Azure Security Center is now called Microsoft Defender for Cloud. Foundational CSPM is free and gives you a secure score and recommendations. Paid Defender plans — for servers, databases, storage, containers and more — add threat protection and are billed per protected resource. Start free, then enable paid plans only where the risk justifies the cost.
📑 On this page · 6 sections
What is Microsoft Defender for Cloud?
Defender for Cloud is Microsoft’s cloud security service. It works across Azure, AWS, Google Cloud and on-premises servers (through Azure Arc), and does two main jobs:
Posture management (CSPM)
Checks your settings against best practices and gives a secure score and recommendations.
Workload protection
Detects and alerts on threats to servers, databases, storage, containers and more.
• Secure score and recommendations
• Regulatory compliance dashboard (e.g. ISO 27001, PCI DSS)
• Threat detection and security alerts
• Vulnerability assessment for servers and containers
• Just-in-time VM access (supported plans)
• Attack path analysis and agentless scanning (Defender CSPM)
• Integration with Microsoft Sentinel
Defender for Cloud pricing: how it works
✅ 🆓 Free: Foundational CSPM — secure score, recommendations and basic compliance at no extra cost.
Defender CSPM
Advanced posture, attack paths, agentless scanning. Per billable resource.
Defender for Servers
Plan 1 or Plan 2, billed per server per hour.
Defender for Databases
SQL, open-source databases and Cosmos DB.
Defender for Storage
Malware scanning and threat detection for storage accounts.
Defender for Containers
Kubernetes and container image protection.
Other plans
App Service, Key Vault, Resource Manager, APIs and more.
Most plans offer a free trial. Prices change over time — check the official Defender for Cloud pricing page.
How to estimate your cost
List resources
Servers, databases, storage accounts, clusters.
Pick plans
Choose the Defender plan for each resource type.
Calculate
Use the Azure Pricing Calculator or the cost estimation workbook.
Start small
Begin with free tier and trials, then expand.
🛡️ Want to practise Defender for Cloud, Key Vault and RBAC in real labs? Join a free demo class.
Book a free demoTips to optimise costs and get more value
• Enable paid plans only where needed
• Choose the right plan level (Servers Plan 1 vs 2)
• Exclude test or temporary resources where allowed
• Review usage in Cost Management
• Use free trials before committing
• Act on recommendations to raise secure score
• Set up email alerts and workflow automation
• Connect alerts to Microsoft Sentinel
• Use compliance dashboards for audits
• Fix the riskiest attack paths first
Example scenarios and choosing your level
Small business
Free Foundational CSPM, plus Defender for Servers only on internet-facing VMs.
Growing company
Adds Defender for Storage and Databases on production data.
Enterprise
Defender CSPM and most workload plans, with alerts sent to Microsoft Sentinel.
Illustrative examples — use the official pricing page for real costs. Regulated industries usually benefit most from compliance dashboards and data/server plans.
Related reading
See What is Key Vault in Azure, Azure Firewall pricing and our Azure training in Hyderabad.
Frequently asked questions
Is Azure Security Center the same as Defender for Cloud?
Yes. Microsoft renamed Azure Security Center to Microsoft Defender for Cloud.
Is Defender for Cloud free?
The Foundational CSPM tier is free. Advanced protection plans are paid per protected resource.
How is Defender for Servers billed?
Per server per hour, with Plan 1 and Plan 2 at different price levels.
Does it protect AWS and Google Cloud?
Yes. You can connect AWS and GCP accounts, and on-premises servers through Azure Arc.
How can I reduce Defender costs?
Enable plans only where needed, pick the right plan level and review usage regularly.