Skip to content
Find Cloud Security

Defender for Cloud's free posture tier goes opt-in on 27 October 2026

By The Cloud Map Desk. Published , updated .

Desk research from public vendor pages. Vendor facts read September 2026, updated 2026-11-03. Profiles follow our published method; we did not run the products.

Pricing, Compliance, 3 min read.

What is changing?

Microsoft's Defender for Cloud release notes, dated 30 July 2026, say that from 27 October 2026 Foundational CSPM will no longer be enabled by default on new Azure subscriptions. Foundational CSPM is the free tier of Defender for Cloud's posture management. Until the change, a new subscription got it automatically; after it, someone has to switch it on.

What is not changing?

According to the same notes, existing subscriptions are not affected, AWS and GCP connectors are not affected, and Foundational CSPM remains free. Nothing is being removed and no price is being added.

Who should care?

Teams that create Azure subscriptions often, especially from templates or landing-zone automation. A subscription created on 28 October without the setting will have no posture checks from Defender for Cloud until someone notices. In a large organisation that can mean weeks of unmonitored configuration in exactly the place new projects start.

It also matters for anyone who treats the free tier as a baseline while evaluating other tools. If your comparison assumes every subscription is covered by the free tier, that assumption stops holding for new subscriptions.

What does the free tier cover, and what does it not?

Microsoft's documentation describes Foundational CSPM as the free entry point. Attack path analysis, the cloud security explorer, agentless VM vulnerability and secrets scanning, agentless Kubernetes discovery, code-to-cloud mapping, AI-SPM, DSPM and external attack surface management sit in the paid Defender CSPM plan, billed per resource. So the change affects the baseline, not the paid features teams usually evaluate.

What should you do before 27 October?

  1. Find where new subscriptions are created: portal, templates, landing-zone tooling, vending pipelines.
  2. Add an explicit step that enables Foundational CSPM, or the paid plan you use.
  3. Add a posture check of your own: a list of subscriptions without Defender for Cloud posture enabled, reviewed weekly.
  4. If you use another vendor's posture tool, check how new subscriptions are onboarded there too. The same gap can exist in any tool that relies on someone connecting each new account.

How does this affect the finder?

It does not change any rule. Defender for Cloud is still the only vendor on this site with public per-resource pricing, a calculator, a free posture tier and a 30-day trial, and the finder's price check for small teams still matches it. The profile now notes the opt-in date.

The broader point

A free tier that is on by default is coverage nobody has to remember. One that is opt-in is a task. Whatever tool you choose, coverage of new accounts is something to test, not assume.

Sources