Azure Container Apps now shows up in Microsoft Defender for Cloud’s serverless container posture management. If you run production workloads on Container Apps, this is the kind of visibility you have been missing: misconfigurations, overly permissive identities, and exposed endpoints that do not need to be exposed. No agents to install. No sidecars. Just control-plane analysis that surfaces what is wrong before someone exploits it.
What gets scanned
Defender for Cloud’s serverless container module does not do runtime threat detection. It looks at how your Container Apps are configured and flags risks in these areas (full recommendation reference):
- Authentication. Checks whether platform-managed auth is turned on. If your container app is serving an API with no auth, Defender will tell you.
- Public exposure. Flags container apps or revisions that are open to the internet. Useful when someone deploys a debug endpoint and forgets to lock it down.
- Identity overprovisioning. Scans managed identities attached to your container apps and surfaces ones with more permissions than they need. Standard least-privilege hygiene, now automated.
- Container image risks. Analyzes images for known vulnerabilities and checks for hardening basics like read-only root filesystems.
These are not runtime detections. You will not get alerts when someone tries to exploit a vulnerability. What you get is a prioritized list of things to fix before that happens.
How to turn it on
Enablement lives in Defender CSPM (Cloud Security Posture Management), not the workload protection plans:
- Open Defender for Cloud in the Azure portal
- Go to Environment settings and find your subscription
- Under Defender plans, enable Defender CSPM
- In the CSPM settings, toggle on Serverless Containers and enable Registry access
After that, give it about 24 hours for the first scan to complete. Recommendations show up in the standard Defender inventory view alongside your VM and AKS findings.
What it costs
Serverless container posture management is bundled into the Defender CSPM plan. If you are already paying for Defender CSPM, this is included. If you are only using the free foundational CSPM tier, you need to upgrade. Microsoft’s pricing page breaks down the per-resource costs. For most teams running more than a handful of Container Apps, the math works out fine. For hobby projects with two container apps, you might just skip it.
The gaps you should know about
This is a posture tool, not a runtime security tool. It will not catch an active compromise. If you need threat detection at the container level, you still need Defender for Containers (for AKS) or a third-party runtime agent. Defender for Cloud’s serverless module is about catching the config bugs that lead to compromises, not the compromises themselves.
Also, the coverage is Azure-only for now. If you run Container Apps on Azure but your container images live in a third-party registry that Defender cannot reach, image scanning will miss those.
None of this is a dealbreaker. It is just useful to know what you are buying. For teams that have been running Container Apps in production without any security scanning beyond their CI pipeline, this fills a real gap. Turn it on. Fix the findings. And do not confuse posture management with runtime defense.