Common questions about Defender for Servers

Yes. It's now possible to manage Defender for Servers on specific resources within your subscription, giving you full control over your protection strategy. With this capability, you can configure specific resources with custom configurations that differ from the settings configured at the subscription level. Learn more about enabling Defender for Servers at the resource level. However, when you enable Microsoft Defender for Servers on a connected AWS account or GCP project, all connected machines are protected by Defender for Servers.

If you already have a license for Microsoft Defender for Endpoint for Servers, you won't have to pay for that part of your Microsoft Defender for Servers Plan 1 or 2 license.

To request your discount, contact the Defender for Cloud support team through the Azure portal by creating a new support request in the help and support center.

1. Sign in to the Azure portal.

2. Select Support and Troubleshooting

   

3. Select Help + support.

4. Select Create a support request.

5. Enter the following information:

   

6. Select Next.

7. Select Next.

8. In the Additional details tab, enter your Customer Org name, Tenant ID, the number of Microsoft Defender for Endpoint for Servers licenses that were purchased, the expiration date of the Microsoft Defender for Endpoint for Servers licenses that were purchased, and all other required fields.

9. Select Next.

10. Select Create.

When you enable Defender for Servers on a subscription, you're charged for all machines based on their power states.

Azure VMs:

Azure Arc machines:

Defender for Servers Plan 1 doesn't depend on Log Analytics. When you enable Defender for Servers Plan 2 at the subscription level, Defender for Cloud automatically enables the plan on your default Log Analytics workspaces. If you use a custom workspace, make sure you enable the plan on the workspace. Here's more information:

• If you turn on Defender for Servers for a subscription and for a connected custom workspace, you aren't charged for both. The system identifies unique VMs.
• If you enable Defender for Servers on cross-subscription workspaces:
  • For the Log Analytics agent, connected machines from all subscriptions are billed, including subscriptions that don't have the Defender for Servers plan enabled.
  • For the Azure Monitor agent, billing and feature coverage for Defender for Servers depends only on the plan being enabled in the subscription.

You can enable Microsoft Defender for Servers at the Log Analytics workspace level, but only servers reporting to that workspace are protected and billed, and those servers don't receive some benefits, such as Microsoft Defender for Endpoint, vulnerability assessment, and just-in-time VM access.

When you have Defender for Servers Plan 2 enabled, you get 500 MB of free data ingestion per day. The allowance is specifically for the security data types directly collected by Defender for Cloud.

This allowance is a daily rate averaged across all nodes. Your total daily free limit is equal to [number of machines] × 500 MB. You aren't charged extra if the total doesn't exceed your total daily free limit, even if some machines send 100 MB and others send 800 MB.

Defender for Cloud billing is closely tied to the billing for Log Analytics. Microsoft Defender for Servers provides an allocation of 500 MB per node per day for machines against the following subset of security data types:

• SecurityAlert
• SecurityBaseline
• SecurityBaselineSummary
• SecurityDetection
• SecurityEvent
• WindowsFirewall
• ProtectionStatus
• Update and UpdateSummary when the Update Management solution isn't running in the workspace or solution targeting is enabled.
• MDCFileIntegrityMonitoringEvents

If the workspace is in the legacy per-node pricing tier, the Defender for Cloud and Log Analytics allocations are combined and applied jointly to all billable ingested data.

Yes. You're charged for all machines that are protected by Defender for Servers in Azure subscriptions, connected AWS accounts, or connected GCP projects. The term machines includes Azure virtual machines, instances of Azure Virtual Machine Scale Sets, and Azure Arc-enabled servers. Machines that don't have Log Analytics installed are covered by protections that don't depend on the Log Analytics agent.

In the past, the Log Analytics agent provisioned Microsoft Defender for Endpoint. When we expanded support to include Windows Server 2019 and Linux, we also added an extension to perform the automatic onboarding.

Defender for Cloud automatically deploys the extension to machines running:

• Windows Server 2019 and Windows Server 2022
• Windows Server 2012 R2 and 2016 if MDE Unified Solution integration is enabled
• Windows 10 on Azure Virtual Desktop.
• Other versions of Windows Server if Defender for Cloud doesn't recognize the OS version (for example, when a custom VM image is used). In this case, the Log Analytics agent still provisions Microsoft Defender for Endpoint.
• Linux.

If you enabled the integration, but still don't see the extension running on your machines:

1. You need to wait at least 12 hours to be sure there's an issue to investigate.
2. If after 12 hours you still don't see the extension running on your machines, check that the Prerequisites for the integration are met.
3. Ensure you enabled the Microsoft Defender for Servers plan for the subscriptions related to the machines you're investigating.
4. If you moved your Azure subscription between Azure tenants, some manual preparatory steps are required before Defender for Cloud deploys Defender for Endpoint. For full details, contact Microsoft support.

Licenses for Defender for Endpoint for servers are included with Microsoft Defender for Servers.

No. With Defender for Endpoint integration in Defender for Servers, you'll also get malware protection on your machines.

• On Windows Server 2012 R2 with Defender for Endpoint unified solution integration enabled, Defender for Servers deploys Microsoft Defender Antivirus in active mode.
• On newer Windows Server operating systems, Microsoft Defender Antivirus is part of the operating system and will be enabled in active mode.
• On Linux, Defender for Servers deploy Defender for Endpoint including the anti-malware component, and set the component in passive mode.

Full instructions for switching from a non-Microsoft endpoint solution are available in the Microsoft Defender for Endpoint documentation: Migration overview.

Defender for Servers Plan 1 and Plan 2 provides the capabilities of Microsoft Defender for Endpoint Plan 2.

Microsoft Defender for Servers includes vulnerability scanning for your machines. You don't need a Qualys license or even a Qualys account - Defender for Cloud handles everything seamlessly. For details of this scanner and instructions for how to deploy it, see Defender for Cloud's integrated Qualys vulnerability assessment solution.

The inventory view lists your Defender for Cloud connected resources from a Cloud Security Posture Management (CSPM) perspective. The filters show only the resources with active recommendations.

For example, if you have access to eight subscriptions but only seven currently have recommendations, filter by Resource type = Subscriptions shows only the seven subscriptions with active recommendations:

A Deny all traffic rule is recommended when, as a result of running the algorithm, Defender for Cloud doesn't identify traffic that should be allowed, based on the existing NSG configuration. Therefore, the recommended rule is to deny all traffic to the specified port. The name of this type of rule is displayed as "System Generated". After enforcing this rule, its actual name in the NSG will be a string that comprises the protocol, traffic direction, "DENY", and a random number.

To deploy the Guest Configuration extension with its prerequisites:

• For selected machines, follow the security recommendation Guest Configuration extension should be installed on your machines from the Implement security best practices security control.

• At scale, assign the policy initiative Deploy prerequisites to enable Guest Configuration policies on virtual machines.

The list of resources in the Not applicable tab includes a Reason column. Some of the common reasons include:

When you enable the Servers plan on the subscription level, Defender for Cloud enables the Servers plan on your default workspaces automatically. Connect to the default workspace by selecting Connect Azure VMs to the default workspace(s) created by Defender for Cloud option and selecting Apply.

However, if you're using a custom workspace in place of the default workspace, you need to enable the Servers plan on all of your custom workspaces that aren't enabled.

If you're using a custom workspace and enable the plan on the subscription level only, the Microsoft Defender for servers should be enabled on workspaces recommendation appears on the Recommendations page. This recommendation gives you the option to enable the servers plan on the workspace level with the Fix button. You're charged for all VMs in the subscription even if the Servers plan isn't enabled for the workspace. The VMs don't benefit from features that depend on the Log Analytics workspace, such as Microsoft Defender for Endpoint, VA solution (MDVM/Qualys), and Just-in-Time VM access.

Enabling the Servers plan on both the subscription and its connected workspaces, won't incur a double charge. The system identifies each unique VM.

If you enable the Servers plan on cross-subscription workspaces, connected VMs from all subscriptions are billed, including subscriptions that don't have the Servers plan enabled.

Yes. When you enable Microsoft Defender for Servers on an Azure subscription or a connected AWS account, you are charged for all machines that are connected to your Azure subscription or AWS account. The term machines include Azure virtual machines, Azure Virtual Machine Scale Sets instances, and Azure Arc-enabled servers. Machines that don't have Log Analytics installed are covered by protections that don't depend on the Log Analytics agent.

If a machine, reports to multiple workspaces, and all of them have Defender for Servers enabled, the machines are billed for each attached workspace.

Yes. If you configure your Log Analytics agent to send data to two or more different Log Analytics workspaces (multi-homing), you get 500-MB free data ingestion for each workspace. It's calculated per node, per reported workspace, per day, and available for every workspace that has a 'Security' or 'AntiMalware' solution installed. You are charged for any data ingested over the 500-MB limit.

You receive a daily allowance of 500 MB of free data ingestion for each virtual machine (VM) connected to the workspace. This allocation specifically applies to the security data types collected directly by Defender for Cloud.

The data allowance is a daily rate calculated across all connected machines. Your total daily free limit is equal to the [number of machines] x 500 MB. So even if on a given day some machines send 100 MB and others send 800 MB, if the total data from all machines doesn't exceed your daily free limit, you won't be charged extra.

Defender for Cloud's billing is closely tied to the billing for Log Analytics. Microsoft Defender for Servers provides a 500 MB/node/day allocation for machines against the following subset of security data types:

• SecurityAlert
• SecurityBaseline
• SecurityBaselineSummary
• SecurityDetection
• SecurityEvent
• WindowsFirewall
• ProtectionStatus
• Update and UpdateSummary when the Update Management solution isn't running in the workspace or solution targeting is enabled.

If the workspace is in the legacy Per Node pricing tier, the Defender for Cloud and Log Analytics allocations are combined and applied jointly to all billable ingested data. To learn more on how Microsoft Sentinel customers can benefit, see the Microsoft Sentinel Pricing page.

You can view your data usage in two different ways, the Azure portal, or by running a script.

To view your usage in the Azure portal:

1. Sign in to the Azure portal.

2. Navigate to Log Analytics workspaces.

3. Select your workspace.

4. Select Usage and estimated costs.

   

You can also view estimated costs under different pricing tiers by selecting for each pricing tier.

To view your usage by using a script:

1. Sign in to the Azure portal.

2. Navigate to Log Analytics workspaces > Logs.

3. Select your time range. Learn about time ranges.

4. Copy and past the following query into the Type your query here section.

   let Unit= 'GB';
   Usage
   | where IsBillable == 'TRUE'
   | where DataType in ('SecurityAlert', 'SecurityBaseline', 'SecurityBaselineSummary', 'SecurityDetection', 'SecurityEvent', 'WindowsFirewall', 'MaliciousIPCommunication', 'SysmonEvent', 'ProtectionStatus', 'Update', 'UpdateSummary')
   | project TimeGenerated, DataType, Solution, Quantity, QuantityUnit
   | summarize DataConsumedPerDataType = sum(Quantity)/1024 by  DataType, DataUnit = Unit
   | sort by DataConsumedPerDataType desc
   

5. Select Run.

   

You can learn how to Analyze usage in Log Analytics workspace.

Based on your usage, you aren't billed until you've used your daily allowance. If you're receiving a bill, it's only for the data used after the 500-MB limit is reached, or for other service that doesn't fall under the coverage of Defender for Cloud.

You might want to manage your costs and limit the amount of data collected for a solution by limiting it to a particular set of agents. Use solution targeting to apply a scope to the solution and target a subset of computers in the workspace. If you're using solution targeting, Defender for Cloud lists the workspace as not having a solution.

Next steps

Plan your Defender for Servers deployment