Microsoft Defender for Cloud: cloud security profile and facts (2026)
Visit Defender for Cloud's siteMicrosoft Defender for Cloud
azure.microsoft.com
* Not found on the pages we read; it may exist. Facts as the vendor states them on its own pages and marketplace listings, read September 2026, checked 3 Nov 2026. Not a measure of how well anything works.
Which categories does Defender for Cloud describe?
- Described on the vendor's pages we read
- Not in our sources (it may exist; we did not find it on the pages we read)
- CNAPPDescribed
Posture (Defender CSPM) and workload protection (Defender for Servers) are separate plans in one product; the full set needs paid plans.
Source: Microsoft Learn: Defender for Cloud CSPM plans, read .
- CSPMDescribed
Foundational CSPM is free; Defender CSPM adds attack path analysis and the cloud security explorer.
Source: Microsoft Learn: Defender for Cloud CSPM plans, read .
- CWPPDescribed
Defender for Servers Plan 1 and Plan 2, with file integrity monitoring and just-in-time access in Plan 2.
Source: Microsoft Learn: Defender for Servers overview, read .
- CIEMDescribed
Defender for Cloud includes native CIEM, supporting Microsoft Entra ID, AWS IAM and Google Cloud IAM.
Source: Microsoft Learn: CIEM in Defender for Cloud, read .
- DSPMDescribed
DSPM is part of the paid Defender CSPM plan.
Source: Microsoft Learn: Defender for Cloud CSPM plans, read .
- Vulnerability managementDescribed
Agentless VM vulnerability scanning is in the paid Defender CSPM plan and Defender for Servers Plan 2.
Source: Microsoft Learn: Defender for Cloud CSPM plans, read .
The map shows what each vendor's own pages describe. It is not a measure of how well a feature works.
How does Defender for Cloud deploy?
| Fact | Defender for Cloud |
|---|---|
| Agent approach | Agentless parts, agent for depth Agentless VM, secrets and Kubernetes scanning exist, but only in the paid Defender CSPM plan and Defender for Servers Plan 2. Source: Microsoft Learn: Defender for Cloud CSPM plans, read . |
| Runtime sensor | Defender for Servers Plan 1 and Plan 2 bring Microsoft Defender for Endpoint EDR to servers. Source: Microsoft Learn: Defender for Servers overview, read . |
| Clouds named | Azure, AWS, GCP Azure, AWS and Google Cloud, plus on-premises machines through Azure Arc. Source: Microsoft Learn: Defender for Servers overview, read . |
| Private cloud or on-premises | On-premises machines through Azure Arc. Source: Microsoft Learn: Defender for Servers overview, read . |
| Disconnected environments | Not in our sources |
What else does Defender for Cloud cover?
| Fact | Defender for Cloud |
|---|---|
| Code security | Code-to-cloud mapping in the paid Defender CSPM plan. Source: Microsoft Learn: Defender for Cloud CSPM plans, read . |
| AI security | AI-SPM in the paid Defender CSPM plan; Defender for AI Services is billed per 1,000 tokens. Source: Azure: Defender for Cloud pricing, read . |
| Kubernetes runtime | Agentless Kubernetes discovery in the paid Defender CSPM plan. Source: Microsoft Learn: Defender for Cloud CSPM plans, read . |
| Compliance reporting | Compliance standards include CIS, PCI DSS v4.0.1, HIPAA, ISO/IEC 27001:2022, SOC 2023, NIST CSF v2.0 and NIST SP 800-53, assignable to Azure subscriptions, AWS accounts and GCP projects. Source: Microsoft Learn: regulatory compliance standards, read . |
| Public-sector authorization | Microsoft lists Defender for Cloud in FedRAMP High audit scope for Azure and Azure Government. Source: Azure and other Microsoft cloud services compliance scope, read . |
| Open source | None named |
What does Defender for Cloud cost?
Foundational CSPM is free. Defender CSPM is $5.11 per billable resource per month (8 functions or web apps count as 1 resource). Defender for Servers is $4.906 per server per month for Plan 1 and $14.60 for Plan 2. Defender for Containers is $6.8693 per vCore per month. USD list prices, East and Central US; free for the first 30 days.
Source: Azure: Defender for Cloud pricing (re-read), read .
Where is Defender for Cloud strong, and where are its limits?
Strengths and limits come from the vendor's own pages and our sources; a limit can be something we did not find.
Strengths
- Publishes per-resource list prices on its own pricing page (Defender CSPM $5.11 per billable resource per month), with a free posture tier, a cost calculator and a 30-day free trial.
- Native to Azure, with AWS and Google Cloud covered and billed alongside it, and on-premises servers through Azure Arc.
- Server protection through Defender for Endpoint EDR for teams already on Microsoft security.
Limits
- Agentless scanning, attack paths, DSPM and AI-SPM sit in the paid Defender CSPM plan ($5.11 per billable resource per month), not the free tier.
- Oracle Cloud and Alibaba Cloud are not named, and from 27 October 2026 the free tier becomes opt-in for new Azure subscriptions.
What does Defender for Cloud say about itself?
No vendor figures are quoted on this profile.
What has Defender for Cloud announced recently?
30 Jul 2026
Microsoft said that from 27 October 2026 Foundational CSPM will no longer be enabled by default on new Azure subscriptions. Existing subscriptions and AWS and GCP connectors are not affected, and it remains free.
Source: Microsoft Learn: Defender for Cloud release notes, read .
Who should shortlist Defender for Cloud?
Consider Defender for Cloud if most of your estate is on Azure and you already use Microsoft security products, or if you need to model cost from public prices before talking to anyone.
In our example finder profiles, Defender for Cloud is in the first group for: Small Azure team on Microsoft security.
Run the finder with your answersHow does Defender for Cloud compare with each other vendor?
Frequently asked questions
Does Defender for Cloud need an agent?
Agentless parts, agent for depth. Agentless VM, secrets and Kubernetes scanning exist, but only in the paid Defender CSPM plan and Defender for Servers Plan 2.
Which clouds does Defender for Cloud name?
Azure, AWS and GCP. Azure, AWS and Google Cloud, plus on-premises machines through Azure Arc.
Does Defender for Cloud publish its prices?
Foundational CSPM is free. Defender CSPM is $5.11 per billable resource per month (8 functions or web apps count as 1 resource). Defender for Servers is $4.906 per server per month for Plan 1 and $14.60 for Plan 2. Defender for Containers is $6.8693 per vCore per month. USD list prices, East and Central US; free for the first 30 days.