Microsoft Defender for Cloud
Architecture and deploymentPlan Management Changes Defender Portal
In brief
The documentation now maps legacy plans to new plans, including default serverless protection in Defender CSPM, revised billing units, consolidated Databases and API plans, and discontinued DNS coverage. DNS protection can be maintained by manually enabling Defender for Servers Plan 2, with possible additional charges.
What Defender admins need to know
Review plan mappings, billing changes, and DNS coverage during migration. No mandatory action or deadline is stated.
Summaries are generated from the documentation change itself.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
When you move Defender for Cloud plan management from the Azure portal to the Microsoft Defender portal, the way that plans are billed, configured, and applied changes.
Before moving an Azure environment, review the following changes:
- Billing moves to the Defender Workload Unit model.
Some existing plans are replaced, consolidated, or measured differently when they move to the Defender portal.
| Defender |
Defender |
| Container Registry. Billed per image. | Containers. Billed per image. |
| Defender for Azure SQL |
|
| DNS | None. Manually enable Defender for Servers Plan 2 for equivalent coverage. |
| ARM. Billed by transaction. | Resource Manager. Billed per subscription. |
| API. P2, P3, P4, P5. | API. A single consolidated plan (P1). |
Most supported plans are mapped automatically to the new model.
Defender for DNS isn't carried forward automatically. DuringAfter migration, choose whether to:you can:
- Continue without DNS protection.
EnableManually enable Defender for Servers Plan2, which includes2 to maintain equivalent DNSprotection andprotection. Additional charges mightresult in additional charges.apply.
Review the changes shown in the Defender portal before confirming the migration. \ No newline at end of file
@@ -15,7 +15,7 @@ manager: orspodek ms.service: defender-for-cloud description: Understand how billing, configuration scope, and cloud security plans change when you manage plans in the Microsoft Defender portal. ms.topic: concept-article-ms.date: 2026-07-28T00:00:00.0000000Z+ms.date: 2026-10-20T00:00:00.0000000Z ai-usage: ai-assisted locale: en-us document_id: 6bbdef1a-16bd-baa5-124e-d3d4dd3a658e@@ -50,6 +50,8 @@ This feature is in preview. For more information, see [Supplemental Terms of Use
When you move Defender for Cloud plan management from the Azure portal to the Microsoft Defender portal, the way that plans are billed, configured, and applied changes.
+[](media/plan-management-changes-defender-portal/migrate-to-defender-plan-comparison.png#lightbox)
+
Before moving an Azure environment, review the following changes:
- Billing moves to the Defender Workload Unit model.
@@ -97,20 +99,24 @@ After an environment moves to Defender portal management:
Some existing plans are replaced, consolidated, or measured differently when they move to the Defender portal.
-| Current plan | Updated plan or behavior |
+| Legacy plan | New plan |
| --- | --- |
-| Defender for Key Vault billed by transaction | Defender for Key Vault billed per resource |
-| Defender for Storage V1 billed by transaction | Defender for Storage V2 billed per resource |
-| Defender for Resource Manager billed by transaction | Defender for Resource Manager billed per resource |
-| Defender for Containers billed by vCPU | Defender for Containers billed by protected node |
-| Defender for Azure SQL Databases, Defender for SQL Servers on Machines, and Defender for Open-Source Relational Databases | Consolidated Defender for Databases plan |
-| Defender for DNS | Continue without DNS protection, or enable Defender for Servers Plan 2 |
+| **Defender CSPM**. Serverless Protection and Serverless Containers were optional capabilities. | **Defender CSPM**. Serverless Protection and Serverless Containers are included by default with no opt-out. Eligible resources are protected and billed based on usage. |
+| **Storage Accounts**. Billed by transaction. | **Storage**. Billed per resource. |
+| **Containers**. Billed by vCPU. | **Containers**. Billed per node. |
+| **Kubernetes Service**. Billed by vCores. | **Containers**. Billed per node. |
+| **Container Registry**. Billed per image. | **Containers**. Billed per image. |
+| **Defender for Azure SQL Databases**, **SQL Servers on Machines**, and **Open-Source Relational Databases**. | **Databases**. A single consolidated plan, billed per instance. |
+| **Key Vaults**. Billed by transaction. | **Key Vaults**. Billed per resource. |
+| **DNS**. Discontinued. | **None**. Manually enable Defender for Servers Plan 2 for equivalent coverage. |
+| **ARM**. Billed by transaction. | **Resource Manager**. Billed per subscription. |
+| **API**. P2, P3, P4, P5. | **API**. A single consolidated plan (P1). |
Most supported plans are mapped automatically to the new model.
-Defender for DNS isn't carried forward automatically. During migration, choose whether to:
+Defender for DNS isn't carried forward automatically. After migration, you can:
- Continue without DNS protection.
-- Enable Defender for Servers Plan 2, which includes DNS protection and might result in additional charges.
+- Manually enable Defender for Servers Plan 2 to maintain equivalent DNS protection. Additional charges might apply.
Review the changes shown in the Defender portal before confirming the migration.\ No newline at end of file