Using Defender Plans
See which Defender for Cloud plans are on for each subscription, how they are configured, and what they cost. Open Insights > Defender Plans from the left sidebar, or click any tile on the Defender Plans dashboard widget.
5 Sections
Prerequisites
- The View Defender Assessments permission, included in the built-in Viewer, Operator, Manager and Administrator roles. It covers this page and Plan Changes.
- At least one completed scan. You see only subscriptions inside your data scope, for both plans and spend.
- Spend amounts need cost data collection. Without it, plans show without amounts.
- A subscription excluded from the Defender Assessments phase under Scope Exclusions has no plan data. Excluding the phase for the whole tenant turns off plan collection entirely.
Choosing a Scan and Filtering
Plans are read from Azure on every scan, so a change made in the Azure Portal appears after the next scan. The page opens on the most recent scan; pick an older one from the Scan picker to see plans exactly as they were then.
Filters
- Plans
- Shows only subscriptions where at least one selected plan is on. The count badges and the detail panel then cover only the selected plans.
- Status
- Paid plans, Add-ons enabled, Retired still paid, No paid plans. A subscription shows when it matches any selected status. Badges for unselected statuses are hidden.
Filters are kept in the page URL, so you can bookmark or share a filtered view.
The Subscription List
Each row carries round count badges. Only non-zero counts show, and a subscription with no paid plans shows a single grey 0. The coloured dots in the Status filter are the legend.
- Green
- Paid plans that are on.
- Blue
- Enabled add-ons across all plans, including add-ons on free plans.
- Orange
- Paid plans that Microsoft has retired.
- Amount (right)
- Month-to-date Defender spend. Hidden when there are no charges this month, including subscriptions in a free trial or with charges only last month.
The dashboard widget tiles use the same counts, so each tile equals the sum of the matching badges. Select a row to open its detail panel; select it again to close it.
A Subscription's Plans
The detail panel groups every plan Azure reports for the subscription. Use Open in Azure Portal in the panel header to go to Defender for Cloud Environment Settings, where plans are changed.
- Enabled plans
- One card per paid plan that is on, including retired plans that are still on.
- Included at no cost
- Plans that are on but free: Foundational CSPM and Discovery.
- Not enabled
- Plans that are off.
- Retired
- Retired plans that are off, struck through. Hover one for its replacement plans.
"On" does not mean "paid"
Azure reports both paid and free plans as Standard when they are on. StratoLens treats Foundational CSPM and Discovery as included at no cost and every other plan as paid. A plan StratoLens does not recognise appears under its Azure name and is treated as paid.
Plan cards
The green tier badge shows the sub-plan (for example P2) or On. A shield-plus icon inside it means add-ons are enabled; an orange dot beside it means resource coverage is partial or none. Each row below appears only when it has a value.
- Sub-plan
- The plan's variant, such as P1 or P2 for Servers.
- Billed as
- Servers only. Shown when both P1 and P2 billed this month, which happens when some machines are set to P1 under a P2 subscription.
- Enabled since
- When the plan was turned on.
- Free trial remaining
- Time left in the plan's free trial as of the latest scan. A snapshot, not a live countdown.
- Enforce on descendants
- Yes forces the plan's setting onto every resource in the subscription. No lets resources override it.
- Resource coverage
- Fully covered, Partially covered or Not covered, reflecting resource-level overrides such as Defender for Storage turned off on individual storage accounts.
Per-resource overrides are not listed
Resource coverage tells you a subscription has resource-level overrides, not which resources. Use Open in Azure Portal to find them.
The Add-ons list shows each add-on with an Enabled or Disabled badge and its settings underneath. For a large structured setting, such as File Integrity Monitoring rules, click View to open the full value in a dialog.
Viewing an older scan
Every plan setting shows its value at the selected scan, except Free trial remaining and Resource coverage, which always show the most recent scan's value.
Retired Plans
A retired plan that is still on stays under Enabled plans with a Retired badge, an orange left edge and a Replaced by row naming the plans to move to. It counts toward the orange badge and the Retired still paid status. A retired plan that is off moves to the Retired section.
Find retired plans still billing
Filter by the Retired still paid status to list every subscription still paying for a retired plan.
Defender Spend
The panel header shows two badges, this month in green and last month in grey, each prefixed with the month (for example "Oct $8.39"). Spend is actual cost, not amortized, from the same cost data as Cost Explorer. Only the Microsoft Defender for Cloud meter category counts; Defender for IoT and Defender EASM do not.
Spend follows the calendar, not the scan
Spend always covers the current and previous calendar month, whatever scan you select. The current month is month to date. A header showing $0.00 this month with charges last month usually means plans were turned off.
Each plan card shows, in order of precedence:
- This month and last month badges, when the plan had charges in either month. A card never shows $0.00.
- A Trial badge, when the plan has no charges but is in a free trial.
- Nothing, otherwise.
How charges are assigned
- SQL
- Charges for Azure SQL and Synapse resources go to Azure SQL Databases. Charges for SQL on virtual machines and Arc-enabled machines go to SQL Servers on Machines.
- Other Defender charges
- Charges that belong to no single plan, such as Defender reservations, appear on a line below the sections. The header total always equals the plan cards plus this line.
- Mixed currency
- Charges in more than one currency are summed, and the amount's tooltip says so.
Spend loads separately from plans. If it cannot load, an error appears under the Subscriptions heading and plans still display without amounts.