Microsoft Defender for Cloud
Architecture and deploymentDeploy Defender Sensor and Azure Policy to Clusters Using Azure CLI - Microsoft Defender for Cloud | Microsoft Learn
In brief
The article now uses clearer wording for deploying the Defender sensor and Azure Policy, verifying automatic provisioning, Azure Arc extensions, RBAC permissions, and GKE Autopilot resource limits. Step numbering and title capitalization were also updated.
What Defender admins need to know
Administrators should find the deployment and verification instructions easier to follow. No action is required.
Summaries are generated from the documentation change itself.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
Deploy Defender sensorSensor and Azure Policy to clusters usingClusters Using Azure CLI - Microsoft Defender for Cloud | Microsoft Learn
This article explains how toYou can deploy the Microsoft Defender for Containers sensor and Azure Policy for Kubernetes to clusters by using Azure CLI afterCLI. First, enable the Defender for Containers plan in Microsoft Defender for Cloud.
For clusters that aren’aren't running in Azure Kubernetes Service (AKS), Defender for Cloud uses Azure Arc-enabled Kubernetes to deploy the required extensions.
Before you begin, review the prerequisites for your cluster type, including enabling the Defender for Containers plan, installing Azure CLI 2.40.0 or later, and meeting any Azure Arc connectivity requirements.
Azure Kubernetes Service (AKS)
Prerequisites
- Defender for Containers enabled on your Azure subscription.
- Azure CLI version 2.40.0 or later.
- Appropriate RBAC
permissions (Contributorpermissions: Contributor or SecurityAdmin).Admin. - AKS cluster supported by Defender for Containers. See the support matrix.
- An OpenId Connect (OIDC) issuer enabled on your cluster.
Deploy the Defender sensor
If you enabled automatic provisioning was enabled when you turned on the Defender for Containers plan, the Defender sensor might already be installed. Before you run the following command, verify whether the deployment is already complete before running this command..
Deploy the Defender sensor to a specific AKS cluster:
--name
--enable-defenderEnable Azure Policy for Kubernetes to assess and enforce configuration best practices:
az aks enable-addons \
Deploy the Defender sensor
For EKS clusters, you deploy Defender components as Azure Arc Kubernetes extensions when you manually deploy them by using Azure CLI.
If you enabled automatic provisioning when you turned on the Defender for Containers plan, the Defender sensor might already be installed. Before you run the following command, verify whether the deployment is already complete before running these commands..
Run the following command to deploy the Defender sensor extension to your Arc-connected EKS cluster:
For Autopilot clusters:
- The Defender sensor automatically adjusts resource requests.
No manual configuration is needed forYou don't need to configure resource limits.
Important
In GKE Autopilot clusters, you can't manually configure resource requests and limits for the Defender sensorsensor. GKE Autopilot controls resource management and you can't be manually configured. Resource management is controlled by GKE Autopilot and can't be overridden.override it.
Deploy the Defender sensor
For GKE clusters, you deploy Defender components are deployed as Azure Arc Kubernetes extensions when you manually deploy them manuallyby using Azure CLI.
If you enabled automatic provisioning was enabled when you turned on the Defender for Containers plan, the Defender sensor might already be installed. Before you run the following command, verify whether the deployment is already complete before running this command..
Run the following command to install the Defender sensor extension on your Arc-connected GKE cluster:
For Arc-enabled Kubernetes clusters, Defender components are deployed as Azure Arc Kubernetes extensions.
If you enabled automatic provisioning was enabled when you turned on the Defender for Containers plan, the Defender sensor might already be installed. Before you run the following command, verify whether the deployment is already complete before running this command..
Run the following command to install the Defender sensor extension on your Arc-enabled Kubernetes cluster:
@@ -1,6 +1,6 @@ --- layout: Conceptual-title: Deploy Defender sensor and Azure Policy to clusters using Azure CLI - Microsoft Defender for Cloud | Microsoft Learn+title: Deploy Defender Sensor and Azure Policy to Clusters Using Azure CLI - Microsoft Defender for Cloud | Microsoft Learn canonicalUrl: https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-containers-deploy-azure-cli breadcrumb_path: /azure/breadcrumb/defender-for-cloud/toc.json feedback_help_link_url: https://techcommunity.microsoft.com/t5/microsoft-defender-for-cloud/bd-p/MicrosoftDefenderCloud@@ -34,29 +34,27 @@ item_type: Content source_path: defender-for-cloud/defender-for-containers-deploy-azure-cli.md cmProducts: - https://authoring-docs-microsoft.poolparty.biz/devrel/8e3fdb08-a059-4277-98f6-c0e21e940707-- https://authoring-docs-microsoft.poolparty.biz/devrel/089c8ba6-d135-43ff-bfaf-b8197fb72fb9 - https://authoring-docs-microsoft.poolparty.biz/devrel/d44a5346-5de4-439c-b804-7b2a536cbb55+- https://authoring-docs-microsoft.poolparty.biz/devrel/089c8ba6-d135-43ff-bfaf-b8197fb72fb9 spProducts: - https://authoring-docs-microsoft.poolparty.biz/devrel/88291526-9c74-4f87-878c-de0a82134421-- https://authoring-docs-microsoft.poolparty.biz/devrel/32516e21-6665-416f-be21-413febe47d91 - https://authoring-docs-microsoft.poolparty.biz/devrel/da41a22b-b7a0-42d3-9c35-50da1c2b7b87+- https://authoring-docs-microsoft.poolparty.biz/devrel/32516e21-6665-416f-be21-413febe47d91 platformId: ef3984b6-6ae6-0985-2ee8-baa02fa13243 --- -# Deploy Defender sensor and Azure Policy to clusters using Azure CLI - Microsoft Defender for Cloud | Microsoft Learn+# Deploy Defender Sensor and Azure Policy to Clusters Using Azure CLI - Microsoft Defender for Cloud | Microsoft Learn -This article explains how to deploy the Microsoft Defender for Containers sensor and Azure Policy for Kubernetes to clusters by using Azure CLI after [enabling the Defender for Containers plan in Microsoft Defender for Cloud](defender-for-containers-enable-plan).
-
-For clusters that aren’t running in Azure Kubernetes Service (AKS), Defender for Cloud uses Azure Arc-enabled Kubernetes to deploy the required extensions.
+You can deploy the Microsoft Defender for Containers sensor and Azure Policy for Kubernetes to clusters by using Azure CLI. First, enable [the Defender for Containers plan in Microsoft Defender for Cloud](defender-for-containers-enable-plan).
-Before you begin, review the prerequisites for your cluster type, including enabling the Defender for Containers plan, installing Azure CLI 2.40.0 or later, and meeting any Azure Arc connectivity requirements.
+For clusters that aren't running in Azure Kubernetes Service (AKS), Defender for Cloud uses Azure Arc-enabled Kubernetes to deploy the required extensions.
# [Azure Kubernetes Service (AKS)](#tab/aks)
## Prerequisites
- [Defender for Containers enabled on your Azure subscription](defender-for-containers-enable-plan?tab=aks).
- Azure CLI version 2.40.0 or later.
-- Appropriate RBAC permissions (Contributor or Security Admin).
+- Appropriate RBAC permissions: Contributor or Security Admin.
- AKS cluster supported by Defender for Containers. See the [support matrix](support-matrix-defender-for-containers).
- [An OpenId Connect (OIDC) issuer](/en-us/azure/aks/use-oidc-issuer) enabled on your cluster.
@@ -80,7 +78,7 @@ For instructions, see [Microsoft Security Private Link for Microsoft Defender fo
## Deploy the Defender sensor
-If automatic provisioning was enabled when you turned on the Defender for Containers plan, the Defender sensor might already be installed. [Verify the deployment](defender-for-containers-verify-deployment) before running this command.
+If you enabled automatic provisioning when you turned on the Defender for Containers plan, the Defender sensor might already be installed. Before you run the following command, [verify whether the deployment is already complete](defender-for-containers-verify-deployment).
1. Deploy the Defender sensor to a specific AKS cluster:
@@ -90,8 +88,7 @@ If automatic provisioning was enabled when you turned on the Defender for Contai --name <aks-cluster-name> \
--enable-defender
```
-
-1. Enable Azure Policy for Kubernetes to assess and enforce configuration best practices:
+2. Enable Azure Policy for Kubernetes to assess and enforce configuration best practices:
```azurecli
az aks enable-addons \
@@ -124,9 +121,9 @@ You also need to validate the [Azure Arc-enabled Kubernetes network requirements
## Deploy the Defender sensor
-For EKS clusters, Defender components are deployed as Azure Arc Kubernetes extensions when you deploy them manually using Azure CLI.
+For EKS clusters, you deploy Defender components as Azure Arc Kubernetes extensions when you manually deploy them by using Azure CLI.
-If automatic provisioning was enabled when you turned on the Defender for Containers plan, the Defender sensor might already be installed. [Verify the deployment](defender-for-containers-verify-deployment) before running these commands.
+If you enabled automatic provisioning when you turned on the Defender for Containers plan, the Defender sensor might already be installed. Before you run the following command, [verify whether the deployment is already complete](defender-for-containers-verify-deployment).
Run the following command to deploy the Defender sensor extension to your Arc-connected EKS cluster:
@@ -200,17 +197,17 @@ No special configuration is required. Follow the deployment steps in the Deploy For Autopilot clusters:
- The Defender sensor automatically adjusts resource requests.
-- No manual configuration is needed for resource limits.
+- You don't need to configure resource limits.
Important
-In GKE Autopilot clusters, resource requests and limits for the Defender sensor can't be manually configured. Resource management is controlled by GKE Autopilot and can't be overridden.
+In GKE Autopilot clusters, you can't manually configure resource requests and limits for the Defender sensor. GKE Autopilot controls resource management and you can't override it.
## Deploy the Defender sensor
-For GKE clusters, Defender components are deployed as Azure Arc Kubernetes extensions when you deploy them manually using Azure CLI.
+For GKE clusters, you deploy Defender components as Azure Arc Kubernetes extensions when you manually deploy them by using Azure CLI.
-If automatic provisioning was enabled when you turned on the Defender for Containers plan, the Defender sensor might already be installed. [Verify the deployment](defender-for-containers-verify-deployment) before running this command.
+If you enabled automatic provisioning when you turned on the Defender for Containers plan, the Defender sensor might already be installed. Before you run the following command, [verify whether the deployment is already complete](defender-for-containers-verify-deployment).
Run the following command to install the Defender sensor extension on your Arc-connected GKE cluster:
@@ -262,7 +259,7 @@ You also need to validate the [Azure Arc-enabled Kubernetes network requirements
For Arc-enabled Kubernetes clusters, Defender components are deployed as Azure Arc Kubernetes extensions.
-If automatic provisioning was enabled when you turned on the Defender for Containers plan, the Defender sensor might already be installed. [Verify the deployment](defender-for-containers-verify-deployment) before running this command.
+If you enabled automatic provisioning when you turned on the Defender for Containers plan, the Defender sensor might already be installed. Before you run the following command, [verify whether the deployment is already complete](defender-for-containers-verify-deployment).
Run the following command to install the Defender sensor extension on your Arc-enabled Kubernetes cluster: