Microsoft Defender for Cloud cost: per resource, per plan

Quick answer

Defender for Cloud has a free posture-management (CSPM) foundation, and paid plans billed per protected resource per month, Defender for Servers (per server), Containers (per vCore), Databases (per instance), Storage (per account or per transaction), and more, each priced and enabled separately. Enabling every plan on every resource over-pays, so enabling the plans your risk profile needs on the resources that matter is the lever.

Microsoft Defender for Cloud provides cloud security posture management (CSPM) and workload protection. Its foundational posture management is free, and the workload-protection value comes from paid plans, each targeting a resource type and billed per protected resource. So the cost is a sum of the plans you enable across the resources you protect.

Per resource, per plan

Plan	Bills per
Defender for Servers	Server per month
Defender for Containers	vCore per month
Defender for Databases	Database instance per month
Defender for Storage	Storage account or per transaction
Other plans (App Service, Key Vault, etc.)	Per resource per month

Each plan is enabled and priced separately, per protected resource. So Defender for Servers costs per server, Defender for Containers per vCore, and so on. The total is the plans you turn on times the resources they cover, which is why enabling everything everywhere adds up fast.

Enable what your risk needs

The common overspend is enabling every plan across every resource by default. Instead, enable the plans that match your risk, Servers and Containers for compute-heavy environments, Databases where you run sensitive data, Storage where it matters, on the resources that warrant protection. Free CSPM covers baseline posture; the paid plans are for workload-specific protection where you need it.

Controlling Defender for Cloud cost

Use the free CSPM foundation for baseline posture management, enable paid plans selectively by resource type and environment (production over dev), scope Storage and per-transaction plans carefully since they can scale with activity, and review enabled plans against what you act on. Aligning plans with risk keeps cost proportional, the same enable-what-you-use discipline as Security Hub.

FAQ

How is Microsoft Defender for Cloud priced?

A free posture-management (CSPM) foundation, plus paid plans billed per protected resource per month, each targeting a resource type: Defender for Servers (per server), Containers (per vCore), Databases (per instance), Storage (per account or transaction), and more. The total is the plans you enable times the resources they cover.

How do I reduce Defender for Cloud cost?

Use the free CSPM foundation for baseline posture, enable paid plans selectively by resource type and environment (production over dev) rather than everything everywhere, scope Storage and per-transaction plans carefully since they scale with activity, and review enabled plans against what you actually act on.

Do I need to enable every Defender plan?

No. Each plan is priced per protected resource, so enabling every plan across every resource by default over-pays. Enable the plans that match your risk, Servers and Containers for compute-heavy environments, Databases for sensitive data, on the resources that warrant protection. Free CSPM covers baseline posture.

Is Defender for Cloud posture management free?

The foundational cloud security posture management (CSPM), which provides security recommendations and a secure score, is free. The paid Defender plans add workload-specific threat protection per resource type. So you get baseline posture at no cost and pay for the deeper protection plans you enable.

Why is my Defender for Cloud bill high?

Usually many plans enabled across many resources. Since each plan bills per protected resource, enabling Servers, Containers, Databases, and Storage across a large environment multiplies cost. Enable only the plans your risk profile needs on the resources that matter, and scope activity-based plans like Storage carefully.

Does C3X estimate Defender for Cloud cost?

Defender for Cloud cost is driven by enabled plans and protected resource counts, which are configuration and usage inputs. C3X prices the surrounding infrastructure, and you model the plans and resources to estimate the per-resource security charges.

What to do next

Estimate the infrastructure around your security posture before you deploy. C3X reads your Terraform and prices your resources against a live catalog. Start with the quickstart.