This article explains how to disable Microsoft Defender for Containers and remove its components by environment.
Turning off the Defender for Containers plan or disabling automatic provisioning stops future deployments, but doesn't uninstall Defender components that are already deployed to clusters. Those components are removed separately.
Important
Removing Defender for Containers stops protection for your clusters. Make sure you have alternative security measures in place before you proceed.
Important
Disabling the plan doesn't delete historical security data stored in Microsoft Defender for Cloud or Log Analytics workspaces.
What stops working after removal
After you remove Defender for Containers components from an AKS cluster:
Runtime threat detection based on Defender sensor telemetry stops.
Kubernetes security recommendations related to Azure Policy for Kubernetes stop updating.
Alerts based on AKS runtime signals and Kubernetes audit data stop being generated.
New container image vulnerability findings for images in Azure Container Registry (ACR) are no longer generated for this environment.
Disable Defender for Containers plan
Sign in to the Azure portal.
Go to Microsoft Defender for Cloud > Environment settings.
Select the subscription that contains your AKS clusters.
In the Defender plans page, toggle Containers to Off.
Select Save.
Remove Defender extensions from AKS clusters
Remove the Defender for Containers profile from the AKS cluster
az aks update \
--name <cluster-name> \
--resource-group <resource-group> \
--disable-defender
Disable Azure Policy add-on
az aks disable-addons \
--addons azure-policy \
--name <cluster-name> \
--resource-group <resource-group>
Verify removal
Check AKS cluster pods
kubectl get pods -A | grep defender
No resources should be returned.
Verify plan status
az security pricing show --name 'Containers'
The output should show pricingTier as Free.