Defender Plans
A per-subscription inventory of your Microsoft Defender for Cloud plans, refreshed on every scan. You see what each plan costs, and you can compare any two scans to see what changed.
What You'll Learn
- Which Defender plans are on for each subscription, with sub-plan, add-ons and settings
- How Defender charges break down per plan and per subscription, this month and last month
- How to find every plan change between two scans, and who made it
Key Capabilities
Plan inventory per subscription
Every Defender for Cloud plan on every subscription, with sub-plan, enablement date, add-ons and their settings, captured on every scan.
Paid versus included
Paid plans are separated from the always-free plans (Foundational CSPM, Discovery), so "on" never gets confused with "paid".
Defender spend per plan
This month's and last month's actual Defender charges on each subscription and on each enabled plan, with free trials marked.
Retired plans still billing
Plans Microsoft has retired but that are still on and paid are flagged and filterable, with their replacement plans named.
Scan-to-scan plan changes
Compare any two scans to see which plans were turned on, turned off, or had a setting or add-on changed.
Who changed it
Jump from a subscription's plan changes to the Activity Explorer for the window between the two scans.
Related Features
Feature Integration
- Dashboard: the Defender Plans widget shows Subscriptions covered, Paid plans enabled, Add-ons enabled and Retired still paid. The Add-ons enabled and Retired still paid tiles open the Defender Plans page filtered to that status. A row in its Recent Changes list opens Plan Changes with that scan and the one before it selected.
- Notification Alerts: the Defender Plan Changes alert type (off by default) sends plan changes by email or webhook, linking straight to Plan Changes. Rule filters narrow it by subscription and management group only.
- Activity Explorer: the Activity button on Plan Changes opens it for the time between the two scans.
- Cost Explorer: Defender spend comes from the same cost data and matches Cost Explorer's Microsoft Defender for Cloud charges in actual cost for the same month.
- Scan History: the Changes tab in Scan Details has a Defender Planscard with that scan's Added, Modified and Deleted counts.
- Data Exclusions: excluding a subscription or the tenant from the Defender Assessments phase also stops plan collection for it.
Documentation Sections
Start with the plan inventory, then read Plan Changes to track what changes between scans.
Using Defender Plans
Filter subscriptions, read plan cards and add-ons, and understand Defender spend.
Read: Using Defender Plans →Plan Changes
Compare two scans to see which plans were added, modified or deleted.
Read: Plan Changes →Troubleshooting
Missing subscriptions, missing or mismatched spend, and unexpected change types.
Read: Troubleshooting →