Forum Discussion

AmineB1275's avatar
AmineB1275
Copper Contributor
Jul 16, 2026

Defender for Cloud Container Workloard AWS EKS

Hi, 

We're onboarding an AWS environment with EKS clusters into Defender for Cloud. The AWS connector is configured correctly and everything up to the final step works: the clusters are discovered and visible in the portal, Defender creates its access entries, authenticates into the clusters, and actively polls them (agentless coverage is healthy).

However, the Azure Arc onboarding never initiates. The "Auto provision Defender's sensor for Azure Arc" component is enabled, but Defender never issues the Microsoft.Kubernetes/connectedClusters/write — the Azure Activity Log shows zero attempts of any status, so no connectedCluster is ever created, no azure-arc/mdc namespaces appear, and the Defender sensor is never deployed.

2 Replies

  • AmineB1275's avatar
    AmineB1275
    Copper Contributor
    Jul 17, 2026

    Thank you Jamony for your reply, Permissions checked and the EKS clusters are not private and I ensured to Whitelist IP addresses for Microsoft. 
    I will re-deploy the cloud formation and re-check again after a couple of hours. I already made the manual deployement with helm and it worked but it will require manual upgrade. 

  • Jamony's avatar
    Jamony
    MCT
    Jul 17, 2026

    Agentless discovery succeeding does not prove Arc provisioning has the permissions it needs; those are separate paths. First, check whether the AWS connector was updated after enabling the Arc sensor option. Microsoft requires you to regenerate and redeploy the connector's CloudFormation template so the new Arc provisioning permissions are applied.

     

    On the Azure side, verify the connector identity has the Defender Kubernetes Agent Operator role at the target subscription or resource group, including Microsoft.Kubernetes/connectedClusters/write. Also confirm the EKS cluster is not private-only, because private EKS clusters are not supported for this Arc-based runtime protection path.

     

    After correcting permissions, allow several hours for automatic provisioning. If it still does nothing, use the Defender for Cloud recommendation for EKS Arc onboarding to connect one cluster manually, then deploy the Defender extension. That will isolate whether discovery is healthy but the automatic Arc provisioning workflow is failing.