Plan Changes
See which Defender plans were turned on, turned off or reconfigured between two scans, per subscription. Open Insights > Plan Changes from the left sidebar, or follow a row in the dashboard widget's Recent Changes list or a Defender Plan Changes alert, which arrive with the scans already selected.
Turning a plan on is a Modified change
Turning a plan on or off shows as Modified, with Tier Free → Standard or the reverse. Added and Deleted mean Azure started or stopped reporting the plan for the subscription.
3 Sections
Jump to a section below.
Prerequisites
The View Defender Assessments permission, as on the Defender Plans page, and at least two completed scans.
Choosing Scans and Filtering
The page compares the two most recent scans by default. Pick different ones with the Older Snapshot and Newer Snapshot pickers. The newer scan must come after the older one: picking a pair in the wrong order clears the newer picker. Changing either snapshot clears the selected subscription.
Filters
- Plans
- Shows only changes to the selected plans. The options are the plans that changed between the two scans.
- Changes
- Any mix of Added, Modified and Deleted.
Only subscriptions with at least one change are listed. Each row shows round badges: green for added, orange for modified, red for deleted, following the Changes filter. Both scans, the selected subscription and the filters are kept in the page URL, so you can bookmark or share a comparison.
Reading the Changes
Select a subscription to see its changes, grouped into Added, Modified and Deleted sections. Each card shows the plan name with a green tier badge when it is a paid plan that is on, and a Retired badge when Microsoft has retired the plan.
Added
Azure started reporting the plan for the subscription, for example a new plan type or a subscription newly in scope. The card lists the plan's tier, sub-plan, enablement date, resource coverage and enabled add-ons.
Modified
A tracked property changed. One before → after row per changed property, with "not set" for a side that has no value.
Deleted
Azure stopped reporting the plan. Usually the subscription left the scan scope (removed, access lost or excluded), or Microsoft removed the plan from its pricing list. The card shows the last known state.
What counts as a change
A plan is Modified when any of these change: Tier, Sub-plan, Enabled since, Enforce on descendants, Retired, Replaced by, or any add-on's enabled state or settings. Disabling and re-enabling a plan between scans shows as Modified with a new Enabled since, even though the tier is the same.
Never reported as changes
Free trial remaining counts down every scan and Resource coverage is reported inconsistently by Azure, so neither ever makes a plan Modified.
The Add-ons list on a Modified card has one row per changed add-on, with an Enabled → Disabled pair (or the reverse) when its state changed and the changed settings underneath. Add-on names are Azure's names split into words. For a large structured setting, such as File Integrity Monitoring rules, click View on either side to open that value in a dialog.
Servers upgraded to P2 with agentless scanning
Defender for Servers moved from P1 to P2 and agentless scanning was enabled. Plan Changes shows one Modified card with Sub-plan P1 → P2 and an Agentless Vm Scanning add-on row going from Disabled to Enabled.
Finding Who Made the Change
Plan data does not record who changed a plan. Click Activity in the subscription panel to open the Activity Explorer in a new tab, limited to that subscription and the time between the two scans.
Needs Microsoft.Security operations in the Activity Log
The Activity Explorer shows who made a change only if Activity Log collection includes Microsoft.Security operations for that subscription.