defender-for-apis

Microsoft Defender for APIs

Defender for APIs is a Microsoft Defender for Cloud plan that provides visibility into the security posture of APIs published in Azure API Management, prioritises them by risk, and detects active threats and abuse. It is detection and posture, not a WAF or API gateway.

When to use

Use this skill when securing APIs that are already published through Azure API Management and you need risk-based prioritisation plus runtime threat detection.

Do not use this skill for:

• Designing API security from scratch (use api-security-design for OWASP API Top 10)
• APIs fronted by Application Gateway / Front Door without APIM (out of scope today)
• WAF tuning or rate-limiting design (APIM policies, not Defender)

Triage which APIs to protect first

Defender for APIs onboards everything in APIM by default. The work is prioritisation. Use this table to rank your inventory:

Risk signal	Priority	Why it matters first
Externally exposed + unauthenticated	P0 - this week	Already an attack surface; one bad request from internet
Externally exposed + handles sensitive data (PII, payment, health)	P0 - this week	Sensitive-data exposure (OWASP API3) and BOLA risk
Externally exposed + authenticated	P1 - this month	Auth bypass / token abuse risk
Internal + handles sensitive data	P2 - this quarter	Insider risk; lateral movement scenarios
Inactive or unused for >90 days	Decommission	Free attack surface reduction
Internal + non-sensitive	P3 - monitor only	Low immediate risk

Rule of thumb: if Defender for APIs surfaces more than 50 findings on day one, do not try to fix all of them. Filter to externally exposed + sensitive-data first - that is usually 5-15 APIs and 80% of real risk.

Approach

1. Enable the plan at subscription scope — Defender for APIs is a per-API priced plan inside Defender for Cloud (billed per million API calls). Enable on the subscription containing your APIM instances. The first 30 days are free for evaluation. Verify: Defender for Cloud → Environment settings → Defender plans shows "APIs: On".
2. Onboard APIs into the plan — From Defender for Cloud → Workload protections → Defender for APIs → Onboard, select APIM instances. Onboarding does not require redeploying APIs. Verify: API inventory populates within ~1 hour; each API shows a risk score and findings.
3. Triage by the risk table above — Filter inventory to External + Unauthenticated and External + Sensitive data findings. Treat these as P0.
4. Remediate at the APIM layer — Defender does not fix; APIM policies do.
   • Unauthenticated → add <validate-jwt> or subscription-key policy
   • Sensitive data exposure → review set-body / response-mask policies
   • Excessive enumeration → add <rate-limit-by-key> policy
   • Inactive APIs → deprecate or revoke product visibility Verify: re-scan finding clears within 24 hours of APIM policy publish.
5. Wire detections to your SOC — Defender alerts flow into Defender for Cloud, Defender XDR, and Sentinel via the Microsoft Defender XDR connector. Build automation rules for unauthenticated-access spikes and credential-stuffing patterns. Verify: a test malicious request (e.g. enumeration burst from one IP) generates an alert within 15 minutes in the Defender XDR portal.
6. Iterate monthly — New APIs appear; old ones go inactive. Re-run the triage table monthly so risk priority stays current.