Security Center should have Windows Defender ATP (WDATP) integration selected
Prowler check defender_ensure_wdatp_is_enabled checks that the Azure subscription integrates Microsoft Defender for Endpoint with Defender for Cloud via WDATP. The setting's presence and enabled state at the subscription scope are evaluated.
Without this integration, servers lack EDR telemetry, automated onboarding, and unified alerts, shrinking visibility. Hands-on-keyboard intrusions, ransomware, and credential theft can persist unnoticed, enabling data exfiltration (confidentiality), unauthorized changes (integrity), and outages (availability).
What this control checks
Defender for Endpoint (WDATP) integration with Defender for Cloud is enabled at subscription scope
Audit evidence
Evidence that deployed resources meet this control: Prowler check defender_ensure_wdatp_is_enabled (prowler azure --checks defender_ensure_wdatp_is_enabled); PowerPipe control azure_compliance.control.securitycenter_wdatp_integration.
Framework-specific interpretation
SOC 2: Mapped to CC6.8 (The entity implements controls to prevent or detect and act upon the introduction of unauthorized or malicious software...) and CC7.1 (To meet its objectives, the entity uses detection and monitoring procedures to identify (1) changes to configurations...).
NIS2 Directive (EU 2022/2555): Mapped to 3.6.2 (The relevant entities shall ensure that post-incident reviews contribute to improving their approach to network and...) and 6.9.2 (For that purpose, the relevant entities shall in particular implement measures that detect or prevent the use of...).
Framework mappings
The clauses this control is mapped to in each framework.
- CC6.8: The entity implements controls to prevent or detect and act upon the introduction of unauthorized or malicious software to meet the entity's objectives.
- CC7.1: To meet its objectives, the entity uses detection and monitoring procedures to identify (1) changes to configurations that result in the introduction of new vulnerabilities, and (2) susceptibilities to newly discovered vulnerabilities.
- 3 Incident handling
- 6 Security in network and information systems acquisition, development and maintenance
- 9.1.3.3 Ensure that 'Endpoint protection' component status is set to 'On'
- 8.1.3.3 Ensure that 'Endpoint protection' component status is set to 'On'
RBI Cyber Security Framework for UCBs
- Annex I (7.4)
- OPS-04.01B Policies and instructions with specifications for protection against malware are documented, communicated, and provided in accordance with SP-01 with respect to the following aspects: - Use of system-specific protection mechanisms;- Operating protection programmes on system components...
- OPS-23.01B The cloud service provider regularly measures, analyses and assesses the procedures with which vulnerabilities and incidents are handled to verify their continued suitability, appropriateness and effectiveness.
- 2.9 Ensure that Windows Defender ATP (WDATP) integration with Security Center is selected
- 2.9 Ensure that Microsoft Defender for Endpoint (WDATP) integration with Microsoft Defender for Cloud is selected
- 2.4.2 Ensure that Microsoft Defender for Endpoint integration with Microsoft Defender for Cloud is selected
- 2.1.22 Ensure that Microsoft Defender for Endpoint integration with Microsoft Defender for Cloud is selected
- 2.1.21 Ensure that Microsoft Defender for Endpoint integration with Microsoft Defender for Cloud is selected
- 3.1.3.3 Ensure that 'Endpoint protection' component status is set to 'On'
- 164.308(a)(5)(ii)(B): Administrative Safeguards
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
securitycenter_wdatp_integration - Powerpipe Control:
azure_compliance.control.securitycenter_wdatp_integration - Prowler Check:
defender_ensure_wdatp_is_enabled
Last reviewed: 2026-10-15