Does setting enforcementMode to Audit provide any actual protection?

It provides visibility (Defender for Endpoint reports what actions it would have taken) without actually blocking or remediating anything, it's a detection/reporting mode, not an active protection mode. Audit is appropriate for a phased rollout to validate behavior before committing to a more active enforcement mode, but if left permanently in Audit, the extension provides monitoring value without the active protection its more enforcing modes would provide.

Does AgentlessScanning's exclusionTags exempt a resource from all Defender protections, or just agentless scanning?

Only agentless scanning specifically, a resource tagged for exclusion from AgentlessScanning can still be covered by other enabled auto-provisioning settings (like MicrosoftDefenderForEndpoint's agent, if separately deployed to that resource). Exclusion tags are scoped to the specific auto-provisioning setting they're configured under, not a global 'ignore this resource for all security purposes' flag.

What happens to resources that already had agents installed manually before auto-provisioning was enabled?

Auto-provisioning generally doesn't duplicate or conflict with an already-installed agent on a resource, it's meant to fill the gap for resources lacking the extension rather than forcibly reinstalling on ones that already have it. That said, verify actual behavior for your specific resource state, since an unexpected duplicate agent installation or configuration conflict is worth checking for after first enabling auto-provisioning broadly.

Azure Security Center Auto-Provisioning Builder

IAM & SecurityAzure

Configure auto-provisioning extensions for Defender agents, vulnerability assessment, agentless scanning, and container sensors.

Microsoft Defender for Cloud Configuration

Configure auto-provisioning extensions for Defender agents, vulnerability assessment, agentless scanning, and container sensors.

Required Fields

subscriptionIdautoProvisioningSettingsautoProvisioningSettings[0].nameautoProvisioningSettings[0].autoProvision

{
  "subscriptionId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
  "autoProvisioningSettings": [
    {
      "name": "MicrosoftDefenderForEndpoint",
      "autoProvision": "On",
      "configuration": {
        "enforcementMode": "Audit"
      }
    },
    {
      "name": "VulnerabilityAssessment",
      "autoProvision": "On",
      "configuration": {
        "type": "Qualys"
      }
    },
    {
      "name": "AzureMonitorAgent",
      "autoProvision": "On",
      "configuration": {
        "workspaceResourceId": "/subscriptions/a1b2c3d4/resourceGroups/rg-security/providers/Microsoft.OperationalInsights/workspaces/law-security-prod",
        "dataCollectionRuleResourceId": "/subscriptions/a1b2c3d4/resourceGroups/rg-security/providers/Microsoft.Insights/dataCollectionRules/dcr-defender",
        "userWorkspaceResourceId": null
      }
    },
    {
      "name": "AgentlessScanning",
      "autoProvision": "On",
      "configuration": {
        "scanningMode": "Default",
        "exclusionTags": {
          "env": "sandbox"
        }
      }
    },
    {
      "name": "ContainerSensor",
      "autoProvision": "On",
      "configuration": {
        "defenderProfile": "Enabled",
        "policyAddon": "Enabled"
      }
    },
    {
      "name": "SensitiveDataDiscovery",
      "autoProvision": "On",
      "configuration": {
        "sensitiveInfoTypes": ["CreditCardNumber", "SSN", "AzureStorageAccountKey"]
      }
    }
  ],
  "workspaceSettings": {
    "scope": "/subscriptions/a1b2c3d4-e5f6-7890-abcd-ef1234567890",
    "workspaceId": "/subscriptions/a1b2c3d4/resourceGroups/rg-security/providers/Microsoft.OperationalInsights/workspaces/law-security-prod"
  }
}

Generated Output

Output will appear here...

About This Tool

Configure Defender for Cloud's auto-provisioning settings for security extensions (Defender for Endpoint, vulnerability assessment, Azure Monitor Agent, agentless scanning, container sensor, sensitive data discovery), each independently toggled with its own configuration block rather than one global on/off switch. MicrosoftDefenderForEndpoint's enforcementMode set to Audit (rather than Enforce or another blocking mode) means the extension reports what it would do without actually taking blocking action, a deliberate staged-rollout pattern, but a team that sets Audit intending it as a permanent conservative posture and never revisits it gets visibility without any actual enforcement indefinitely.

When to Use This Tool

•Setting AzureMonitorAgent's configuration to reference a specific workspaceResourceId and dataCollectionRuleResourceId, so security-relevant telemetry from provisioned resources flows into the intended centralized Log Analytics workspace rather than a default or ad-hoc one.
•Using AgentlessScanning's exclusionTags to exempt sandbox-tagged resources from agentless vulnerability/malware scanning, reducing scan noise and cost on resources that don't warrant the same security scrutiny as production.
•Setting MicrosoftDefenderForEndpoint's enforcementMode to Audit initially during a phased rollout, with an explicit plan to revisit and tighten to a more enforcing mode once the audit period confirms no unexpected disruption.
•Enabling SensitiveDataDiscovery with a specific sensitiveInfoTypes list (CreditCardNumber, SSN, AzureStorageAccountKey) scoped to the data classification categories actually relevant to compliance requirements, rather than every available sensitive-info type generating broader, less-actionable findings.

Pro Tips

TIP

Treat enforcementMode: Audit as a temporary rollout stage with a planned revisit date, not a permanent security posture, a team that sets Audit and moves on gets visibility without actual protection indefinitely.

TIP

Exclusion tags scoped to one specific auto-provisioning setting are easy to mistake for a broader security exemption, verify what exactly a given exclusionTags configuration exempts a resource from before assuming it covers more than that one setting.

TIP

Scope SensitiveDataDiscovery's sensitiveInfoTypes list to what's actually relevant for your compliance requirements, an overly broad list generates more findings to triage without necessarily improving actual data-protection posture, dilating signal with types that aren't genuinely relevant to your data.

How It Works Under the Hood

The builder validates that subscriptionId, autoProvisioningSettings, and the first setting's name/autoProvision resolve before accepting the JSON as a plausible combined auto-provisioning configuration payload; it can't verify a specific extension's configuration block (like AzureMonitorAgent's referenced workspace/DCR) is actually valid or that the referenced resource IDs exist, those checks happen only against the live Microsoft.Security resource provider.

Frequently Asked Questions

Does setting enforcementMode to Audit provide any actual protection?: It provides visibility (Defender for Endpoint reports what actions it would have taken) without actually blocking or remediating anything, it's a detection/reporting mode, not an active protection mode. Audit is appropriate for a phased rollout to validate behavior before committing to a more active enforcement mode, but if left permanently in Audit, the extension provides monitoring value without the active protection its more enforcing modes would provide.
Does AgentlessScanning's exclusionTags exempt a resource from all Defender protections, or just agentless scanning?: Only agentless scanning specifically, a resource tagged for exclusion from AgentlessScanning can still be covered by other enabled auto-provisioning settings (like MicrosoftDefenderForEndpoint's agent, if separately deployed to that resource). Exclusion tags are scoped to the specific auto-provisioning setting they're configured under, not a global 'ignore this resource for all security purposes' flag.
What happens to resources that already had agents installed manually before auto-provisioning was enabled?: Auto-provisioning generally doesn't duplicate or conflict with an already-installed agent on a resource, it's meant to fill the gap for resources lacking the extension rather than forcibly reinstalling on ones that already have it. That said, verify actual behavior for your specific resource state, since an unexpected duplicate agent installation or configuration conflict is worth checking for after first enabling auto-provisioning broadly.

Related Learning Guides

Azure RBAC Role Finder5 min read
Azure AD & RBAC Guide26 min read

Was this tool helpful?

Disclaimer: This tool runs entirely in your browser. No data is sent to our servers. Always verify outputs before using them in production. AWS, Azure, and GCP are trademarks of their respective owners.

Azure Security Center Auto-Provisioning Builder

IAM & SecurityAzure

Configure auto-provisioning extensions for Defender agents, vulnerability assessment, agentless scanning, and container sensors.

Microsoft Defender for Cloud Configuration

Configure auto-provisioning extensions for Defender agents, vulnerability assessment, agentless scanning, and container sensors.

Required Fields

subscriptionIdautoProvisioningSettingsautoProvisioningSettings[0].nameautoProvisioningSettings[0].autoProvision

Generated Output

Output will appear here...

About This Tool

When to Use This Tool

•Setting AzureMonitorAgent's configuration to reference a specific workspaceResourceId and dataCollectionRuleResourceId, so security-relevant telemetry from provisioned resources flows into the intended centralized Log Analytics workspace rather than a default or ad-hoc one.
•Using AgentlessScanning's exclusionTags to exempt sandbox-tagged resources from agentless vulnerability/malware scanning, reducing scan noise and cost on resources that don't warrant the same security scrutiny as production.
•Setting MicrosoftDefenderForEndpoint's enforcementMode to Audit initially during a phased rollout, with an explicit plan to revisit and tighten to a more enforcing mode once the audit period confirms no unexpected disruption.
•Enabling SensitiveDataDiscovery with a specific sensitiveInfoTypes list (CreditCardNumber, SSN, AzureStorageAccountKey) scoped to the data classification categories actually relevant to compliance requirements, rather than every available sensitive-info type generating broader, less-actionable findings.

Pro Tips

TIP

How It Works Under the Hood

Frequently Asked Questions

Does setting enforcementMode to Audit provide any actual protection?: It provides visibility (Defender for Endpoint reports what actions it would have taken) without actually blocking or remediating anything, it's a detection/reporting mode, not an active protection mode. Audit is appropriate for a phased rollout to validate behavior before committing to a more active enforcement mode, but if left permanently in Audit, the extension provides monitoring value without the active protection its more enforcing modes would provide.
Does AgentlessScanning's exclusionTags exempt a resource from all Defender protections, or just agentless scanning?: Only agentless scanning specifically, a resource tagged for exclusion from AgentlessScanning can still be covered by other enabled auto-provisioning settings (like MicrosoftDefenderForEndpoint's agent, if separately deployed to that resource). Exclusion tags are scoped to the specific auto-provisioning setting they're configured under, not a global 'ignore this resource for all security purposes' flag.
What happens to resources that already had agents installed manually before auto-provisioning was enabled?: Auto-provisioning generally doesn't duplicate or conflict with an already-installed agent on a resource, it's meant to fill the gap for resources lacking the extension rather than forcibly reinstalling on ones that already have it. That said, verify actual behavior for your specific resource state, since an unexpected duplicate agent installation or configuration conflict is worth checking for after first enabling auto-provisioning broadly.

Related Learning Guides

Azure RBAC Role Finder5 min read
Azure AD & RBAC Guide26 min read

Was this tool helpful?