Azure subscriptions should have Microsoft Defender for Azure Cosmos DB enabled
Microsoft Defender for Azure Cosmos DB is an Azure-native layer of security that detects attempts to exploit databases in your Azure Cosmos DB accounts. It detects potential SQL injections, known bad actors, and suspicious access patterns.
Without this protection, Cosmos DB activity lacks advanced threat detection and telemetry. Attacks such as SQL injection, credential abuse, and anomalous access patterns may go unnoticed, enabling data exfiltration and unauthorized changes, degrading confidentiality and integrity.
What this control checks
Defender for Azure Cosmos DB (CosmosDbs plan) is set to On, using the Standard pricing tier.
Common pitfalls
Defender for Databases needs four plans on Standard
Standard pricing must be enabled for SqlServers, SqlServerVirtualMachines, OpenSourceRelationalDatabases, and CosmosDbs.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definitions "Configure Microsoft Defender for Azure Cosmos DB to be enabled" (82bf5b87-728b-4a74-ba4d-6123845cf542) and "Microsoft Defender for Azure Cosmos DB should be enabled" (adbe85b5-83e6-4350-ab58-bf3a4f736e5e); Prowler checks defender_ensure_defender_for_cosmosdb_is_on (prowler azure --checks defender_ensure_defender_for_cosmosdb_is_on) and defender_ensure_defender_for_databases_is_on (prowler azure --checks defender_ensure_defender_for_databases_is_on); PowerPipe control azure_compliance.control.securitycenter_azure_defender_on_for_cosmosdb.
Framework-specific interpretation
SOC 2: Mapped to CC6.8 (The entity implements controls to prevent or detect and act upon the introduction of unauthorized or malicious software...) and CC7.1 (To meet its objectives, the entity uses detection and monitoring procedures to identify (1) changes to configurations...).
ISO/IEC 27001:2022: Mapped to A.5.25 (Assessment And Decision On Information Security Events), A.5.28 (Collection Of Evidence), A.8.7 (Protection Against Malware) and 1 more clause.
NIS2 Directive (EU 2022/2555): Mapped to 3.6.2 (The relevant entities shall ensure that post-incident reviews contribute to improving their approach to network and...) and 6.9.2 (For that purpose, the relevant entities shall in particular implement measures that detect or prevent the use of...).
Framework mappings
The clauses this control is mapped to in each framework.
- CC6.8: The entity implements controls to prevent or detect and act upon the introduction of unauthorized or malicious software to meet the entity's objectives.
- CC7.1: To meet its objectives, the entity uses detection and monitoring procedures to identify (1) changes to configurations that result in the introduction of new vulnerabilities, and (2) susceptibilities to newly discovered vulnerabilities.
- A.5.25 Assessment and decision on information security events
- A.5.28 Collection of evidence
- A.8.7 Protection against malware
- A.8.9 Configuration management
- 3 Incident handling
- 6 Security in network and information systems acquisition, development and maintenance
- 9.1.7.1 Ensure That Microsoft Defender for Azure Cosmos DB Is Set To 'On'
- 8.1.7.1 Ensure That Microsoft Defender for Azure Cosmos DB Is Set To 'On'
RBI Cyber Security Framework for UCBs
- Annex I (6)
- OPS-04.01B Policies and instructions with specifications for protection against malware are documented, communicated, and provided in accordance with SP-01 with respect to the following aspects: - Use of system-specific protection mechanisms;- Operating protection programmes on system components...
- 2.1.9 Ensure That Microsoft Defender for Cosmos DB Is Set To 'On'
- 2.1.3 Ensure That Microsoft Defender for Databases Is Set To 'On'
- 2.1.9 Ensure That Microsoft Defender for Azure Cosmos DB Is Set To 'On'
- 2.1.6 Ensure That Microsoft Defender for Azure Cosmos DB Is Set To 'On'
- 3.1.7.1 Ensure That Microsoft Defender for Azure Cosmos DB Is Set To 'On'
- 164.308(a)(1)(ii)(A) Risk analysis
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
securitycenter_azure_defender_on_for_cosmosdb - Powerpipe Control:
azure_compliance.control.securitycenter_azure_defender_on_for_cosmosdb - Prowler Checks:
defender_ensure_defender_for_cosmosdb_is_on,defender_ensure_defender_for_databases_is_on - Azure Policy Definitions:
82bf5b87-728b-4a74-ba4d-6123845cf542,adbe85b5-83e6-4350-ab58-bf3a4f736e5e
Last reviewed: 2026-10-14