Muokkaa

Exclude Kubernetes clusters from automatic Defender sensor deployment

When automatic provisioning is enabled in the Defender for Containers plan, Microsoft Defender for Cloud deploys the Defender sensor to supported Kubernetes clusters.

To manage sensor deployment manually for specific clusters, add an exclusion tag to prevent automatic deployment.

You can use exclusion tags on the following cluster types:

  • Azure Kubernetes Service (AKS)
  • Amazon Elastic Kubernetes Service (EKS)
  • Google Kubernetes Engine (GKE)

Note

Exclusion tags aren't supported for Arc-enabled Kubernetes clusters in on-premises environments.

Prerequisites

Exclude a cluster from automatic sensor deployment

To exclude a cluster from automatic Defender sensor deployment:

Important

Add the exclusion tag before automatic provisioning deploys the Defender sensor. If the Defender sensor is already deployed, adding the tag doesn't remove the existing deployment.

To exclude an AKS cluster from automatic Defender sensor deployment:

  1. Sign in to the Azure portal.

  2. Go to Kubernetes services.

  3. Select the relevant AKS cluster.

  4. Select Tags.

  5. Add the following tag:

    • Name: ms_defender_container_exclude_sensors
    • Value: true

    Screenshot of the Tags page for a Kubernetes cluster showing the ms_defender_container_exclude_sensors tag set to true.

  6. Select Apply.

Next steps