Microsoft Defender for Cloud CSPM Plan 2

Robert Fenech Santucci 0 Reputation points
2026-11-05T16:01:13.1466667+00:00

For customers already subscribed to Microsoft Defender CSPM Plan 2, our understanding is that enabling Agentless Scanning for Machines does not incur additional licensing or usage costs. Could you confirm whether this feature is fully included in the existing subscription or whether any additional charges may apply depending on how the feature is used, such as the frequency of scanning, the number of machines scanned, or other usage-related factors?

Microsoft Security | Microsoft Defender | Microsoft Defender for Cloud
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Vasileios Dionysopoulos 646 Reputation points
    2026-11-06T10:12:26.7333333+00:00

    Hi Robert,

    Short answer: yes, your understanding is right, with one exception for AWS.

    A small naming point first, because it matters when you check pricing: there's one paid Defender CSPM plan. Plan 2 is a Defender for Servers name. Agentless scanning for machines is included in both Defender CSPM and Defender for Servers Plan 2, so either way you're covered.

    What's included

    • Microsoft's Defender for Cloud FAQ states that agentless scanning is part of these plans and that no additional Defender for Cloud charges apply when you enable it.
    • Defender CSPM is billed per billable resource (servers, databases, storage accounts). Turning on agentless scanning doesn't add a new billing meter, and scan frequency or the number of machines scanned doesn't change the price. What you pay is driven by how many resources are covered by the plan.

    Where a cost can appear: AWS (and possibly GCP)

    The scanner takes a short-lived disk snapshot, extracts the metadata, and deletes the snapshot, usually within minutes. For AWS, Microsoft notes that AWS may charge a small overhead for that snapshot storage. That charge comes from AWS, not from Defender for Cloud. I'd treat GCP the same way, since the scanner role there also creates snapshots in your project.

    To see exactly what it costs, the snapshots are tagged CreatedBy = Microsoft Defender for Cloud. Activate that tag in AWS Billing and Cost Management, then filter on it after about 24 hours.

    One thing worth knowing

    If snapshot deletion keeps failing (for example, a permissions issue) and 250 or more Defender-tagged snapshots pile up in an AWS scope, Defender pauses new scans there to stop storage costs from growing. Your Defender for Cloud charges continue during the pause. Check the scanner role permissions if you ever see scans stall.

    For Azure VMs only, I'd expect no extra cost at all.

    References

    Was this answer helpful?

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.