Defender for Cloud in one page (plus a mock case)

Defender for Cloud has a lot of plans. Every plan has its own toggle, its own scope rules and its own idea of who's allowed to touch it. My readiness notes for this topic were mostly question marks. So I did what I always do: rebuilt it in my lab and checked every answer against Microsoft Learn (October 2026).

Part 1 is the one-page version: what you get for free, what you pay for, where each plan can be turned on, and who can change what. Part 2 is a mock case: three small puzzles from my notes, each with the answer.

My lab: a Contoso tenant, subscription sub-lab-prod, resource group rg-lab-mdc with a Windows Server VM vm-lab-01 and a storage account stlabmdc01, a Log Analytics workspace law-lab-mdc, and two test users, lab-reader@contoso.com and lab-secadmin@contoso.com. All names and numbers are made up.

TL;DR

• Defender for Cloud is posture (CSPM) plus workload protection (CWPP). Foundational CSPM is free: recommendations, secure score, asset inventory and the Microsoft cloud security benchmark. Alerts and extra regulatory standards come with paid plans.
• Most plans are switched on per subscription. Storage, SQL and open-source relational databases can also go per resource, and Defender for Servers Plan 1 can go per machine. Plan 2 can't.
• Security Reader looks, Security Admin changes policy and plans, Owner can do everything. Some features (agentless scanning with Defender CSPM) only switch on fully when an Owner enables the plan.

Lab at a glance

Table of contents

• Part 1: Defender for Cloud in one page
  • CSPM plus CWPP
  • Foundational CSPM vs Defender CSPM
  • The plans and where you can turn them on
  • Who can do what
  • How to enable plans, one or a hundred
  • Secure score and recommendations
  • Regulatory compliance basics
• Build
• Verify
• Break it
• Fix
• Clean up
• Mock case: three puzzles from my notes
• Gotchas
• Checklist
• Sources

Part 1: Defender for Cloud in one page

CSPM plus CWPP

Microsoft calls Defender for Cloud a cloud-native application protection platform (CNAPP). Big name, three parts:

It covers Azure, AWS, GCP and on-premises machines (through Azure Arc). It's also moving into the Defender portal, so some pages now exist in two places. The Azure portal is still where you configure most things.

Foundational CSPM vs Defender CSPM

When you open Defender for Cloud on a subscription, you already have Foundational CSPM. It's free and needs no toggle.

So what do you get with no paid plan at all? Posture. You see what's wrong and how to fix it, scored against MCSB. What you don't get: security alerts and incidents. Those need a workload protection plan.

Defender CSPM bills per resource type (VMs, storage accounts, databases and a few more). Learn keeps the full list and the pricing page has the numbers. I won't quote prices here because they change more often than my lab passwords.

The plans and where you can turn them on

The plans you toggle on Environment settings > your subscription > Defender plans:

Two notes:

• Defender for DNS is no longer a separate plan for new subscriptions. Its alerts are part of Defender for Servers Plan 2. Old subscriptions that already had it can keep the standalone plan.
• Learn recommends subscription level for Servers. Resource level is for mixing plans or excluding machines, not for saving money by picking favorites.

Who can do what

Defender for Cloud uses Azure RBAC. Here is Learn's role table, shortened:

The fine print that bites:

• Security Admin, Contributor and Owner can all toggle plans, but Learn says Owner is needed to enable all capabilities of a plan. Example: if someone below Owner enables Defender CSPM, agentless scanning isn't turned on, and attack path analysis stays empty of vulnerabilities.
• Security Admin can't use Fix. Contributor can, but can't edit policy. Nobody gets everything except Owner. That's the point.

How to enable plans, one or a hundred

In the API and in policies, standard means a plan is on and free means it's off. Useful when you read JSON at 11 pm.

Secure score and recommendations

Recommendations come from the security standards assigned to your scope. MCSB is assigned by default. The secure score turns them into one number: higher score, lower risk.

What counts:

• Only built-in MCSB recommendations affect the score. Preview recommendations don't.
• Recommendations are grouped into security controls. You only get a control's points when all its recommendations are fixed on all resources. Fixing half of "Secure management ports" gives you exactly nothing. Sorry.
• Controls are recalculated every eight hours, so the score lags behind the recommendation list.
• There are now two secure scores: the classic one in the Azure portal, and the risk-based Cloud Secure Score in the Defender portal. Different math, different numbers. Don't compare them in a meeting.

Regulatory compliance basics

• Standards are Azure Policy initiatives. MCSB is on by default (plus AWS and GCP defaults for those clouds).
• Other standards (ISO 27001, NIST, PCI DSS, CIS and many more) need a paid plan. Learn's assignment page says any plan except Defender for Servers Plan 1 or Defender for APIs Plan 1. The CSPM comparison lists regulatory compliance assessments under Defender CSPM.
• Assigning a standard happens in the Azure portal. The Defender portal only shows progress.
• A standard with no relevant resources doesn't show up on the dashboard, even when it's assigned.
• Controls that can't be checked automatically show as greyed out. Green on the dashboard is not a certificate. An auditor still wants to talk to you.

Build

You do all of this as Owner on sub-lab-prod, unless a step says otherwise.

Step 1. See what you have for free

1. In the Azure portal, open Microsoft Defender for Cloud.
2. Go to Environment settings > sub-lab-prod > Defender plans.
3. You should see Foundational CSPM included and the paid plans Off (if nobody touched this subscription before).

Same view from Cloud Shell:

az security pricing list --subscription sub-lab-prod -o table

Every plan with tier Free is off.

Step 2. Give two test users two different roles

In sub-lab-prod > Access control (IAM):

• lab-reader@contoso.com gets Security Reader.
• lab-secadmin@contoso.com gets Security Admin.

We'll use them in Break it.

Step 3. Turn on Defender for Servers Plan 1 for one VM only

Leave Servers Off at subscription level. Then turn on Plan 1 for vm-lab-01 with the Pricings REST API (from any REST client):

PUT https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/rg-lab-mdc/providers/Microsoft.Compute/virtualMachines/vm-lab-01/providers/Microsoft.Security/pricings/virtualMachines?api-version=2024-01-01

{
  "properties": {
    "pricingTier": "Standard",
    "subPlan": "P1"
  }
}

Only that VM is now covered. The subscription-level toggle still says Off.

Step 4. Set up continuous export

1. Environment settings > sub-lab-prod > Continuous export, tab Log Analytics workspace.
2. Data types: Security recommendations and Secure score.
3. Frequency: Streaming.
4. Target: law-lab-mdc.
5. When the page asks where to save the configuration, pick a new resource group: rg-lab-mdc-export. Remember this. It's mock case 1.
6. Save.

Verify

1. Plans. Open the coverage workbook (Defender for Cloud > Workbooks). It shows which plans are on per subscription and per resource. You should see vm-lab-01 with Servers Plan 1 while the subscription shows Servers off.
2. Recommendations. Open Recommendations. Within minutes to hours you should see items for vm-lab-01 and stlabmdc01.
3. Secure score. Check the tile on Overview, or run this in Azure Resource Graph Explorer:

   SecurityResources
   | where type == 'microsoft.security/securescores'
   | extend current = properties.score.current, max = todouble(properties.score.max)
   | project subscriptionId, current, max, percentage = ((current / max)*100)

A brand-new subscription may need a few rounds of the eight-hour cycle before the number settles.

1. Compliance. Regulatory compliance should show MCSB only.
2. Export. In Cloud Shell:

   az security automation list -g rg-lab-mdc-export -o table

You should see one automation. In law-lab-mdc, rows land in SecurityRecommendation. Streaming only sends data when a health state changes, so a quiet lab means a quiet table.

Break it

Three small breaks, all on purpose.

Break 1. The reader wants to help. Sign in as lab-reader@contoso.com and open Environment settings > sub-lab-prod > Defender plans. Try to switch Defender CSPM to On. Security Reader is read-only, so this shouldn't save.

Break 2. The admin wants ISO 27001. Sign in as lab-secadmin@contoso.com. Open Regulatory compliance > Manage compliance policies > sub-lab-prod > Security policies and look for ISO IEC 27001:2022. With only Foundational CSPM and one VM on Servers Plan 1, the subscription doesn't meet the plan requirement for extra standards. Note what the portal shows you here. That's mock case 2.

Break 3. Plan 2 for one VM. Change the body from Step 3 to "subPlan": "P2" and send it again. Learn is clear: Plan 2 can't be enabled at resource level, only disabled. Don't expect this to work.

Fix

Fix 1. Plans are changed by Security Admin, Contributor (subscription) or Owner. Give the reader a role that fits the job, or let the admin do it. Don't hand out Owner because someone asked nicely.

Fix 2. Two things must be true:

1. A qualifying plan is on. As Owner, turn on Defender CSPM for sub-lab-prod (Owner, so agentless scanning gets switched on too). Any paid plan except Servers Plan 1 or APIs Plan 1 meets Learn's prerequisite.
2. The person adding the standard has Owner or Policy Contributor (Learn's assignment page). The role table also lists Security Admin for adding initiatives. If the toggle still won't move, check the role at the exact scope you picked.

Then turn ISO IEC 27001:2022 On. It appears on the dashboard once there are relevant resources to assess.

Fix 3. If you want Plan 2, enable it at subscription level. If some machines should stay on Plan 1, downgrade them per machine with "subPlan": "P1". If some shouldn't be covered at all, set them to "pricingTier": "Free".

Clean up

Paid plans keep billing after the trial. Clean up the same day.

1. Environment settings > sub-lab-prod > Defender plans: switch off Defender CSPM, Servers and anything else you enabled. The plan's extensions aren't uninstalled, but they stop collecting data after a while.
2. If you ever enabled Servers Plan 2 on a Log Analytics workspace, switch it off there too. It doesn't follow the subscription.
3. Remove the per-VM setting for vm-lab-01 with a DELETE on the same pricing URL from Step 3.
4. Delete the export: az security automation delete -g rg-lab-mdc-export -n <automation name>, or remove it on the Continuous export page.
5. Switch off any compliance standards you added.
6. Remove the role assignments and the two test users.
7. Delete rg-lab-mdc, rg-lab-mdc-export and law-lab-mdc if they were only for this lab.

Mock case: three puzzles from my notes

Same lab, same Contoso, three questions I had written down with no answers. Here they are, with the answers from Learn.

Puzzle 1. "Why does continuous export want a resource group? Export isn't a resource."

The setup. You configure continuous export for sub-lab-prod, and the page asks you for a resource group. A colleague asks what gets deployed there. Nobody remembers creating anything.

The answer. Export is a resource. The configuration is saved as a security automation: resource type Microsoft.Security/automations. Its REST path lives under /subscriptions/{id}/resourceGroups/{rg}/providers/Microsoft.Security/automations/{name}. That's why it needs a resource group. The Azure Policy version of continuous export asks for the same thing: resource group name and location.

How to find it.

az security automation list -o table                    # all automations in the subscription
az security automation list -g rg-lab-mdc-export -o table
az security automation show -g rg-lab-mdc-export -n <automation name>

The output shows the scopes (what is exported), the sources (alerts, assessments, secure score) and the actions (which workspace or event hub).

What to remember.

• Delete the resource group, and you delete the export with it. Put it somewhere boring and permanent, not in a test group someone cleans up on Fridays.
• The portal handles one export configuration per subscription, at subscription scope. The API can create several, and can scope one to a resource group. If someone did that, the portal shows a banner saying other configurations exist.
• The person setting it up needs Security Admin or Owner on that resource group, plus write access to the target.

Puzzle 2. "Why can't I add a regulatory compliance standard?"

The setup. lab-secadmin@contoso.com opens Manage compliance policies to add ISO 27001 and can't. The subscription runs Foundational CSPM plus Defender for Servers Plan 1 on one VM.

The answer. Two gates, and both must open:

The fix. Turn on a qualifying plan (Defender CSPM is the natural one for compliance), then add the standard with the right role. That's what we did in Fix 2.

Two look-alikes that are not this problem:

• A standard is assigned but missing from the dashboard: there are no relevant resources for it in that scope.
• Some controls inside a standard are greyed out: they can't be assessed automatically. That's expected, not broken.

Puzzle 3. "A third-party EDR is installed, but 'Endpoint protection should be installed on your machines' stays unhealthy"

The setup. vm-lab-01 runs a third-party EDR. Someone's old runbook says to check Endpoint protection should be installed on your machines. It looks unhealthy, and the security team insists the EDR is fine.

The answer. That recommendation is retired. Learn lists Endpoint protection should be installed on machines and Endpoint protection health issues on machines should be resolved as deprecated. They relied on the Log Analytics agent (MMA), and MMA-based scanning was deprecated in November 2024. If an old runbook, a saved query or a dashboard still points at them, you're looking at a ghost.

Today the check is agentless, and the recommendations are:

• EDR solution should be installed on Virtual Machines (plus versions for EC2 and GCP)
• EDR configuration issues should be resolved on virtual machines (Defender for Endpoint settings)

What to check, in order:

1. Plan. The agentless EDR check needs Defender for Servers Plan 2 or Defender CSPM. Our VM has Servers Plan 1 only, so the new check doesn't run there. That alone explains a lot.
2. Agentless scanning. It must be on. It's on by default in both plans, but remember Owner: if someone below Owner enabled Defender CSPM, the scanner may be off.
3. Supported product. Learn has a short list of supported non-Microsoft EDRs, and some only count on certain platforms or install methods. If yours isn't on the list, Defender for Cloud can't see it, no matter how healthy it is.
4. Where the machine lives. Azure, AWS and GCP machines are supported. On-premises servers aren't, for these agentless recommendations.
5. What it found. Open the recommendation, tab Healthy resources, column Discovered EDRs. If your EDR shows up there, you're done.
6. Patience. After a change it can take up to 24 hours for the machine to move to Healthy.

If the EDR is real but not detected: exempt the machine with category Resolved through third-party service (mitigated). Mitigated exemptions count as healthy. For these EDR assessments, Learn says the Azure CSPM initiative must be assigned (it's on by default with Defender CSPM), and exemptions in general need MCSB assigned.

Careful with Fix. The Enable Microsoft Defender for Endpoint integration action only appears when no supported third-party EDR is detected, and it installs the Defender for Endpoint sensor on all Windows and Linux servers in the subscription. Running two EDR products on one server is a conversation you want to have before, not after.

Gotchas

• Free isn't nothing. Foundational CSPM gives you recommendations, secure score and MCSB at no cost. It doesn't give you alerts.
• Owner matters. Security Admin can turn on Defender CSPM, but agentless scanning only comes with it when an Owner does it.
• Plan 2 is all or nothing per subscription. You can switch it off per machine, but not on.
• Workspace plans don't follow the subscription. Servers Plan 2 enabled on a workspace must be switched off on the workspace.
• Trials don't pause. A 30-day trial starts when you enable a plan. Storage malware scanning isn't included in the free trial at all.
• Two secure scores. Azure portal classic score and Defender portal Cloud Secure Score use different math.
• Export lives in a resource group. Delete the group, lose the export.
• Old recommendation names. Anything that says "Endpoint protection should be installed" is from the MMA era.

Checklist

• [ ] Know which plans are on: az security pricing list and the coverage workbook
• [ ] Resource-level settings documented (Servers Plan 1 per machine, Storage, SQL)
• [ ] Roles reviewed: Security Reader to look, Security Admin for policy and plans, Owner only where needed
• [ ] Defender CSPM enabled by an Owner if you need agentless scanning
• [ ] Secure score checked after at least one eight-hour cycle
• [ ] Extra compliance standards backed by a qualifying plan and added by the right role
• [ ] Continuous export: automation found in its resource group, data arriving in SecurityRecommendation
• [ ] EDR checked with the new agentless recommendation, Discovered EDRs column reviewed
• [ ] Lab plans, per-VM settings, export, standards and role assignments cleaned up

Which Defender for Cloud toggle surprised you the most when the bill arrived? Mine would have been a workspace-level plan I forgot existed.

Sources

• Microsoft Defender for Cloud overview
• What is Cloud Security Posture Management (CSPM)
• Connect your Azure subscriptions
• User roles and permissions
• Protect your servers with Defender for Servers
• Select a Defender for Servers plan
• Deploy Microsoft Defender for Storage
• Protect your resources with Defender CSPM
• Onboard a management group to Microsoft Defender for Cloud
• az security pricing
• Cloud secure score in Microsoft Defender for Cloud
• Regulatory compliance in Defender for Cloud
• Assign regulatory compliance standards
• Set up continuous export in the Azure portal
• Set up continuous export with Azure Policy
• Set up continuous export with REST API
• Export alerts and recommendations with continuous export
• Automations - Create Or Update (REST API)
• az security automation
• Detecting endpoint detection and response solutions
• Remediate EDR solution recommendations
• Assess Defender for Endpoint EDR settings
• Compute security recommendations reference
• Deprecated security recommendations reference
• Exempt resources from recommendations