Enable Defender for Cloud on all subscriptions in a management group

Overview

You can use Azure Policy to enable Microsoft Defender for Cloud on all the Azure subscriptions in the same management group. This approach is more convenient than accessing them individually from the portal, and works even if the subscriptions belong to different owners.

Prerequisites

Before you onboard the management group, register the required resource provider.

Enable the resource provider _Microsoft.Security_ for the management group. The following Azure CLI command registers the Microsoft.Security resource provider at the management group scope so that Defender for Cloud policies can be assigned and evaluated:

az provider register --namespace Microsoft.Security --management-group-id …

Onboard a management group and all its subscriptions

To onboard a management group and all its subscriptions:

As a user with Security Admin permissions, open Azure Policy and search for the definition Enable Microsoft Defender for Cloud on your subscription.
Select Assign and ensure you set the scope to the management group level.

Tip

Other than the scope, there are no required parameters.
Select Remediation, and then select Create a remediation task to ensure all existing subscriptions that don't have Defender for Cloud enabled get onboarded.
Select Review + create.
Review your information and select Create.

When you assign the definition, it:

Detects all subscriptions in the management group that aren't yet registered with Defender for Cloud.
Marks those subscriptions as non-compliant.
Marks as compliant all registered subscriptions, regardless of whether they have Defender for Cloud's enhanced security features on or off.

The remediation task then enables Defender for Cloud's basic functionality on the non-compliant subscriptions.

Optional policy definition modifications

You might choose to modify the Azure Policy definition in various ways:

Define compliance differently. The supplied policy classifies all subscriptions in the management group that aren't yet registered with Defender for Cloud as non-compliant. You might choose to set it to all subscriptions without Defender for Cloud's enhanced security features enabled.

The supplied definition defines either of the pricing settings below as compliant. Meaning that a subscription set to standard or free is compliant.

Tip

When any Microsoft Defender plan is enabled, it's described in a policy definition as being on the standard setting. When it's disabled, it's free. To learn about the differences between these plans, see Microsoft Defender for Cloud's Defender plans.
```
"existenceCondition": {
    "anyof": [
        {
            "field": "microsoft.security/pricings/pricingTier",
            "equals": "standard"
        },
        {
            "field": "microsoft.security/pricings/pricingTier",
            "equals": "free"
        }
    ]
},
```
If you change the existenceCondition to the following, only subscriptions set to standard would be classified as compliant:
```
"existenceCondition": {
        "field": "microsoft.security/pricings/pricingTier",
        "equals": "standard"
      },
```
Define some Defender plans to apply when enabling Defender for Cloud. The supplied policy enables Defender for Cloud without any of the optional enhanced security features. You might choose to enable one or more of the Defender plans.

The supplied definition's deployment section has a parameter pricingTier. By default, this parameter is set to free, but you can modify it.

Next step

Enable enhanced security features in Defender for Cloud

Last updated on 2026-09-22