How to check Defender for Cloud plans in Azure

Before you start

Use an Azure account with read access to the subscriptions you want to check. The built-in Reader role is enough, assigned at the subscription or a parent scope. No Defender plan or other licence is needed to read the settings. The PowerShell example uses the Az.Accounts and Az.Security modules, reads Azure and exports a CSV without changing anything. Its finally block disconnects the account, so you may need to sign in again. Disabled subscriptions, and ones the account cannot read, are left out.

Azure calls the setting the pricing tier: Standard is on and Free is off. The examples read the setting of each subscription. Some plans, such as Defender for Storage, can also be on for a single resource, which is not shown.

Option 1

Check Defender for Cloud plans with PowerShell

Install the modules once and connect to Azure. The script reads the plans of each enabled subscription and writes 1 row for each plan.

Install-Module -Name Az.Accounts, Az.Security -Repository PSGallery -Scope CurrentUser

$ErrorActionPreference = 'Stop'
Connect-AzAccount -ErrorAction Stop
try {
    $subscriptions = @(Get-AzSubscription | Where-Object State -eq 'Enabled')
    if ($subscriptions.Count -eq 0) {
        Write-Output 'No enabled subscriptions are available to this account.'
        return
    }
    $rows = @(
        foreach ($subscription in $subscriptions) {
            try {
                Set-AzContext -Subscription $subscription.Id -Scope Process | Out-Null
                $plans = @(Get-AzSecurityPricing)
            } catch {
                Write-Warning "Could not read $($subscription.Name): $($_.Exception.Message)"
                continue
            }
            foreach ($plan in $plans) {
                $tier = if ($plan.PricingTier -eq 'Standard') { 'On' }
                    elseif ($plan.PricingTier -eq 'Free') { 'Off' }
                    else { 'Not set' }
                [pscustomobject]@{
                    Subscription   = $subscription.Name
                    Plan           = $plan.Name
                    Tier           = $tier
                    SubPlan        = $plan.SubPlan
                    SubscriptionId = $subscription.Id
                }
            }
        }
    )
    if ($rows.Count -eq 0) {
        Write-Output 'No Defender for Cloud plans were read.'
    } else {
        $rows |
            Sort-Object Subscription, Plan |
            Export-Csv -Path './defender-plans.csv' -NoTypeInformation -Encoding utf8
        $off = @($rows | Where-Object Tier -eq 'Off')
        Write-Output "$($rows.Count) plan settings saved to defender-plans.csv."
        Write-Output "$($off.Count) plan settings are off."
    }
} finally {
    Disconnect-AzAccount | Out-Null
}

The export has the subscription name, the plan's name as Azure writes it, its tier as On or Off, its sub-plan and the subscription ID. A subscription that cannot be read gives a warning and the script carries on. An empty result writes a message, not an empty CSV.

To narrow the search, keep only the subscriptions you want in $subscriptions. To list only what is off, add | Where-Object Tier -eq 'Off' before Export-Csv.

Option 2

Review Defender for Cloud plans in the Azure portal

1. Sign in to the Azure portal with read access to the subscriptions.
2. Search for resource graph > choose Resource Graph Explorer.
3. Paste this query in Query 1 and choose Run query:
   KQL

   SecurityResources
   | where type == 'microsoft.security/pricings'
   | extend plan = name, tier = tostring(properties.pricingTier)
   | extend status = iff(tier =~ 'Standard', 'On', iff(tier =~ 'Free', 'Off', 'Not set'))
   | project subscriptionId, plan, status, subPlan = tostring(properties.subPlan)
   | order by subscriptionId asc, plan asc

4. Review the plans in Results. Each row is 1 plan in 1 subscription.
5. To see 1 subscription's plans, search for Microsoft Defender for Cloud > choose Environment settings > select the subscription. The plans page shows each plan as on or off. Leave the toggles alone, as each one changes the subscription.
6. To compare subscriptions, go to Microsoft Defender for Cloud > Workbooks > Coverage, which shows each plan's status for each subscription.

These suit an occasional look. Use PowerShell when you need a CSV to keep.

Common questions

Does Off mean a subscription has no protection?

No. Off means the paid plan is not on for that subscription. The free tier still gives the foundational features, including recommendations, the asset inventory and secure score.

Why does a plan show a sub-plan, and why do subscriptions differ?

A sub-plan names the variant of a plan that is on, such as P1 or P2 for the Virtual Machines plan. Each subscription keeps its own settings, so 1 can have a plan on while another has it off.

What else should I review in these subscriptions?

For vaults, see how to check key vaults for soft delete and purge protection in Azure, which needs the same read access.