The container that got popped in the last breach you read about probably wasn’t running on a cluster anyone was watching. It was some quiet little revenue-report job on a serverless platform, spun up by a team that never filed a ticket, running an image last rebuilt eleven months ago. Nobody deployed a security agent to it because there was nowhere to deploy one. That’s the gap Microsoft just closed — at least on paper.
As of today, Defender for Cloud’s Serverless Containers Posture supports Azure Container Apps environments at GA. The pitch is simple: your Container Apps get scanned for image vulnerabilities, misconfigurations, and compliance drift, and they show up in the same Defender view as your AKS clusters — without you installing anything on them. Agentless. No sensor, no privileged DaemonSet, no Helm chart you have to babysit through every Kubernetes minor bump.
I’ve run Defender for Containers against AKS for long enough to be suspicious of the word “unified,” so let me walk a skeptical colleague through it. He’s earned the right to push.
What actually gets scanned
“Agentless. Right. So it scans nothing and calls it posture.”
Fair reflex, wrong this time. Three things it genuinely sees:
- Container images. The images backing your Container Apps revisions get pulled apart for known CVEs — OS packages and language-layer dependencies. Treat it as image vulnerability scanning pointed at a new compute target; whether it’s byte-for-byte the same assessment pipeline that covers your registries and AKS workloads is a claim I’d verify against the docs rather than assert.
- Environment configuration. How the Container App and its environment are set up — ingress exposure, identity, secrets handling — evaluated against Defender’s recommendation set and surfaced as posture findings, not just a vuln list.
- Compliance and attack-path context. Findings roll into the same secure score, regulatory compliance dashboards, and attack-path analysis you already use, so a vulnerable serverless container that’s internet-exposed and holds a managed identity reads as one connected risk instead of three orphaned alerts.
The important word is context. A CVE list is cheap. Knowing that this specific image, on a publicly-reachable Container App, with a user-assigned managed identity that has Key Vault Secrets User, is one hop from your secrets — that’s the thing you couldn’t previously assemble for serverless without a spreadsheet and a bad afternoon.
How this is different from the AKS story
“You’ve had container posture for years. What’s new here besides a checkbox?”
The compute model. AKS posture in Defender for Containers leans on a couple of things: agentless discovery of the cluster plus, for runtime threat detection, the Defender sensor — a DaemonSet you deploy and then maintain across node pools and Kubernetes upgrades. That sensor is where a lot of the operational tax lives.
Container Apps has no nodes you own. There’s no DaemonSet slot, no kubelet you can reach, no place to bolt an agent even if you wanted to. So the whole feature is agentless by necessity: Defender reads the platform’s control-plane view of your environments, revisions, and images and assesses from there. Nothing to deploy, nothing to patch, nothing to break during a maintenance window. For serverless that’s not a nice-to-have — it’s the only model that could have worked.
“And the catch is…”
The catch is the fourth thing, the one I don’t think comes with it: runtime threat detection. I’m reading that off the word Microsoft chose — posture. Posture is the state of things before anything happens: this image is vulnerable, this config is exposed. It is a different job from a sensor watching a process spawn a reverse shell at 2 a.m., and this GA is described as the posture one. That’s an inference from the terminology, not a line item I’ve seen the announcement spell out — so don’t read “we now cover Container Apps” as “we now detect live attacks inside your Container Apps,” and if your threat model needs behavioral detection on serverless workloads, pull the current Defender for Containers capability matrix and confirm it before you promise anyone a dashboard.
Which plan, and don’t guess
“Let me guess — it’s free until it isn’t.”
Historically, container image scanning and vulnerability assessment have lived under the Defender for Containers plan, while the broader posture reasoning — attack paths, agentless scanning across resource types — has been Defender CSPM territory. But which capability lights up under which plan has moved around before, and the GA note isn’t the place I’d stake a budget on. So don’t take my word or a launch blog’s — check the current Defender for Cloud plan documentation for the SKU split, then check what your subscription is actually paying for:
If Containers reads Free, none of this applies to you yet — you’re looking at the marketing, not your tenant. Enabling it is a state-changing call (az security pricing create --name Containers --tier Standard), so do it deliberately, per subscription, and know it bills. There’s no --what-if on pricing; the “dry run” is you reading the invoice estimate first.
A worked look before you trust the portal
Once the plan’s on and a scan cycle has run, don’t click through blades one at a time. Ask Resource Graph what Defender is actually flagging on your serverless containers, tenant-wide:
That Microsoft.App/ filter is the tell — it’s the Container Apps resource provider, so you’re pulling posture findings scoped to serverless containers rather than drowning in AKS noise. Run it, sort by count, and you’ll have your real first-week backlog in one query instead of a screenshot tour.
The parts the launch note is quiet about
“So I flip it on globally Monday and we’re done?”
No. Two things to nail down before you tell leadership it’s covered.
Regions. New Defender features typically light up in commercial Azure first, and sovereign and government clouds have historically trailed — sometimes by a lot, sometimes indefinitely. I’m not going to state a rollout schedule the announcement doesn’t give. If you run workloads in Azure Government or a sovereign region, confirm availability there specifically against the feature’s own documentation — “GA” in the update feed means GA somewhere, not everywhere. Assume public cloud and verify the rest.
Scan latency and shadow environments. I don’t have a published scan-frequency number for this feature, so take the next sentence as operational caution rather than a spec: agentless posture reads the platform’s reported state on some cadence, which means a freshly-pushed vulnerable image can plausibly sit in production for a window before it surfaces as a finding. Don’t design as if it’s instantaneous until the docs say it is. Put your hard gate at the registry and CI stage; treat Defender’s serverless posture as the safety net that catches what leaked past you, not the tripwire at the door.
And the quiet win nobody will headline: discovery. Half the value here isn’t the CVE list — it’s Defender finally enumerating the Container Apps environments some team stood up eight months ago and never told you about. The scan is useful. The inventory is the part that saves you at 2 a.m., when the thing you’re paging about turns out to be a workload you didn’t know you owned.
