What it is
A Microsoft Defender for Cloud plan that Microsoft has retired, still set to the Standard pricing tier on a subscription and still producing charges. The canonical pair is Defender for Container Registries (ContainerRegistry) and Defender for Kubernetes (KubernetesService), both superseded by Defender for Containers. Azure flags these rows with properties.deprecated: true and names the successor in properties.replacedBy, but it does not disable them, so a subscription that turned them on in 2021 is paying for them in 2026, usually next to the successor plan that already covers the same registries and clusters.
Why it happens
Plan retirement in Defender for Cloud is a one-way door that only blocks the way in. Microsoft's documentation for the retired container plans says it plainly: if the plan is already enabled on a subscription you can keep using it, you just won't get Defender for Containers' improvements and new features, and the plan is no longer available where it isn't already on. In July 2026 Microsoft went further and made the plan-enablement API refuse new onboarding to five deprecated plans (Defender for Azure Kubernetes Service, Defender for Azure Container Registry, Defender for Key Vault, Defender for DNS, Defender for Azure Resource Manager), while stating that existing subscriptions "continue to receive product access, value, and billing" and that no retirement date has been announced. Nothing in that sequence ever flips an enabled plan to Free.
The portal does not make this visible. The Defender plans page lists what is on and off; a retired plan that is on looks like any other enabled plan, and the successor sits in the same list as a separate toggle. Teams that adopted Defender for Containers when it went GA typically enabled the new plan and never went back to disable the old ones, because the old ones were still "working."
The API tells the truth if you ask it. On Microsoft.Security/pricings (api-version 2024-01-01), deprecated is documented as "True if the plan is deprecated. If there are replacing plans they will appear in replacedBy," and replacedBy as the list of plans that replace this one, present only when the plan is deprecated. The same rows are queryable tenant-wide in Azure Resource Graph's securityresources table.
One trap when you go looking: pricingTier == 'Standard' is not proof of spend. Foundational CSPM and Discovery are always-on, no-cost plans that report Standard on every subscription. Filter on the deprecated flag, not on the tier alone.
What it costs / blast radius
The cost is the retired plan's meter, every month, for protection the successor already delivers. Defender for Containers lists at about $0.0094 per vCore-hour, roughly $7 per vCore per month at list price in East US (Azure Retail Prices API; your contract may differ), billed on the vCores of your Kubernetes worker nodes. The retired Container Registries and Kubernetes plans billed on their own meters (Microsoft's documentation for the registries plan: charged once per image scanned); those meters no longer appear in the public Retail Prices catalog, so the only honest number is the one on your invoice under the Defender for Cloud meter category for those plan names. A subscription running both the old pair and Defender for Containers is paying for the same clusters and registries twice, and the duplicate line is one nobody expects to see, so nobody questions it.
The security cost is quieter. A retired plan's detections stop improving on the day it is deprecated: Defender for Containers gained agentless registry and runtime scanning powered by Microsoft Defender Vulnerability Management, Kubernetes node vulnerability assessment, binary drift detection, and admission-time misconfiguration enforcement; none of that reaches a subscription still relying on the old plans. A team that believes "we have Defender on our containers" because two legacy toggles are green has a coverage gap it is actively paying for. (Azure behavior; authored assessment.)
See it
// Defender plan rows live in securityresources. The deprecated flag,
// not the Standard tier, is the signal: Foundational CSPM and Discovery
// are always-on no-cost plans that also report Standard.
securityresources
| where type == 'microsoft.security/pricings'
| where tostring(properties.pricingTier) =~ 'Standard'
| where tolower(tostring(properties.deprecated)) == 'true'
| project subscriptionId, retiredPlan = name,
replacedBy = tostring(properties.replacedBy),
enabledSince = tostring(properties.enablementTime)
| order by subscriptionId asc, retiredPlan asc# Run in the context of the affected subscription (az account set -s <subscriptionId>).
# 1. Confirm the successor covers you before touching the old plans.
az security pricing show --name Containers --query pricingTier -o tsv
# expect: Standard
# 2. Turn the retired plans off. Azure blocks new enablement of retired
# plans, so expect no way back: step 1 is the whole safety net.
az security pricing create --name ContainerRegistry --tier free
az security pricing create --name KubernetesService --tier freeHow StratoLens helps
StratoLens inventories every Defender for Cloud plan on every subscription in your tenant and marks the ones Azure has flagged deprecated but that are still on a paid tier, as a "Retired still paid" status you can filter on and a dashboard count you can watch go to zero, next to the observed spend per plan from your cost data. The duplicate line stops hiding inside the Defender total.
