Defender for Cloud Pricing 2026: Per-Plan Costs

The Bill That Arrives Three Weeks Late

We have seen this pattern on roughly half the Azure engagements we pick up mid-flight. A team enables Defender for Cloud across a subscription, treats it as a checkbox, and then gets a $4,000-$12,000 overage on the monthly invoice. The root cause is almost always the same: they enabled one plan thinking it was the whole product, or they forgot that Log Analytics workspace ingestion costs are entirely separate and stack on top of every Defender plan they turned on.

Defender for Cloud is not a single SKU. It is a family of per-resource-type plans, each billed independently, and Microsoft is not shy about adding new billable dimensions when they restructure a plan. The pricing page is accurate but dense; the in-portal recommendations UI is not designed to help you understand what enabling a recommendation will cost.

This note walks through the current plan structure, the specific numbers that matter, where the surprise multipliers hide, and a KQL query you can run today to audit your actual exposure.

Free Tier vs. Paid Plans: What You Actually Get Without Spending Anything

The foundational CSPM tier is free. It gives you Secure Score, the recommendations list, and assessment against the Microsoft Cloud Security Benchmark, on Azure, AWS and GCP. NIST, CIS and PCI DSS compliance dashboards need the paid Defender CSPM plan. From October 27, 2026, new Azure subscriptions start with Foundational CSPM off, so you have to turn it on. For a team that just wants to know where they stand without any ongoing cost, that is genuinely useful.

What the free tier does not give you: workload protections, threat detection alerts, JIT VM access, file integrity monitoring, or the enhanced posture features under Defender CSPM (the paid CSPM plan). Paid plans on AWS and GCP resources bill per resource, the same way they do on Azure.

Once you cross into paid territory, you are buying per-plan, not per-seat or per-subscription.

Current Plan Pricing: The Numbers That Matter

These are Microsoft's East US list prices as of September 2026, from the Azure Retail Prices API. Hourly meters are converted at 730 hours a month. Your region and agreement will change them, so confirm on the Defender for Cloud pricing page.

Defender for Servers Plan 1: about $4.91 per server per month. Covers the Defender for Endpoint integration (EDR). No free Log Analytics allowance, no just-in-time VM access, no file integrity monitoring.
Defender for Servers Plan 2: about $14.60 per server per month. Adds agentless scanning, premium Defender Vulnerability Management, file integrity monitoring, just-in-time VM access, and 500 MB/day of free ingestion per server for eligible security tables. If you already pay for Defender for Endpoint for Servers licences, Microsoft discounts that part of the plan on a support request.
Defender CSPM (paid): billed per billable resource per month, with the covered resource types listed in Microsoft's CSPM doc. Attack path analysis, cloud security explorer and agentless scanning for posture sit behind this plan. On a large estate it is not a rounding error, so price it before you flip it on.
Defender for Containers: about $6.87 per vCore per month across the cluster's nodes. A production cluster with 12 nodes of 4 vCores each runs about $330 a month for container protection alone.
Defender for Storage: about $9.78 per storage account per month, plus $0.15 per GB for on-upload malware scanning. Accounts with very heavy transaction volume also pay about $0.15 per million transactions above the included amount. A tenant with 80 storage accounts pays about $780 a month before any scanning volume.
Defender for App Service: about $14.60 per App Service instance per month. The meter counts instances, so a plan scaled out to 10 instances bills 10 times.
Defender for Key Vault: about $0.25 per vault per month on the per-vault plan.
Defender for Resource Manager: about $5.04 per subscription per month on the per-subscription plan.
Defender for Azure SQL: about $14.72 per server per month. SQL Server on machines: about $10.95 per vCore per month. MySQL and PostgreSQL: $15 per server per month.
Defender for APIs: sold as monthly plans sized by API call volume. Check the pricing page for the tier that matches your API Management traffic.

Multi-cloud connectors for AWS (via the CSPM or Servers plans) add a per-resource surcharge that mirrors the Azure pricing. GCP connector pricing follows the same pattern.

The Hidden Multiplier: Log Analytics

Every alert Defender for Cloud generates, and every diagnostic log it collects, lands in a Log Analytics workspace. That workspace has its own billing based on data ingestion and retention.

The 500 MB/day free allowance is a Plan 2 benefit only, and it is pooled across the servers in a subscription. It covers security tables such as SecurityEvent. It only applies when Defender for Servers Plan 2 is also turned on for the Log Analytics workspace the machines report to. Creating a data collection rule alone does not enable it. A busy Windows server with a verbose audit policy can push 2 to 4 GB/day without any application logs. At the pay-as-you-go Log Analytics rate of $2.30 per GB, or $4.30 per GB if the workspace has Sentinel, a 50-server fleet with aggressive logging can add $5,000 to $14,000 a month at $2.30, and roughly twice that on a Sentinel workspace, on top of the Defender plan fees.

The fix is a combination of data collection rule (DCR) scoping, commitment tier pricing, and table-level retention policies. We cover the architecture in more detail on the detection engineering practice page, but the short version is: do not inherit the default collection policy and assume it is safe.

Auditing Your Current Exposure With KQL

This query runs against your Azure Cost Management data exported to Log Analytics, or via the Azure Resource Graph for plan coverage. The second query is what we use to map which plans are actually enabled per subscription:

// Run in Azure Resource Graph Explorer
// Maps Defender plan states across all subscriptions
SecurityResources
| where type == "microsoft.security/pricings"
| extend
    PlanName     = name,
    PricingTier  = properties.pricingTier,
    SubPlan      = tostring(properties.subPlan),
    ResourceType = tostring(properties.resourceType)
| project
    subscriptionId,
    PlanName,
    PricingTier,
    SubPlan,
    ResourceType
| where PricingTier == "Standard"
| summarize EnabledPlans = make_set(PlanName) by subscriptionId
| order by subscriptionId asc

Pair that with a cost query from your billing export:

// Run against your Cost Management export in Log Analytics
AzureDiagnostics
| where ResourceProvider == "MICROSOFT.SECURITY"
| union (
    Usage_CL
    | where ServiceName_s contains "Defender"
)
| summarize TotalCostUSD = sum(todouble(PreTaxCost_d))
    by ServiceName_s, bin(TimeGenerated, 1d)
| order by TotalCostUSD desc

The Resource Graph query is the one we run first on every new engagement. It tells us in 30 seconds which plans are live and whether sub-plan distinctions (Plan 1 vs Plan 2 for Servers) are configured correctly. Teams that enable Defender through Policies or Blueprints sometimes end up with Plan 2 everywhere when Plan 1 would cover their actual use case.

Where We Usually Find Savings

Three patterns repeat often enough that we check them on every cost review.

First, non-production environments running Plan 2. Dev and staging environments rarely need MDE, vulnerability scanning, and file integrity monitoring at the same fidelity as production. Dropping them to Plan 1 or disabling Defender for Servers entirely and relying on the free CSPM tier for posture visibility is defensible for ephemeral environments. Tag-based exclusion policies in Azure Policy can enforce this automatically.

Second, Defender for Containers enabled on clusters that already have a third-party container security tool (Calico Enterprise, Cilium with Hubble, Aqua). The overlap is real. We are not saying disable Defender for Containers universally; the integration with Microsoft Sentinel and the native threat detection on AKS control-plane events has value. But if you are paying for both and only consuming one set of alerts, that is budget leaking.

Third, storage account sprawl. Teams that create storage accounts liberally across resource groups, often as Terraform outputs from module patterns, end up with 60-100 storage accounts in a subscription when 15-20 would cover the actual workload. Defender for Storage charges per account. A storage account consolidation exercise, which has other operational benefits, pays for itself fast.

When to Engage Before the Bill Arrives

The right time to model Defender for Cloud costs is before you enable plans at the management group level via Policy. Plans bill hourly, so turning one off stops the charge. Every hour it ran at the wrong scope is already billed, and on a big estate those hours add up.

We do pre-enablement cost modeling as a fixed deliverable: scope the resource inventory, map each Defender plan to actual detection requirements, project monthly cost at P5/P50/P95 resource growth, and output a Bicep or Terraform module that enforces the approved plan set via Azure Policy with deny effects on unapproved upsells.

If your team is already past that point and the bill is a problem, the audit starts with the Resource Graph query above and a 30-minute call to understand your actual threat model.

For next steps or to scope a Defender for Cloud cost and coverage review, reach out to the KeMeT Tech team.

Defender for Cloud Pricing: What the Azure Portal Doesn't Tell You