Does setting the top-level pricingTier to Standard enable Defender for every resource type?

No, the top-level pricingTier is largely informational/legacy, actual protection is controlled per-plan under the plans array, each resource type (VirtualMachines, SqlServers, StorageAccounts, etc.) needs its own pricingTier explicitly set to Standard. A resource type not listed, or listed with pricingTier still at Free, gets no active Defender protection regardless of what the top-level field says.

What does the CapGBPerMonthPerStorageAccount setting under OnUploadMalwareScanning actually limit?

It caps the volume of data (in GB per month, per storage account) that gets scanned for malware on upload, once that cap is reached for a given account in a given month, additional uploads to that account stop being scanned until the next month, this is a cost-control mechanism, not a security setting, so a very high-upload-volume storage account could have uploads going unscanned for the remainder of the month after hitting the cap.

Does enabling AgentlessVmScanning replace the need for the Defender agent on VMs?

It provides a meaningful baseline (vulnerability and malware scanning without agent deployment) but doesn't necessarily cover every capability an in-guest agent provides (like certain runtime behavioral detections). For comprehensive coverage, many organizations run both agentless scanning (for broad, deployment-free baseline coverage) and the agent-based approach (for VMs where deeper runtime visibility matters), rather than treating them as strictly either/or.

Azure Defender for Cloud Config Builder

IAM & SecurityAzure

Configure Defender for Cloud plan settings including per-resource pricing tiers, extensions, and security contacts.

Microsoft Defender for Cloud Configuration

Configure Defender for Cloud plan settings including per-resource pricing tiers, extensions, and security contacts.

Required Fields

subscriptionIdpricingTierplansplans[0].nameplans[0].pricingTiersecurityContacts.emails

{
  "subscriptionId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
  "pricingTier": "Standard",
  "plans": [
    {
      "name": "VirtualMachines",
      "pricingTier": "Standard",
      "subPlan": "P2",
      "extensions": [
        {
          "name": "AgentlessVmScanning",
          "isEnabled": true
        },
        {
          "name": "MdeDesignatedSubscription",
          "isEnabled": false
        }
      ]
    },
    {
      "name": "SqlServers",
      "pricingTier": "Standard",
      "subPlan": null
    },
    {
      "name": "AppServices",
      "pricingTier": "Standard",
      "subPlan": null
    },
    {
      "name": "StorageAccounts",
      "pricingTier": "Standard",
      "subPlan": "PerTransaction",
      "extensions": [
        {
          "name": "OnUploadMalwareScanning",
          "isEnabled": true,
          "additionalExtensionProperties": {
            "CapGBPerMonthPerStorageAccount": 5000
          }
        },
        {
          "name": "SensitiveDataDiscovery",
          "isEnabled": true
        }
      ]
    },
    {
      "name": "Containers",
      "pricingTier": "Standard",
      "subPlan": null,
      "extensions": [
        {
          "name": "ContainerRegistriesVulnerabilityAssessments",
          "isEnabled": true
        }
      ]
    },
    {
      "name": "KeyVaults",
      "pricingTier": "Standard",
      "subPlan": null
    },
    {
      "name": "Dns",
      "pricingTier": "Standard",
      "subPlan": null
    },
    {
      "name": "Arm",
      "pricingTier": "Standard",
      "subPlan": "PerSubscription"
    }
  ],
  "autoProvisioningSettings": {
    "logAnalyticsAgent": "On",
    "workspaceId": "/subscriptions/a1b2c3d4/resourceGroups/rg-security/providers/Microsoft.OperationalInsights/workspaces/law-security"
  },
  "securityContacts": {
    "emails": "security-team@contoso.com",
    "phone": "+1-555-0199",
    "alertNotifications": "On",
    "alertsToAdmins": "On",
    "notificationsSeverity": "High"
  }
}

Generated Output

Output will appear here...

About This Tool

Configure Microsoft Defender for Cloud plan pricing tiers per resource type (VirtualMachines, SqlServers, StorageAccounts, Containers, KeyVaults) each with their own subPlan and extensions, since Defender for Cloud is billed per-plan, not as one flat subscription-wide toggle. Enabling the top-level pricingTier alone does nothing for a specific resource type, each plan under plans needs its own pricingTier set to Standard, and forgetting one (leaving it at Free implicitly) means that resource type gets none of Defender's threat detection even though the subscription overall looks 'protected' at a glance.

When to Use This Tool

•Setting StorageAccounts' subPlan to PerTransaction with OnUploadMalwareScanning enabled and a CapGBPerMonthPerStorageAccount cap, so malware scanning cost is bounded per account rather than scaling unpredictably with upload volume on a high-traffic storage account.
•Enabling AgentlessVmScanning on the VirtualMachines plan specifically to get vulnerability and malware scanning without deploying an agent to every VM, useful for a fleet where agent deployment coverage is inconsistent.
•Setting securityContacts.notificationsSeverity to High so security contacts are only paged for genuinely high-severity findings, not every low-severity informational alert Defender generates.
•Auditing each entry in plans individually to confirm pricingTier is actually Standard (not left at the Free default) for every resource type actually in use in the subscription, since a plan silently left at Free provides essentially no active threat protection for that resource type.

Pro Tips

TIP

Audit every entry under plans individually rather than trusting the top-level pricingTier field, a subscription can look protected at a glance while several specific resource-type plans are silently still at Free.

TIP

Storage malware scanning's per-account monthly GB cap is a real cost control but also a real coverage gap once exceeded, size the cap based on actual expected upload volume, not an arbitrary round number, or high-traffic accounts silently lose scanning coverage mid-month.

TIP

Route securityContacts to an address/channel that's actually monitored in near-real-time for anything above Medium severity, a security contact configured but pointed at an unmonitored inbox provides no practical benefit over having no contact configured at all.

How It Works Under the Hood

The builder validates that subscriptionId, pricingTier, plans, and the first plan's name/pricingTier plus securityContacts.emails all resolve before accepting the JSON as a plausible combined Defender for Cloud pricing and configuration payload; it can't verify that a specific plan/subPlan/extension combination is actually valid or currently available for your subscription's region, that's only confirmed against the live Microsoft.Security resource provider.

Frequently Asked Questions

Does setting the top-level pricingTier to Standard enable Defender for every resource type?: No, the top-level pricingTier is largely informational/legacy, actual protection is controlled per-plan under the plans array, each resource type (VirtualMachines, SqlServers, StorageAccounts, etc.) needs its own pricingTier explicitly set to Standard. A resource type not listed, or listed with pricingTier still at Free, gets no active Defender protection regardless of what the top-level field says.
What does the CapGBPerMonthPerStorageAccount setting under OnUploadMalwareScanning actually limit?: It caps the volume of data (in GB per month, per storage account) that gets scanned for malware on upload, once that cap is reached for a given account in a given month, additional uploads to that account stop being scanned until the next month, this is a cost-control mechanism, not a security setting, so a very high-upload-volume storage account could have uploads going unscanned for the remainder of the month after hitting the cap.
Does enabling AgentlessVmScanning replace the need for the Defender agent on VMs?: It provides a meaningful baseline (vulnerability and malware scanning without agent deployment) but doesn't necessarily cover every capability an in-guest agent provides (like certain runtime behavioral detections). For comprehensive coverage, many organizations run both agentless scanning (for broad, deployment-free baseline coverage) and the agent-based approach (for VMs where deeper runtime visibility matters), rather than treating them as strictly either/or.

Related Learning Guides

Azure RBAC Role Finder5 min read
Azure AD & RBAC Guide26 min read

Was this tool helpful?

Disclaimer: This tool runs entirely in your browser. No data is sent to our servers. Always verify outputs before using them in production. AWS, Azure, and GCP are trademarks of their respective owners.

Azure Defender for Cloud Config Builder

IAM & SecurityAzure

Configure Defender for Cloud plan settings including per-resource pricing tiers, extensions, and security contacts.

Microsoft Defender for Cloud Configuration

Configure Defender for Cloud plan settings including per-resource pricing tiers, extensions, and security contacts.

Required Fields

subscriptionIdpricingTierplansplans[0].nameplans[0].pricingTiersecurityContacts.emails

Generated Output

Output will appear here...

About This Tool

When to Use This Tool

•Setting StorageAccounts' subPlan to PerTransaction with OnUploadMalwareScanning enabled and a CapGBPerMonthPerStorageAccount cap, so malware scanning cost is bounded per account rather than scaling unpredictably with upload volume on a high-traffic storage account.
•Enabling AgentlessVmScanning on the VirtualMachines plan specifically to get vulnerability and malware scanning without deploying an agent to every VM, useful for a fleet where agent deployment coverage is inconsistent.
•Setting securityContacts.notificationsSeverity to High so security contacts are only paged for genuinely high-severity findings, not every low-severity informational alert Defender generates.
•Auditing each entry in plans individually to confirm pricingTier is actually Standard (not left at the Free default) for every resource type actually in use in the subscription, since a plan silently left at Free provides essentially no active threat protection for that resource type.

Pro Tips

TIP

How It Works Under the Hood

Frequently Asked Questions

Does setting the top-level pricingTier to Standard enable Defender for every resource type?: No, the top-level pricingTier is largely informational/legacy, actual protection is controlled per-plan under the plans array, each resource type (VirtualMachines, SqlServers, StorageAccounts, etc.) needs its own pricingTier explicitly set to Standard. A resource type not listed, or listed with pricingTier still at Free, gets no active Defender protection regardless of what the top-level field says.
What does the CapGBPerMonthPerStorageAccount setting under OnUploadMalwareScanning actually limit?: It caps the volume of data (in GB per month, per storage account) that gets scanned for malware on upload, once that cap is reached for a given account in a given month, additional uploads to that account stop being scanned until the next month, this is a cost-control mechanism, not a security setting, so a very high-upload-volume storage account could have uploads going unscanned for the remainder of the month after hitting the cap.
Does enabling AgentlessVmScanning replace the need for the Defender agent on VMs?: It provides a meaningful baseline (vulnerability and malware scanning without agent deployment) but doesn't necessarily cover every capability an in-guest agent provides (like certain runtime behavioral detections). For comprehensive coverage, many organizations run both agentless scanning (for broad, deployment-free baseline coverage) and the agent-based approach (for VMs where deeper runtime visibility matters), rather than treating them as strictly either/or.

Related Learning Guides

Azure RBAC Role Finder5 min read
Azure AD & RBAC Guide26 min read

Was this tool helpful?