# Microsoft Defender for Cloud Plan

> Microsoft Defender for Cloud plans bill per protected resource or per unit: Defender for Servers meters each covered VM, Defender for SQL each database. ZopNight discovers every plan's tier and coverage via Resource Graph and attributes per-plan spend from Cost Management, so subscriptions where protection outcosts the protected estate stand out.

Source: https://zop.dev/integrations/azure/defender-plan
Updated: 2026-08-19

---

Defender for Cloud plans add threat protection per resource type (servers, SQL, storage, containers), billed per protected resource or per unit. Plans enabled subscription-wide on non-production estates can cost more than the resources they protect.

## Protection priced per protected thing

Each Defender plan is a per-resource-type subscription toggle whose meter counts what it covers: servers plans charge for each protected machine, database plans for each protected SQL resource, storage and container plans per protected unit or by activity. Enablement is subscription-wide by default, which means the charge scales automatically with the estate. Every VM added to a covered subscription silently joins the Defender bill. Nothing about the plan is capacity; the meter is coverage headcount.

## The coverage-versus-cost view ZopNight builds

Discovered via Azure Resource Graph with plan tier and coverage. Cost Management billing attributes per-plan spend, supporting coverage-versus-cost review, lining up what each plan costs against what it is protecting, per subscription. A security plan has no off-hours, so there is nothing to schedule; the decision ZopNight informs is whether each plan's tier and scope match the criticality of the resources underneath it, which is a governance call the billing data alone cannot settle but can definitely start.

## When Defender spend outgrows its estate

The canonical mismatch is the non-production subscription that inherited production's enablement: a dev estate of small B-series VMs where the per-server protection charge rivals the compute underneath it. Close behind are plans left enabled for resource types a subscription no longer contains, billing for coverage of nothing, and tier choices made once, subscription-wide, that never got revisited as the estate's shape changed.

## Checking plan enablement per subscription

Azure portal → Microsoft Defender for Cloud → Environment settings, then a subscription, lists every plan with its toggle and tier. Reading that page against the subscription's actual contents is the fastest manual version of the review ZopNight's per-plan spend attribution automates.