Azure subscriptions should have Microsoft Defender for Cloud pricing set to Standard
This control checks whether Security center pricing is set to standard. It is non-compliant if pricing is set to free. The result depends on the pricing value: standard is the expected setting, and free is the setting that causes a failure.
To benefit from Azure Defender you should use the Standard subscription tier. Enabling Azure Defender extends the capabilities of the free mode to workloads running in private and other public clouds, providing unified security management and threat protection across your hybrid cloud workloads.
What this control checks
Security Center pricing tier must be Standard; Free fails.
Audit evidence
Evidence that deployed resources meet this control: PowerPipe control azure_compliance.control.securitycenter_pricing_standard.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_AZURE_19; KICS query "Security Center Pricing Tier Is Not Standard" (819d50fd-1cdf-45c3-9936-be408aaad93e); Trivy check AZU-0045.
Related controls
- ASC Default policy settings should not have any setting set to 'Disabled'
- Azure subscriptions should have Microsoft Defender for APIs set to 'On'
- Microsoft Defender for Cloud settings should have 'Additional email addresses' configured with a security contact email
- Running container images should have no unresolved vulnerabilities
- Virtual machines should have a vulnerability assessment solution enabled
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
securitycenter_pricing_standard - Checkov Check:
CKV_AZURE_19 - Powerpipe Control:
azure_compliance.control.securitycenter_pricing_standard - KICS Query:
819d50fd-1cdf-45c3-9936-be408aaad93e - Trivy Check:
AZU-0045
Last reviewed: 2026-10-15