Forum Discussion

AmineB1275's avatar
AmineB1275
Copper Contributor
Jul 16, 2026

Defender for Cloud Container Workloard AWS EKS

Hi,  We're onboarding an AWS environment with EKS clusters into Defender for Cloud. The AWS connector is configured correctly and everything up to the final step works: the clusters are discover...
Jamony's avatar
Jamony
MCT
Jul 17, 2026

Agentless discovery succeeding does not prove Arc provisioning has the permissions it needs; those are separate paths. First, check whether the AWS connector was updated after enabling the Arc sensor option. Microsoft requires you to regenerate and redeploy the connector's CloudFormation template so the new Arc provisioning permissions are applied.

 

On the Azure side, verify the connector identity has the Defender Kubernetes Agent Operator role at the target subscription or resource group, including Microsoft.Kubernetes/connectedClusters/write. Also confirm the EKS cluster is not private-only, because private EKS clusters are not supported for this Arc-based runtime protection path.

 

After correcting permissions, allow several hours for automatic provisioning. If it still does nothing, use the Defender for Cloud recommendation for EKS Arc onboarding to connect one cluster manually, then deploy the Defender extension. That will isolate whether discovery is healthy but the automatic Arc provisioning workflow is failing.