Microsoft Defender for Cloud Plan
Does ZopNight manage Microsoft Defender for Cloud Plan?
Microsoft Defender for Cloud plans bill per protected resource or per unit: Defender for Servers meters each covered VM, Defender for SQL each database. ZopNight discovers every plan's tier and coverage via Resource Graph and attributes per-plan spend from Cost Management, so subscriptions where protection outcosts the protected estate stand out.
Rules that fire on Microsoft Defender for Cloud Plan
No active rule family targets Microsoft Defender for Cloud Plan today. Rules that used to are retired, and retired rules publish no pages and fire no findings. Scheduling and permissions coverage are unaffected.
At a glance
| Field | Value |
|---|---|
| Scheduling notes | discovery and cost visibility only. |
Defender for Cloud plans add threat protection per resource type (servers, SQL, storage, containers), billed per protected resource or per unit. Plans enabled subscription-wide on non-production estates can cost more than the resources they protect.
Protection priced per protected thing
Each Defender plan is a per-resource-type subscription toggle whose meter counts what it covers: servers plans charge for each protected machine, database plans for each protected SQL resource, storage and container plans per protected unit or by activity. Enablement is subscription-wide by default, which means the charge scales automatically with the estate. Every VM added to a covered subscription silently joins the Defender bill. Nothing about the plan is capacity; the meter is coverage headcount.
The coverage-versus-cost view ZopNight builds
Discovered via Azure Resource Graph with plan tier and coverage. Cost Management billing attributes per-plan spend, supporting coverage-versus-cost review, lining up what each plan costs against what it is protecting, per subscription. A security plan has no off-hours, so there is nothing to schedule; the decision ZopNight informs is whether each plan’s tier and scope match the criticality of the resources underneath it, which is a governance call the billing data alone cannot settle but can definitely start.
When Defender spend outgrows its estate
The canonical mismatch is the non-production subscription that inherited production’s enablement: a dev estate of small B-series VMs where the per-server protection charge rivals the compute underneath it. Close behind are plans left enabled for resource types a subscription no longer contains, billing for coverage of nothing, and tier choices made once, subscription-wide, that never got revisited as the estate’s shape changed.
Checking plan enablement per subscription
Azure portal → Microsoft Defender for Cloud → Environment settings, then a subscription, lists every plan with its toggle and tier. Reading that page against the subscription’s actual contents is the fastest manual version of the review ZopNight’s per-plan spend attribution automates.