Defender for Cloud Pricing: What the Azure Portal Doesn't Tell You

The Bill That Arrives Three Weeks Late

We have seen this pattern on roughly half the Azure engagements we pick up mid-flight. A team enables Defender for Cloud across a subscription, treats it as a checkbox, and then gets a $4,000-$12,000 overage on the monthly invoice. The root cause is almost always the same: they enabled one plan thinking it was the whole product, or they forgot that Log Analytics workspace ingestion costs are entirely separate and stack on top of every Defender plan they turned on.

Defender for Cloud is not a single SKU. It is a family of per-resource-type plans, each billed independently, and Microsoft is not shy about adding new billable dimensions when they restructure a plan. The pricing page is accurate but dense; the in-portal recommendations UI is not designed to help you understand what enabling a recommendation will cost.

This note walks through the current plan structure, the specific numbers that matter, where the surprise multipliers hide, and a KQL query you can run today to audit your actual exposure.

Free Tier vs. Paid Plans: What You Actually Get Without Spending Anything

The foundational CSPM tier is free. It gives you Secure Score, the recommendations list, regulatory compliance dashboards (NIST, CIS, PCI DSS mappings), and basic cloud security posture assessment across Azure resources. For a team that just wants to know where they stand without any ongoing cost, that is genuinely useful.

What the free tier does not give you: workload protections, threat detection alerts, JIT VM access, adaptive application controls, file integrity monitoring, or the enhanced posture features under Defender CSPM (the paid CSPM plan). It also does not give you multi-cloud coverage, which requires paid connectors for AWS and GCP.

Once you cross into paid territory, you are buying per-plan, not per-seat or per-subscription.

Current Plan Pricing: The Numbers That Matter

As of mid-2026, the plans we encounter most often break down like this. All prices are per resource per month unless noted:

Defender for Servers Plan 1: ~$5 per server. Includes JIT VM access and 500 MB/day free Log Analytics ingestion per machine. Does not include Microsoft Defender for Endpoint (MDE) licensing.
Defender for Servers Plan 2: ~$15 per server. Includes MDE P2, vulnerability assessment via Qualys or MDVM, file integrity monitoring, and the full 500 MB/day Log Analytics allowance. If you are paying separately for MDE on Azure VMs, Plan 2 often cancels that cost out, making the net delta smaller than it looks.
Defender CSPM (paid): ~$0.007 per billable resource per month. "Billable resource" maps to a specific resource type list. A subscription with 1,500 resources is roughly $10-$15/month for CSPM alone, which is negligible, but the attack paths, cloud security explorer, and agentless scanning features are behind this plan.
Defender for Containers: billed per vCore of the AKS node pool, currently around $7/vCore/month. A modest production cluster with 12 x 4-vCore nodes runs $336/month just for container protection. This one bites teams that treat AKS as cheap compute.
Defender for Storage: this plan changed its billing model. Current pricing is per-storage-account per month (~$10/account) with an optional transaction-based add-on for malware scanning (~$0.15/GB scanned). A tenant with 80 storage accounts across environments is looking at $800/month before any malware scanning volume.
Defender for App Service: ~$15 per App Service plan (not per app). If you are running 20 App Service plans, that is $300/month, and many teams are surprised that "plan" here means the compute tier, not the Defender plan.
Defender for Key Vault: ~$0.02 per 10,000 transactions. Low-volume vaults are nearly free; a vault that issues secrets at scale can generate surprising costs.
Defender for Resource Manager: ~$4 per subscription per month. Flat, low, and usually worth it for ARM-layer threat detection.
Defender for APIs: ~$0.007 per API call assessed. This one scales directly with traffic and can become meaningful fast for high-throughput APIs registered in API Management.

Multi-cloud connectors for AWS (via the CSPM or Servers plans) add a per-resource surcharge that mirrors the Azure pricing. GCP connector pricing follows the same pattern.

The Hidden Multiplier: Log Analytics

Every alert Defender for Cloud generates, and every diagnostic log it collects, lands in a Log Analytics workspace. That workspace has its own billing based on data ingestion and retention.

The 500 MB/day free allowance per server under Plans 1 and 2 sounds generous until you turn on process creation events, network connection logging, or DNS query logs. A busy Windows server with verbose audit policy can push 2-4 GB/day without any application logs. At the Pay-As-You-Go rate of roughly $2.76/GB (Commitment tiers start at 100 GB/day and drop to $1.50-$2.00/GB), a 50-server fleet with aggressive logging can generate $3,000-$8,000/month in pure Log Analytics costs on top of the Defender plan fees.

The fix is a combination of data collection rule (DCR) scoping, commitment tier pricing, and table-level retention policies. We cover the architecture in more detail on the detection engineering practice page, but the short version is: do not inherit the default collection policy and assume it is safe.

Auditing Your Current Exposure With KQL

This query runs against your Azure Cost Management data exported to Log Analytics, or via the Azure Resource Graph for plan coverage. The second query is what we use to map which plans are actually enabled per subscription:

// Run in Azure Resource Graph Explorer
// Maps Defender plan states across all subscriptions
SecurityResources
| where type == "microsoft.security/pricings"
| extend
    PlanName     = name,
    PricingTier  = properties.pricingTier,
    SubPlan      = tostring(properties.subPlan),
    ResourceType = tostring(properties.resourceType)
| project
    subscriptionId,
    PlanName,
    PricingTier,
    SubPlan,
    ResourceType
| where PricingTier == "Standard"
| summarize EnabledPlans = make_set(PlanName) by subscriptionId
| order by subscriptionId asc

Pair that with a cost query from your billing export:

// Run against your Cost Management export in Log Analytics
AzureDiagnostics
| where ResourceProvider == "MICROSOFT.SECURITY"
| union (
    Usage_CL
    | where ServiceName_s contains "Defender"
)
| summarize TotalCostUSD = sum(todouble(PreTaxCost_d))
    by ServiceName_s, bin(TimeGenerated, 1d)
| order by TotalCostUSD desc

The Resource Graph query is the one we run first on every new engagement. It tells us in 30 seconds which plans are live and whether sub-plan distinctions (Plan 1 vs Plan 2 for Servers) are configured correctly. Teams that enable Defender through Policies or Blueprints sometimes end up with Plan 2 everywhere when Plan 1 would cover their actual use case.

Where We Usually Find Savings

Three patterns repeat often enough that we check them on every cost review.

First, non-production environments running Plan 2. Dev and staging environments rarely need MDE, vulnerability scanning, and file integrity monitoring at the same fidelity as production. Dropping them to Plan 1 or disabling Defender for Servers entirely and relying on the free CSPM tier for posture visibility is defensible for ephemeral environments. Tag-based exclusion policies in Azure Policy can enforce this automatically.

Second, Defender for Containers enabled on clusters that already have a third-party CNI security tool (Calico Enterprise, Cilium with Hubble, Aqua). The overlap is real. We are not saying disable Defender for Containers universally; the integration with Microsoft Sentinel and the native threat detection on AKS control-plane events has value. But if you are paying for both and only consuming one set of alerts, that is budget leaking.

Third, storage account sprawl. Teams that create storage accounts liberally across resource groups, often as Terraform outputs from module patterns, end up with 60-100 storage accounts in a subscription when 15-20 would cover the actual workload. Defender for Storage charges per account. A storage account consolidation exercise, which has other operational benefits, pays for itself fast.

When to Engage Before the Bill Arrives

The right time to model Defender for Cloud costs is before you enable plans at the management group level via Policy. Retroactive cleanup requires disabling plans, waiting for the billing cycle to close, and re-enabling at the right scope, and you still pay for the month you over-enabled.

We do pre-enablement cost modeling as a fixed deliverable: scope the resource inventory, map each Defender plan to actual detection requirements, project monthly cost at P5/P50/P95 resource growth, and output a Bicep or Terraform module that enforces the approved plan set via Azure Policy with deny effects on unapproved upsells.

If your team is already past that point and the bill is a problem, the audit starts with the Resource Graph query above and a 30-minute call to understand your actual threat model.

For next steps or to scope a Defender for Cloud cost and coverage review, reach out to the KeMeT Tech team.