Set Microsoft Defender for APIs to the Standard tier
March 21, 2025 ยท View on GitHub
SYNOPSIS
Enable Microsoft Defender for APIs.
DESCRIPTION
Microsoft Defender for APIs provides additional security for APIs published in Azure API Management.
Protection is provided by analyzing onboarded APIs. Which allows Microsoft Defender for Cloud to produce security findings.
The inventory and security findings for onboarded APIs is reviewed in the Defender for Cloud API Security dashboard.
These security findings includes API recommendations and runtime threats.
Defender for APIs can be enabled together with the Defender CSPM plan, offering further capabilities.
Microsoft Defender for APIs can be enabled at the subscription level.
RECOMMENDATION
Consider using Microsoft Defender for APIs to provide additional security for APIs published in Azure API Management.
EXAMPLES
Configure with Azure template
To deploy and enable Defender for APIs configurations that pass this rule:
- Set the
properties.pricingTierproperty to toStandard. - Set the
properties.subPlanproperty to a plan such asP1. Other plans are available, currently these are:P1,P2,P3,P4, andP5.
For example:
{
"type": "Microsoft.Security/pricings",
"apiVersion": "2023-01-01",
"name": "Api",
"properties": {
"subPlan": "P1",
"pricingTier": "Standard"
}
}
Configure with Bicep
To deploy and enable Defender for APIs configurations that pass this rule:
- Set the
properties.pricingTierproperty to toStandard. - Set the
properties.subPlanproperty to a plan such asP1. Other plans are available, currently these are:P1,P2,P3,P4, andP5.
For example:
resource defenderForApi 'Microsoft.Security/pricings@2023-01-01' = {
name: 'Api'
properties: {
subPlan: 'P1'
pricingTier: 'Standard'
}
}
Configure with Azure CLI
To enable Microsoft Defender for APIs:
- Set the
Standardpricing tier for Microsoft Defender for APIs.
For example:
az security pricing create -n Api --tier standard --subplan P1
Configure with Azure PowerShell
To enable Microsoft Defender for APIs:
- Set the
Standardpricing tier for Microsoft Defender for APIs.
For example:
Set-AzSecurityPricing -Name 'Api' -PricingTier 'Standard' -SubPlan 'P1'
NOTES
Currently only REST APIs published in Azure API Management is supported. Not all regions are supported.
LINKS
- SE:10 Monitoring and threat detection
- What is Microsoft Defender for Cloud?
- Overview of Microsoft Defender for APIs
- Support and prerequisites for Defender for APIs
- Onboard Defender for APIs
- Quickstart: Enable enhanced security features
- Azure security baseline for API Management
- LT-1: Enable threat detection capabilities
- Azure Policy built-in policy definitions
- Azure deployment reference