- The organization wants a no-cost multicloud posture baseline with a clear path to advanced graph-based risk: Foundational CSPM supplies inventory, MCSB, Secure Score, recommendations, reporting, export, and workflows across Azure, AWS, and GCP; paid Defender CSPM adds attack paths, security explorer, data and identity context, governance, and agentless scanning.
- Cloud security operations already use Azure governance, Logic Apps, Sentinel, Event Hubs, Log Analytics, GitHub, Azure DevOps, or ServiceNow: Defender for Cloud integrates posture data with Azure-native policy, automation, export, DevOps, SIEM, and ITSM workflows and can operate across management groups and connected cloud organizations.
Security & Privacy / Cloud Security Posture Management (CSPM) Software
Microsoft Defender for Cloud Review, Pricing, Pros & Cons
Microsoft Defender for Cloud provides free Foundational CSPM and paid Defender CSPM plans, combining multicloud inventory, secure score, policy assessment, compliance, a cloud security graph, attack paths, data and identity context, governance, and workflow automation.
Research by Global Tool Radar Research SystemEvidence checked: Aug 10, 2026AI-assisted · No Global Tool Radar hands-on testView research methodology
Buying snapshot
Quick buying snapshot
A compact view of who this tool fits, what it costs, and what to confirm before choosing it.
- The buyer requires one flat and publicly stable paid CSPM price before connecting inventory: Paid cost depends on protected resource mix, agreement, region, currency, exclusions, serverless conversions, and optional pre-purchase; current official pages also disagree on complete billable scope.
- The purchase must include managed response, full SIEM, full data cataloging, or runtime workload protection by default: Defender Experts, Sentinel, Purview full cataloging, and Defender workload-protection plans are separate services, purchases, or consumption layers rather than universal CSPM entitlements.
- Foundational CSPM is free. Defender CSPM is a pay-as-you-go Azure plan metered against defined protected resource counts across connected clouds. Microsoft also offers a one-year pre-purchase pool of Defender Commit Units that can be consumed by any publicly available Defender for Cloud plan at retail rates.
- Foundational CSPM · new Azure subscriptions must opt in starting October 27, 2026
- Foundational CSPM remains free. The broader Defender for Cloud pricing page states that the first 30 days are free and usage after that is automatically charged, with stated exceptions for some adjacent plans.
Product scope
Product functionality and purchase scope
This profile evaluates the free Foundational CSPM and paid Defender CSPM entitlements inside Microsoft Defender for Cloud. It includes only the CSPM capabilities the current plan comparison assigns to those plans and does not treat every Defender for Cloud workload-protection, Microsoft security, data-governance, SIEM, managed-service, or DevOps product as included.
Product checked: Aug 10, 2026
- Free Foundational CSPM inventory, security assessment, Microsoft Cloud Security Benchmark, Secure Score, recommendations, data export, workbooks, remediation tools, and workflow automation
- Paid Defender CSPM cloud security graph, attack paths, risk prioritization, security explorer, critical assets, CIEM, agentless VM and Kubernetes posture, sensitive-data context, custom recommendations, and regulatory compliance
- Azure, AWS, GCP, Azure Arc hybrid resources, GitHub, Azure DevOps, Docker Hub, and JFrog Artifactory only where the current feature matrix lists support
- Azure Government and Azure Government Secret availability subject to the cloud support matrix
- ServiceNow preview, Azure Logic Apps, Event Hubs, Log Analytics, REST APIs, workbooks, and export workflows where entitled and configured
- Pay-as-you-go Azure metering and optional Defender for Cloud commit-unit purchase path
- Defender for Servers, Containers, Storage, Databases, APIs, App Service, Key Vault, Resource Manager, AI Services, and other cloud workload protection plans unless separately enabled
- Malware scanning, runtime alerting, and endpoint protection not assigned to Defender CSPM in the current plan matrix
- Microsoft Sentinel SIEM and SOAR ingestion, analytics, and retention charges
- Microsoft Purview full data cataloging and its separate licenses
- GitHub Advanced Security products and licenses beyond the DevOps posture features included in paid Defender CSPM
- Microsoft Security Copilot and Microsoft Defender Experts managed detection and response
- Azure Logic Apps, Log Analytics, Event Hubs, ServiceNow, and third-party destination consumption or licenses
- Microsoft Defender for Cloud Apps CASB, which is a different product
Pricing checked: Aug 10, 2026
- Azure pay-as-you-go Defender CSPM: Enable Foundational CSPM or paid Defender CSPM on Azure subscriptions and connected AWS or GCP scopes, with usage billed through the Azure agreement.
- Microsoft sales or Azure partner: Acquire Defender CSPM through Microsoft sales or an Azure partner when agreement-specific pricing, government eligibility, or multicloud scope needs commercial confirmation.
- One-year Defender Commit Units: Pre-purchase a noncancelable one-year pool usable across publicly available Defender for Cloud plans, including Defender CSPM. Published pool discounts range from 10% to 22% by commit-unit tier, and unused units expire at term end.
Pricing plans
Microsoft Defender for Cloud pricing table
Pricing checked: Aug 10, 2026
Official factConfidence 99%2 linked sources
The zero-price Foundational CSPM offer is exact and retained. Paid Defender CSPM is withheld from numeric offers: the pricing page lists compute, storage, database, and serverless meters and conversion rules, while the August 7 product overview lists only compute, storage, and databases by cloud; the paid amount is hidden in the captured pricing table. Microsoft directs buyers to the calculator, their Azure agreement, sales, or partners. A separate one-year pre-purchase plan offers commit-unit discounts but is a broader Defender for Cloud purchasing vehicle, not a CSPM-only SKU.
Official pricing pageCommercial scope needs confirmation
Current official sources describe an offer or purchase route differently. The page remains usable, but affected price schema is withheld until the scope is resolved.
- The pricing page includes serverless resources and conversion rules, while the newer August 7, 2026 CSPM overview's Azure, AWS, and GCP billable tables list compute, storage, and databases without serverless. Serverless quantities must be confirmed in the buyer's Azure pricing state before forecast binding.
Pricing cautions
- Inventory every billable resource class before enabling paid CSPM broadly: Counts vary across running compute, eligible storage, databases, functions, web apps, and published serverless-container conversions, with exclusions that differ by cloud.
- Do not infer a commitment from a monthly or annual cost display: The primary paid route is usage-metered. A one-year commitment exists only when eligible buyers explicitly purchase the separate Defender Commit Unit pre-purchase plan.
- Budget connected-service consumption separately: Logic Apps, Log Analytics, Event Hubs, Sentinel, ServiceNow, Purview, GitHub security products, and workload-protection plans can add their own licenses or usage charges.
PlanPriceKey differencesBest for
Foundational CSPMCurrent Foundational CSPM planSupporting pricing evidence
- 0 · per cloud scope · Foundational CSPM enabled for Azure subscriptions, connected AWS accounts, or connected GCP projects
- new Azure subscriptions must opt in starting October 27, 2026
- Foundational posture capabilities: Asset inventory, data export, workbooks, MCSB, Secure Score, security recommendations, remediation tools, and workflow automation; Cloud-specific support and connector permissions apply.
Defender CSPMPaid Microsoft Defender Cloud Security Posture Management planSupporting pricing evidenceAmount unverified — check official pricing
- Azure usage meter: pay as you go; Actual amount depends on region, currency, Azure agreement, date, and the protected resource mix; no amount is retained from the incomplete public state.
- Billable resources: Compute, storage, databases; pricing page also includes serverless resources; Azure, AWS, and GCP resource types and exclusions vary; current official sources conflict on serverless inclusion.
- Paid CSPM capabilities: Agentless scanning, graph, attack paths, risk prioritization, data-aware posture, CIEM, custom recommendations, governance, regulatory compliance, DevOps mapping, and ServiceNow preview; Feature-specific cloud support, extensions, permissions, previews, and connected services apply.
Plan upgrade triggers
Verified plan boundaries that can change the required edition.
The organization needs attack paths, the cloud security graph, risk prioritization, security explorer, critical-asset and internet-exposure context, native CIEM, sensitive-data context, agentless vulnerability or secrets scanning, custom recommendations, regulatory assessments, governance, advanced DevOps mapping, or ServiceNow preview.
Supporting pricing evidenceWhat is included, connected, or sold separately
Product scope
What is included, connected, or sold separately
Material capabilities are separated by their verified relationship to the target product.
Cloud infrastructure entitlement managementRelationship not verified
Native CIEM is included in paid Defender CSPM and is not dependent on the deprecated standalone Entra Permissions Management product.
Plan: Foundational CSPM: Not verified · Defender CSPM: Not verified
Data-aware security posture and sensitive-data discoveryRelationship not verified
Smart-sampled data-aware posture is included; complete catalog scanning and all classifications require Microsoft Purview.
Plan: Foundational CSPM: Not verified · Defender CSPM: Not verified
Foundational CSPMRelationship not verified
The free baseline remains available at no cost; new Azure subscriptions must opt in starting October 27, 2026.
Plan: Foundational CSPM: Not verified · Defender CSPM: Not verified
Generative AI security assistantRelationship not verified
No Security Copilot entitlement is inferred from the Defender CSPM purchase.
Microsoft Security Copilot
Managed detection and responseRelationship not verified
Defender Experts coverage for cloud workloads is separately scoped and priced and is not a CSPM entitlement.
Microsoft Defender Experts
Microsoft Sentinel SIEM and SOAR integrationRelationship not verified
Defender for Cloud exports and integrates with Sentinel, Splunk, QRadar, and other systems; those products are not included.
Microsoft Sentinel
Runtime cloud workload protectionRelationship not verified
CSPM assessment and agentless posture do not imply all runtime alerts, malware protection, or workload plan entitlements.
Microsoft Defender for Servers, Containers, Storage, Databases, APIs, and other workload plans
How the score is calculated
Scoring method
How the score is calculated
The score uses the category-specific buying dimensions below and their displayed weights.
This page is based on public product information, official sources, structured feature data, and multi-model AI evaluation. It is not a hands-on lab test unless explicitly stated. Confidence percentages describe our research indicators, not the probability that a claim is true or a measured accuracy rate.
- Evidence confidence
- 76%
- AI claim confidence
- 99%
- Required-field evidence status
- 100%
- Evidence freshness
- 54%
- Field traceability
- 100%
- Model agreement
- 92%
Why this confidence level
- Evidence confidence uses source level and claim-to-source support; AI claim confidence is shown separately.
- Required-field evidence status measures whether weighted required claims have evidence links; it does not mean every product behavior was independently verified.
- 8 of 8 weighted claims have evidence links.
- 0 A1 documentary official sources and 8 A2 official product sources are linked.
- 1 independent review sources are retained, including 0 professional sources with an explicit hands-on method.
- 4 weighted claims are past the review window.
- 1 non-blocking commercial scope issue requires confirmation.
Cloud coverage and visibility18%
84Free multicloud inventory, workbooks, and Secure Score establish baseline visibility, and paid agentless scanning plus the security graph and explorer expand asset and relationship views, subject to connector coverage and resource-type support differences.
Detection and policy depth18%
80MCSB assessments and standard recommendations run on Foundational CSPM, while paid Defender CSPM enables custom KQL recommendations and deeper agentless and container posture checks, so detection depth scales with the chosen plan and enabled scopes.
Risk prioritization and context16%
86The paid cloud security graph, attack paths, CIEM identity context, data-aware posture, and critical-asset marking supply the primary risk-context layer; without Defender CSPM those contextual signals are not part of the free baseline.
Remediation operations15%
79Remediation tools, workflow automation, Logic Apps, REST APIs, and DevOps-related integrations support operational follow-through, but buyers still need to configure scopes, roles, and connected services.
Compliance and governance13%
82The paid plan adds governance rules, assigning owners, and setting due dates, which are missing from the base benchmark tracking in the free plan.
Integrations and reporting10%
80Export, workbooks, REST APIs, Event Hubs, Log Analytics, Sentinel, ServiceNow, GitHub, and Azure DevOps provide broad reporting and integration options, but several targets are separate services rather than included capabilities.
Support and total cost10%
62Foundational CSPM at zero cost lowers the entry barrier, but Defender CSPM pay-as-you-go metering lacks a retained public amount, carries serverless-scope ambiguity, and can accumulate separate charges for Logic Apps, exports, Sentinel, and related services, so total cost depends heavily on estate size and connected-service design.
Public review signals
Defender for Cloud is well rated for unified Microsoft visibility, with noise and navigation concerns
The retained exact-product aggregate is favorable. Review material commonly praises centralized cloud visibility, native Azure and Microsoft security integration, recommendations, threat intelligence, and multicloud posture. Common cautions concern tuning, false positives, fragmented administration, remediation ownership, cost visibility, and dependence on the broader Microsoft environment.
Public review signals updated: Aug 10, 2026
Commonly reported strengths
- Centralized cloud posture and workload visibility
- Native Azure and broader Microsoft security integration
- Actionable recommendations and strong threat context
Commonly reported concerns
- Operational noise and false positives require tuning
- Configuration can span multiple Microsoft portals
- Cost visibility and remediation ownership become difficult at scale
Gartner Peer Insights4.4/5
- Rating count
- 160 ratings
- Source context
- Microsoft Defender for Cloud on Gartner Peer InsightsExact product
Microsoft Defender for Cloud tag profile
Company size
- Enterprise
- Mid-market
- Small business
Microsoft Defender for Cloud core capabilities
- Free Foundational CSPM across Azure, AWS, and GCP
- Multicloud inventory, Microsoft Cloud Security Benchmark, Secure Score, recommendations, and workbooks
- Paid intelligent cloud security graph, security explorer, and contextual attack paths
- Native CIEM across Azure, AWS, and GCP
- Agentless VM vulnerability and secrets scanning plus Kubernetes and container posture
- Data-aware security posture, sensitive-data context, and critical-asset protection
Detailed strengths and purchase cautions
Why it is worth considering
- Foundational CSPM supplies no-cost multicloud asset inventory, Microsoft Cloud Security Benchmark assessments, Secure Score, security recommendations, data export, workbooks, remediation tools, and workflow automation across Azure, AWS, and GCP.
- Paid Defender CSPM adds the intelligent cloud security graph, security explorer, contextual attack paths, risk prioritization, critical-asset protection, native CIEM, agentless VM vulnerability and secrets scanning, Kubernetes and container posture, and data-aware sensitive-data context.
- Custom KQL recommendations, regulatory compliance controls, exemptions, governance rules with owners and due dates, and DevOps mapping extend policy and ownership workflows on the paid plan.
- Logic Apps automation plus REST APIs, Event Hubs, Log Analytics, Sentinel export, ServiceNow preview, GitHub, and Azure DevOps integrations support operational handoff without replacing the CSPM control plane.
What to confirm before buying
- Defender CSPM is usage-metered with no retained public paid amount, and official sources conflict on whether serverless resources belong in the complete billable scope, so buyers must inventory compute, storage, databases, and any serverless conversions before broad enablement.
- Cloud security graph, attack paths, risk prioritization, security explorer, CIEM, agentless scanning, data-aware posture, custom recommendations, advanced compliance, governance, and DevOps mapping require the paid Defender CSPM plan rather than Foundational CSPM.
- Logic Apps, Log Analytics, Event Hubs, Sentinel, ServiceNow, Purview classification use, GitHub security products, and separate workload-protection plans can generate additional licenses or usage charges outside the CSPM meter.
- Exemptions, scans, finding closure, and attack-path removal are not instantaneous and can take up to 24 hours, and feature support varies by commercial versus government clouds, multicloud connectors, DevOps, registries, and res
Cross-model buying perspectives
Multi-AI review
Cross-model buying perspectives
Multiple AI models assess this tool against the same buying criteria, so you can compare scores, confidence, fit, cautions, and final views.
AI assessment updated: Sep 23, 2026
Score comparisonGPTxAIGeminiRange
Cloud coverage and visibility8884808
Detection and policy depth85817510
Risk prioritization and context90878010
Remediation operations8077803
Compliance and governance8779808
Integrations and reporting8383758
Support and total cost5862657
cspm cloud misconfig detection8282853
cspm cloud compliance policy8478806
cspm risk prioritization context8988854
cspm remediation guidance workflow8180801
cspm multicloud operability8685851
- Detection and policy depth: 75–85 (10-point range)
- Risk prioritization and context: 80–90 (10-point range)
- Cloud coverage and visibility: 80–88 (8-point range)
GPTAI-assisted buyer perspective83
Microsoft Defender for Cloud fits buyers that want a free multicloud CSPM baseline first and can evaluate paid CSPM for graph-based risk analysis, data and identity context, governance, and workflow automation after checking resource coverage and connected-service costs.
- Review confidence
- 83/100
Model details
- Strengths
- Foundational CSPM is free and includes inventory, Secure Score, recommendations, remediation tools, workflow automation, and export across Azure, AWS, and GCP.
- Paid Defender CSPM adds cloud security graph, attack paths, risk prioritization, CIEM, agentless scanning, data-aware posture, and advanced compliance functions.
- The product supports integrations and exports to Logic Apps, REST APIs, Event Hubs, Log Analytics, Sentinel, ServiceNow, GitHub, and Azure DevOps.
- Cautions
- Paid Defender CSPM is usage-metered and the captured pricing table suppresses the paid amount, so buyers need the calculator or commercial channel to size spend.
- Current official pages disagree on whether serverless resources belong in the complete billable scope, so resource accounting needs validation before broad enablement.
- Several connected services and workload plans can add separate charges, so the CSPM budget does not fully capture adjacent platform costs.
xAIAI-assisted buyer perspective81
Microsoft Defender for Cloud fits Azure-centered or multicloud buyers that want a free Foundational CSPM baseline for inventory, MCSB, Secure Score, and recommendations, then selectively enable paid Defender CSPM for graph, attack paths, CIEM, and data-aware context, provided they can accept usage metering, connector administration, and separate connected-service costs.
- Review confidence
- 81/100
Model details
- Strengths
- Foundational CSPM supplies no-cost multicloud asset inventory, Microsoft Cloud Security Benchmark assessments, Secure Score, security recommendations, data export, workbooks, remediation tools, and workflow automation across Azure, AWS, and GCP.
- Paid Defender CSPM adds the intelligent cloud security graph, security explorer, contextual attack paths, risk prioritization, critical-asset protection, native CIEM, agentless VM vulnerability and secrets scanning, Kubernetes and container posture, and data-aware sensitive-data context.
- Custom KQL recommendations, regulatory compliance controls, exemptions, governance rules with owners and due dates, and DevOps mapping extend policy and ownership workflows on the paid plan.
- Logic Apps automation plus REST APIs, Event Hubs, Log Analytics, Sentinel export, ServiceNow preview, GitHub, and Azure DevOps integrations support operational handoff without replacing the CSPM control plane.
- Cautions
- Defender CSPM is usage-metered with no retained public paid amount, and official sources conflict on whether serverless resources belong in the complete billable scope, so buyers must inventory compute, storage, databases, and any serverless conversions before broad enablement.
- Cloud security graph, attack paths, risk prioritization, security explorer, CIEM, agentless scanning, data-aware posture, custom recommendations, advanced compliance, governance, and DevOps mapping require the paid Defender CSPM plan rather than Foundational CSPM.
- Logic Apps, Log Analytics, Event Hubs, Sentinel, ServiceNow, Purview classification use, GitHub security products, and separate workload-protection plans can generate additional licenses or usage charges outside the CSPM meter.
- Exemptions, scans, finding closure, and attack-path removal are not instantaneous and can take up to 24 hours, and feature support varies by commercial versus government clouds, multicloud connectors, DevOps, registries, and res
GeminiAI-assisted buyer perspective79
Microsoft Defender for Cloud provides a zero-cost entry point with its Foundational CSPM plan for basic multicloud inventory and benchmark mapping, while its paid Defender CSPM tier adds advanced cloud security graph relationships and contextual risk prioritizations for teams willing to navigate complex pay-as-you-go resource metering and associated connected-service costs.
- Review confidence
- 79/100
Model details
- Strengths
- A permanent free tier is provided through Foundational CSPM, delivering multicloud asset inventory, Microsoft Cloud Security Benchmark compliance, and Secure Score recommendations without a financial commitment.
- The paid tier delivers contextual risk analysis by combining an intelligent cloud security graph, attack path modeling, cloud infrastructure entitlement management, and data-aware posture tracking to highlight high-priority items.
- The platform offers flexible automated remediation options using built-in tools, REST APIs, Event Hubs, and native Logic Apps integration.
- Cautions
- The paid Defender CSPM plan relies on a complex usage meter with suppressed public pricing tables and conflicting official product terms regarding the billing inclusion of serverless resources.
- Essential surrounding capabilities like Sentinel ingestion, deep Purview classification, runtime threat protection, and automated workflows incur separate usage or license fees.
- Remediation statuses, exemptions, scans, and attack-path updates are not real-time and can take up to 24 hours to propagate across the system.
Research transparency
How this page was researched
A compact record of the evidence used, what was not tested, and which conclusions still need verification.
- Official sources
- 8
- Broad product review sources
- 1
- Marketplace and app-store sources
- 0
- Editorial sources
- 0
- Latest evidence check
- Aug 10, 2026
Research basis
Global Tool Radar generated this assessment from structured facts linked to public sources. No Global Tool Radar hands-on test is recorded in this page's research data. Any external hands-on assessment is identified separately and does not affect the Global Tool Radar score.
Conflict handlingUnresolved evidence is disclosed on the page; affected deterministic calculations and price schema are withheld when the conflict is blocking.
View research methodologyVerified findingsFoundational CSPM remains free. The broader Defender for Cloud pricing page states that the first 30 days are free and usage after that is automatically charged, with stated exceptions for some adjacent plans.
- Foundational CSPM is free. Defender CSPM is a pay-as-you-go Azure plan metered against defined protected resource counts across connected clouds. Microsoft also offers a one-year pre-purchase pool of Defender Commit Units that can be consumed by any publicly available Defender for Cloud plan at retail rates.
- Free Foundational CSPM across Azure, AWS, and GCP Multicloud inventory, Microsoft Cloud Security Benchmark, Secure Score, recommendations, and workbooks Paid intelligent cloud security graph, security explorer, and contextual attack paths Native CIEM across Azure, AWS, and GCP Agentless VM vulnerability and secrets scanning plus Kubernetes and container posture Data-aware security posture, sensitive-data context, and critical-asset protection Custom KQL recommendations, regulatory compliance, exemptions, governance rules, owners, and due dates Logic Apps workflow automation, REST APIs, Event Hubs, Log Analytics, Sentinel, ServiceNow, GitHub, and Azure DevOps integration
- USD 0 for Foundational CSPM. No paid Defender CSPM amount is bound because the current pricing page suppresses the amount and current official pages disagree on whether serverless resources belong in the complete billable scope.
- The zero-price Foundational CSPM offer is exact and retained. Paid Defender CSPM is withheld from numeric offers: the pricing page lists compute, storage, database, and serverless meters and conversion rules, while the August 7 product overview lists only compute, storage, and databases by cloud; the paid amount is hidden in the captured pricing table. Microsoft directs buyers to the calculator, their Azure agreement, sales, or partners. A separate one-year pre-purchase plan offers commit-unit discounts but is a broader Defender for Cloud purchasing vehicle, not a CSPM-only SKU.
Verification notes and unresolved itemsThe pricing page includes serverless resources and conversion rules, while the newer August 7, 2026 CSPM overview's Azure, AWS, and GCP billable tables list compute, storage, and databases without serverless. Serverless quantities must be confirmed in the buyer's Azure pricing state before forecast binding.
- All eight CSPM attributes are supported by current official Microsoft sources, led by the August 7, 2026 exact plan comparison.
- The package binds only the exact free Foundational CSPM amount.
- Paid numeric pricing is withheld because amount, complete billable scope, region, agreement state, and serverless eligibility were not proven together.
- CSPM is separated from CWPP plans, Sentinel, Purview full cataloging, GitHub products, Security Copilot, Defender Experts, and connected-service consumption.
Sources checked
Sources checked
Microsoft Defender for Cloud source links
Set Up Continuous Export with REST APIMicrosoftLevel A2Linked to 1 scored claimChecked Aug 10, 2026
Create Custom Standards and RecommendationsMicrosoftLevel A2Linked to 0 scored claimsChecked Aug 10, 2026
Automate Remediation ResponsesMicrosoftLevel A2Linked to 0 scored claimsChecked Aug 10, 2026
About Data Security Posture ManagementMicrosoftLevel A2Linked to 1 scored claimChecked Aug 10, 2026
Cloud Infrastructure Entitlement ManagementMicrosoftLevel A2Linked to 1 scored claimChecked Aug 10, 2026
Identify and Remediate Attack PathsMicrosoftLevel A2Linked to 0 scored claimsChecked Aug 10, 2026
Microsoft Defender for Cloud PricingMicrosoft AzureLevel A2Linked to 4 scored claimsChecked Aug 10, 2026
What is Cloud Security Posture ManagementMicrosoftLevel A2Linked to 5 scored claimsChecked Aug 10, 2026
FAQ
Microsoft Defender for Cloud FAQ
What is the difference between Foundational CSPM and Defender CSPM?
Foundational CSPM is free and includes inventory, benchmark assessment, Secure Score, recommendations, reporting, export, remediation tools, and workflows. Paid Defender CSPM adds the cloud security graph, attack paths, risk prioritization, security explorer, critical assets, CIEM, agentless scanning, data-aware posture, custom recommendations, advanced compliance, governance, DevOps mapping, and ServiceNow preview.
Does Defender CSPM include workload protection?
It includes agentless vulnerability, secrets, Kubernetes posture, and other assessment features listed in the CSPM plan. Runtime threat protection, malware scanning, and workload-specific Defender plans remain separate unless the current matrix explicitly assigns a feature to CSPM.
Is Microsoft Sentinel included?
No. Defender for Cloud can export or stream data to Sentinel and other SIEM or data platforms, but Sentinel ingestion, analytics, automation, and retention are separate services and charges.
Does Defender CSPM replace Microsoft Purview?
No. Defender CSPM uses Purview classification technology and smart sampling for data-aware posture, but Microsoft explicitly directs buyers to Purview scanning for complete data cataloging and all sensitive information types.
Does annual cost in the Azure calculator require an annual contract?
No. Annual cost can be an estimate of pay-as-you-go usage. An explicit one-year commitment applies only to the separately purchased Defender for Cloud commit-unit pre-purchase plan.
Popular comparisons
Common Microsoft Defender for Cloud comparisons
Only high-scoring and nearby tools from the same subcategory are shown, avoiding comparisons between unrelated use cases.