Troubleshooting
What to check when the Defender Plans or Plan Changes page doesn't show what you expect.
Defender Plans Page
A subscription is missing from the list
Answer
Check that the subscription is in your data scope and is not excluded from the Defender Assessments phase under Scope Exclusions. A subscription excluded after earlier scans drops out at the next scan.
I changed a plan in Azure and StratoLens still shows the old setting
Answer
Plans are read at scan time. Run a scan or wait for the next scheduled scan.
No spend amounts appear
Answer
If an error appears under the Subscriptions heading, spend failed to load; reload the page. If there is no error, the subscription has no Defender charges this month, is in a free trial, or only had charges last month. Open the subscription to see both months, and check that Cost Explorer has data for it.
Defender spend doesn't match Cost Explorer
Answer
Compare actual cost (not amortized) for the same calendar month, and include the Other Defender charges line. Only the Microsoft Defender for Cloud meter category is counted; Defender for IoT and Defender EASM are not.
Plan Changes Page
Every plan on a subscription shows as Deleted
Answer
The subscription was not scanned in the newer scan. Check whether it was excluded under Scope Exclusions, removed from your data scope, or whether the scanner lost access to it.
The Activity Explorer doesn't show who changed the plan
Answer
The Activity Log for that window may not include the Microsoft.Security write operation. Widen the time range in the Activity Explorer, and check that Activity Log collection is running for the subscription.