Explanation:

In Microsoft Defender for DevOps, IaC misconfiguration scanning uses purp ose-built analyzers per template type. For Azure Resource Manager (ARM) and Bicep templates, Defender leverages Template Analyzer , which evaluates security best practices and policy compliance specific to Azure resource definitions.
Template Analyzer parse s Bicep (and ARM JSON) and flags insecure defaults such as overly permissive network rules, missing encryption settings, insecure identity assignments, and more-making it the correct choice for Bicep files .
For container and Kubernetes ecosystem artifacts, including Helm charts , Defender integrates Terrascan , an open-source static analysis tool that scans Helm/Kubernetes manifests (and Terraform) against hundreds of policies. Terrascan inspects rendered Helm templates to detect issues like privileged contai ners, hostPath mounts, missing resource limits, and insecure service exposures.
By contrast, CredScan (Credential Scanner) is aimed at finding embedded secrets (keys/passwords) in code and isn't the primary IaC misconfiguration engine for either Bicep or H elm in Defender for DevOps.
Therefore, to detect IaC misconfigurations: use Template Analyzer for Bicep and Terrascan for Helm charts .