For clusters that aren’t running in Azure Kubernetes Service (AKS), Defender for Cloud uses Azure Arc-enabled Kubernetes to deploy the required extensions.
Before you begin, review the prerequisites for your cluster type, including enabling the Defender for Containers plan, installing Azure CLI 2.40.0 or later, and meeting any Azure Arc connectivity requirements.
Prerequisites
Network requirements
The Defender sensor must connect to Microsoft Defender for Cloud to send security data and events. Make sure that the required endpoints are configured for outbound access.
Connection requirements
The Defender sensor needs connectivity to:
- Microsoft Defender for Cloud (for sending security data and events)
By default, AKS clusters have unrestricted outbound (egress) internet access.
For clusters with restricted egress, you must allow specific FQDNs for Microsoft Defender for Containers to function properly. See Microsoft Defender for Containers - Required FQDN/application rules in the AKS outbound network documentation for the required endpoints.
Private link configuration
For instructions, see Microsoft Security Private Link for Microsoft Defender for Cloud.
Deploy the Defender sensor
If automatic provisioning was enabled when you turned on the Defender for Containers plan, the Defender sensor might already be installed. Verify the deployment before running this command.
Deploy the Defender sensor to a specific AKS cluster:
az aks update \
--resource-group <resource-group> \
--name <aks-cluster-name> \
--enable-defender
Enable Azure Policy for Kubernetes to assess and enforce configuration best practices:
az aks enable-addons \
--addons azure-policy \
--name <aks-cluster-name> \
--resource-group <resource-group>
Prerequisites
Network requirements
Validate that the following endpoints for public cloud deployments are configured for outbound access. Configuring them for outbound access helps ensure that the Defender sensor can connect to Microsoft Defender for Cloud to send security data and events.
Note
The Azure domains *.ods.opinsights.azure.com and *.oms.opinsights.azure.com are no longer required for outbound access. For more information, see the deprecation announcement.
| Azure domain |
Azure Government domain |
Azure operated by 21Vianet domain |
Port |
| *.cloud.defender.microsoft.com |
N/A |
N/A |
443 |
You also need to validate the Azure Arc-enabled Kubernetes network requirements.
Deploy the Defender sensor
For EKS clusters, Defender components are deployed as Azure Arc Kubernetes extensions when you deploy them manually using Azure CLI.
If automatic provisioning was enabled when you turned on the Defender for Containers plan, the Defender sensor might already be installed. Verify the deployment before running these commands.
Run the following command to deploy the Defender sensor extension to your Arc-connected EKS cluster:
az k8s-extension create \
--name microsoft.azuredefender.kubernetes \
--extension-type microsoft.azuredefender.kubernetes \
--cluster-type connectedClusters \
--cluster-name <cluster-name> \
--resource-group <resource-group> \
Deploy the Azure Policy extension
Install the Azure Policy extension to enable policy-based security recommendations and compliance assessments for your EKS cluster:
az k8s-extension create \
--name azurepolicy \
--extension-type Microsoft.PolicyInsights \
--cluster-type connectedClusters \
--cluster-name <cluster-name> \
--resource-group <resource-group>
Prerequisites
Network requirements
Validate that the following endpoints for public cloud deployments are configured for outbound access. Configuring them for outbound access helps ensure that the Defender sensor can connect to Microsoft Defender for Cloud to send security data and events.
Note
The Azure domains *.ods.opinsights.azure.com and *.oms.opinsights.azure.com are no longer required for outbound access. For more information, see the deprecation announcement.
| Azure domain |
Azure Government domain |
Azure operated by 21Vianet domain |
Port |
| *.cloud.defender.microsoft.com |
N/A |
N/A |
443 |
You also need to validate the Azure Arc-enabled Kubernetes network requirements.
Private GKE clusters
Private GKE clusters must allow outbound HTTPS (TCP 443) access to Microsoft Defender for Cloud endpoints.
If your private cluster blocks outbound traffic, create a firewall rule to allow cluster nodes to reach Microsoft Defender for Cloud endpoints over TCP 443:
gcloud compute firewall-rules create allow-azure-defender \
--allow tcp:443 \
--source-ranges <cluster-cidr> \
--target-tags <node-tags>
Cluster-specific considerations
Review the following considerations based on your GKE cluster type before deploying the Defender sensor.
Standard GKE clusters
No special configuration is required. Follow the deployment steps in the Deploy the Defender sensor and Deploy the Azure Policy extension sections.
GKE Autopilot clusters
For Autopilot clusters:
- The Defender sensor automatically adjusts resource requests.
- No manual configuration is needed for resource limits.
Important
In GKE Autopilot clusters, resource requests and limits for the Defender sensor can't be manually configured. Resource management is controlled by GKE Autopilot and can't be overridden.
Deploy the Defender sensor
For GKE clusters, Defender components are deployed as Azure Arc Kubernetes extensions when you deploy them manually using Azure CLI.
If automatic provisioning was enabled when you turned on the Defender for Containers plan, the Defender sensor might already be installed. Verify the deployment before running this command.
Run the following command to install the Defender sensor extension on your Arc-connected GKE cluster:
az k8s-extension create \
--name microsoft.azuredefender.kubernetes \
--extension-type microsoft.azuredefender.kubernetes \
--cluster-type connectedClusters \
--cluster-name <cluster-name> \
--resource-group <resource-group> \
Deploy the Azure Policy extension
Install the Azure Policy extension on your Arc-connected GKE cluster to enable policy-based security recommendations and compliance assessments:
az k8s-extension create \
--name azurepolicy \
--extension-type Microsoft.PolicyInsights \
--cluster-type connectedClusters \
--cluster-name <cluster-name> \
--resource-group <resource-group>
Prerequisites
Network requirements
Validate that the following endpoints for public cloud deployments are configured for outbound access. Configuring them for outbound access helps ensure that the Defender sensor can connect to Microsoft Defender for Cloud to send security data and events.
Note
The Azure domains *.ods.opinsights.azure.com and *.oms.opinsights.azure.com are no longer required for outbound access. For more information, see the deprecation announcement.
| Azure domain |
Azure Government domain |
Azure operated by 21Vianet domain |
Port |
| *.cloud.defender.microsoft.com |
N/A |
N/A |
443 |
You also need to validate the Azure Arc-enabled Kubernetes network requirements.
Deploy the Defender sensor
For Arc-enabled Kubernetes clusters, Defender components are deployed as Azure Arc Kubernetes extensions.
If automatic provisioning was enabled when you turned on the Defender for Containers plan, the Defender sensor might already be installed. Verify the deployment before running this command.
Run the following command to install the Defender sensor extension on your Arc-enabled Kubernetes cluster:
az k8s-extension create \
--name microsoft.azuredefender.kubernetes \
--extension-type microsoft.azuredefender.kubernetes \
--cluster-type connectedClusters \
--cluster-name <cluster-name> \
--resource-group <resource-group> \
Deploy the Azure Policy extension
Install the Azure Policy extension on your Arc-enabled Kubernetes cluster to enable policy-based security recommendations and compliance assessments:
az k8s-extension create \
--name azurepolicy \
--extension-type Microsoft.PolicyInsights \
--cluster-type connectedClusters \
--cluster-name <cluster-name> \
--resource-group <resource-group>