Skip to content

fix: expose Defender for Containers extension parameters - #2185

Open
kumarpk3456 (kumarpk3456) wants to merge 5 commits into
mainfrom
fix/4220-clean
Open

fix: expose Defender for Containers extension parameters#2185
kumarpk3456 (kumarpk3456) wants to merge 5 commits into
mainfrom
fix/4220-clean

Conversation

@kumarpk3456

@kumarpk3456 kumarpk3456 (kumarpk3456) commented Aug 14, 2026

Copy link
Copy Markdown
Contributor

Related Issue
Fixes: #4220
[Bug]: Add Subplan Azure Policy in Containers Defender Plan

Overview
This PR addresses Issue #4220 - Add Subplan Azure Policy in Containers Defender Plan by updating the Defender for Containers configuration initiative to use the latest built-in policy and expose additional Defender for Containers extension settings.

This PR fixes/adds/changes

  1. Replaces the existing Defender for Containers built-in policy (c9ddb292-b203-4738-aead-18e2716e858f) with the newer built-in policy (efd4031d-b232-4595-babf-ae817348e91b).
  2. Retains the existing enableAscForContainers parameter to maintain compatibility with existing assignments.
  3. Adds new optional Defender for Containers configuration parameters with default values:
  • ascForContainersIsContainerRegistriesVulnerabilityAssessmentsEnabled
  • ascForContainersIsAgentlessDiscoveryForKubernetesEnabled
  • ascForContainersIsAgentlessVmScanningEnabled
  • ascForContainersIsContainerSensorEnabled
  • ascForContainersIsSecurityGatingEnabled
  • ascForContainersIsContainerIntegrityContributionEnabled
  1. Updates parameter mappings in the initiative to pass the new settings to the built-in policy.
  2. Bumps the initiative version from 2.4.1 to 2.5.0 in accordance with Azure Policy versioning guidance for non-breaking parameter additions.
  3. Regenerates the initiative artifact (eslzArm/managementGroupTemplates/policyDefinitions/initiatives.json).

Breaking Changes
None

  • Existing enableAscForContainers parameter is retained.
  • All newly introduced parameters include default values, ensuring existing policy assignments continue to function without modification.
  • The change follows Azure Policy guidance for non-breaking updates by adding parameters rather than removing existing ones.

Testing Evidence

  1. Validate that the old Defender for Containers policy was removed and replaced with the new built-in policy.
Screenshot 13 2. Verify initiative version was incremented correctly. Screenshot 14 3. Newly introduced Defender for Containers configuration parameters exist in source initiative definition. screenshot 15 4. Validate that all newly added parameters were included in generated artifacts. Screenshot 17 5. Verify newly added parameters are exposed in Azure assignment UI. Screenshot 20 6. Validate deployment of the generated initiative to Azure for end-to-end testing. Screenshot 18 7. Verify successful initiative assignment and parameter exposure in Azure. Screenshot 21

As part of this Pull Request I have

  • Checked for duplicate Pull Requests
  • Associated it with relevant issues, for tracking and closure.
  • Ensured my code/branch is up-to-date with the latest changes in the main branch
  • Performed testing and provided evidence.
  • Ensured contribution guidance is followed.
  • Updated relevant and associated documentation.
  • Created a pull request to updated the "What's New?" wiki page.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Policy Proposal]: Add Subplan Azure Policy in Containers Defender Plan

1 participant