Azure Security Center
      Back to home
      1. CNS Policies
      2. Azure Knowledge Base
      3. Azure Security Center

      Auto-Provisioning Disabled

      Risk Level: Low

      Description:

      This plugin guarantees that the monitoring agent is automatically provisioned. The Microsoft Monitoring Agent monitors and warns on numerous security-related configurations and events, such as system upgrades, OS vulnerabilities, and endpoint protection.

      About the Service :

      Amazon RDS (Amazon Relational Database Service) makes it simple to set up, run, and scale a relational database in the cloud. It offers scalable capacity at a low cost while automating time-consuming administrative activities including hardware provisioning, database setup, patching, and backups. 

      Impact: 

      When the Automatic Provisioning of the monitoring agent is disabled, the Azure Security Center is not able to install Microsoft Monitoring Agent on the existing supported virtual machines. If the MMA is not installed, the Azure Security Center will not be able to log events, read security misconfiguration, or send the collected data to your workspace.

      Steps to reproduce :

      1. Sign in to your Azure management console.
      2. Navigate to the Azure Security Center blade at: https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/
      3. On the Microsoft Defender For Cloud page that appears click on the Azure Subscriptions heading. 
      4. Select the subscription that you want to examine.
      5. Under the navigation panel, select Auto provisioning.
      6. On the  Auto provisioning - Extensions page that appears, check if all the auto provisioning extensions are enabled for the selected Microsoft Azure subscription.
      7. If not, then the auto provisioning of the monitoring agent feature is disabled for the selected Azure subscription.
      8. Repeat step no. 3 - 8 for each Microsoft Azure subscription available in your account.

      Steps for remediation :

      1. Sign in to your Azure management console.
      2. Navigate to the Azure Security Center blade at: https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/
      3. On the Microsoft Defender For Cloud page that appears click on the Azure Subscriptions heading. 
      4. Select the subscription that you want to examine.
      5. Under the navigation panel, select Auto provisioning.
      6. On the  Auto provisioning - Extensions page that appears, click on Enable all extensions.
      7. Select a workspace from the Choose a Log Analytics Workspace dropdown and click on Apply. 
      8. On the Advanced Configuration pane that appears, click on Confirm.
      9. The Auto provisioning of the monitoring agent is enabled on your selected Azure subscription.
      10. If required, repeat steps for other Microsoft Azure cloud subscriptions available.

      References:

      Please feel free to reach out to support@pingsafe.ai with any questions that you may have.

      Thanks

      PingSafe Support