defender for Cloud.+If Azure Policy for Kubernetes isn't deployed or was turned off in the Defender for Containers plan settings, you can install it by remediating the recommendation that matches your cluster type in Defender for Cloud.  1. Sign in to the [Azure portal](https://portal.azure.com). @@ -107,7 +108,9 @@ To view data plane hardening recommendations for a specific cluster:  ## Configure policy parameters -Some recommendations require parameter configuration to be effective. For example, the recommendation **Container images should be deployed from trusted registries only** requires you to define a list of trusted registries.+Some recommendations include parameters that limit the Kubernetes resources evaluated by the underlying Azure Policy. For example, the policy for **Immutable (read-only) root filesystem should be enforced for containers** includes the `excludedContainers`, `excludedImages`, and `excludedNamespaces` parameters. Container exclusions match container names. Image exclusions support prefix matching when the value ends in `*`, such as `myregistry.azurecr.io/istio:*`. Use a fully qualified image name to avoid unintentionally excluding an image from an untrusted registry.++Other recommendations require parameter configuration to be effective. For example, the recommendation **Container images should be deployed from trusted registries only** requires you to define a list of trusted registries.  If required parameters aren't configured, resources are shown as unhealthy. @@ -166,6 +169,8 @@ Deploy the following example YAML files to verify that compliant workloads are d  ### Compliant deployment example +The following deployment uses a trusted container registry, enforces CPU and memory limits, and applies a restrictive security context that disables privilege escalation and runs as a non-root user.+ ```yml apiVersion: apps/v1 kind: Deployment@@ -216,6 +221,8 @@ spec:  ### Noncompliant deployment example +The following deployment intentionally violates multiple data plane hardening policies, including running a privileged container as root, enabling host networking and shared namespaces, and mounting a host path volume.+ ```yml apiVersion: apps/v1 kind: Deployment@@ -273,7 +280,8 @@ spec:     targetPort: 9001 ``` -## Learn more+<a name="learn-more"></a>+## Related content  - [Deploy Defender for Containers components using Azure CLI](defender-for-containers-deploy-azure-cli.md) @@ -281,4 +289,3 @@ spec:  > [!div class="nextstepaction"] > [Enable Defender for Containers in Microsoft Defender for Cloud](defender-for-containers-enable-plan.md)-