Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
This article explains how to disable Microsoft Defender for Containers and remove its components by environment.
Turning off the Defender for Containers plan or disabling automatic provisioning stops future deployments, but doesn't uninstall Defender components that are already deployed to clusters. Defender components already deployed to clusters are removed separately.
Important
Removing Defender for Containers stops protection for your clusters. Make sure you have alternative security measures in place before you proceed.
Important
Disabling the plan doesn't delete historical security data stored in Microsoft Defender for Cloud or Log Analytics workspaces.
What stops working after removal
After you remove Defender for Containers components from an AKS cluster:
Runtime threat detection based on Defender sensor telemetry stops.
Kubernetes security recommendations related to Azure Policy for Kubernetes stop updating.
Alerts based on AKS runtime signals and Kubernetes audit data stop being generated.
New container image vulnerability findings for images in Azure Container Registry (ACR) are no longer generated for this environment.
Disable Defender for Containers plan
To disable the Defender for Containers plan for the subscription that contains your AKS clusters:
Sign in to the Azure portal.
Go to Microsoft Defender for Cloud > Environment settings.
Select the subscription that contains your AKS clusters.
In the Defender plans page, toggle Containers to Off.
Select Save.
Remove Defender extensions from AKS clusters
After disabling the plan, remove the Defender-related components from each AKS cluster.
Remove the Defender for Containers profile from the AKS cluster
Run the following command to remove the Defender for Containers profile from the AKS cluster:
az aks update \
--name <cluster-name> \
--resource-group <resource-group> \
--disable-defender
Disable Azure Policy add-on
If Azure Policy was enabled for this cluster, run the following command to disable the add-on:
az aks disable-addons \
--addons azure-policy \
--name <cluster-name> \
--resource-group <resource-group>
Verify removal
Use the following checks to confirm that Defender for Containers has been fully removed from your AKS cluster.
Check AKS cluster pods
Run the following command to check all namespaces for remaining Defender pods and confirm that the uninstall completed successfully:
kubectl get pods -A | grep defender
No resources should be returned.
Verify plan status
Run the following command to confirm that the Containers plan is disabled for the subscription:
az security pricing show --name 'Containers'
The output should show pricingTier as Free.