Tools
Defender for Cloud: which plans are worth enabling
The free tier does more than people realise. Which paid plans earn their per-resource cost, and which quietly do not.
Microsoft
Start with what is already free
The foundational Cloud Security Posture Management capability is free on every Azure subscription. It gives you secure score, recommendations and regulatory compliance views without enabling a single paid plan.
A large number of organisations have never looked at it, then buy a third-party posture product to tell them the same things. Read the free one first.
The plans in the order we would enable them
Defender for Servers
Priced per server per month and usually the first worth having, because it brings Defender for Endpoint to your virtual machines and covers the workload most likely to be reached.
Defender for Storage
Comparatively cheap, and it catches malware uploaded to blob storage plus unusual access patterns. Strong value for the price if you hold customer-uploaded content.
Defender for Containers
Only if you actually run AKS in production. Genuinely useful there, and pure cost if your cluster is a proof of concept nobody has decommissioned.
Defender CSPM
The paid posture tier, adding attack path analysis and agentless scanning. Worth it once you have enough resources for attack paths to be non-obvious, not before.
The mistake that wastes the most money
Enabling every plan at subscription level across all subscriptions, including the dormant ones. Billing is per resource, so a forgotten development subscription with forty virtual machines quietly costs the same as production.
Enable per subscription deliberately, and review which subscriptions still exist before each renewal.
The verdict
Free posture everywhere, Servers and Storage on production only
It covers the workloads that matter at a fraction of the cost of blanket enablement, and the free tier already answers most posture questions.
Do not enable plans across development and sandbox subscriptions by default. That is where most of the wasted spend in this product lives.
Disclosure. Some links on this site are affiliate links. Scoring weights are published before any programme is joined, and commission is never a ranking input. Full policy, and the method behind this guide.