Microsoft Defender for Cloud policy assignments should have enforcement mode set to Default
Defender for Cloud default policy assignment (`SecurityCenterBuiltIn`) uses enforcement mode `Default` rather than `DoNotEnforce`. With `DoNotEnforce`, policy effects like `deny` and `deployIfNotExists` aren't applied.
With DoNotEnforce, policy effects like deny and deployIfNotExists aren't applied, letting insecure configs persist. This erodes confidentiality and integrity (exposed endpoints, weak encryption) and can affect availability via unpatched or misconfigured services, enabling compromise and lateral movement.
What this control checks
SecurityCenterBuiltIn uses enforcement mode Default rather than DoNotEnforce
Audit evidence
Evidence that deployed resources meet this control: Prowler check policy_ensure_asc_enforcement_enabled (prowler azure --checks policy_ensure_asc_enforcement_enabled).
Framework-specific interpretation
PCI DSS v4.0: Mapped to 10.2.1.1 (Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of...), 10.4.1 (Audit logs are reviewed to identify anomalies or suspicious activity.), 10.4.1.1 (Audit logs are reviewed to identify anomalies or suspicious activity.) and 6 more clauses.
Framework mappings
The clauses this control is mapped to in each framework.
- 10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- 10.4.1: Audit logs are reviewed to identify anomalies or suspicious activity.
- 10.4.1.1: Audit logs are reviewed to identify anomalies or suspicious activity.
- 10.4.2: Audit logs are reviewed to identify anomalies or suspicious activity.
- 10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
4 more clauses
- 10.7.1: Failures of critical security control systems are detected, reported, and responded to promptly.
- 10.7.2: Failures of critical security control systems are detected, reported, and responded to promptly.
- A3.3.1: PCI DSS is incorporated into business-as-usual (BAU) activities.
- A3.5.1: Suspicious events are identified and responded to.
- 9.1.11 Ensure that Microsoft Cloud Security Benchmark policies are not set to 'Disabled'
- 8.1.11 Ensure that Microsoft Cloud Security Benchmark policies are not set to 'Disabled'
- 2.1.14 Ensure Any of the ASC Default Policy Settings are Not Set to 'Disabled'
- 2.1.13 Ensure that Microsoft Cloud Security Benchmark policies are not set to 'Disabled'
- 3.1.11 Ensure that Microsoft Cloud Security Benchmark policies are not set to 'Disabled'
- 164.308(a)(1)(ii)(A) Risk analysis
- 164.308(a)(8) Evaluation
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
azure_policy_ensure_asc_enforcement_enabled - Prowler Check:
policy_ensure_asc_enforcement_enabled
Last reviewed: 2026-10-11