Defender for Cloud CSPM: understand the coverage you actually have

Enabled is the beginning of the conversation

When a team tells me Defender for Cloud is already turned on, I want to know what that means in the subscriptions and workloads that matter. A posture dashboard can exist while the organization still has gaps in coverage, ownership, and response. The question is whether the enabled plans provide the evidence the team needs to make a decision.

This adaptation of my April article separates foundational posture management, the paid Defender CSPM plan, and workload protection. They serve related purposes, but enabling one should not be treated as proof that all three are operating.

What foundational CSPM provides

Foundational CSPM is available at no cost and provides posture recommendations and secure score. Those capabilities help identify configuration weaknesses and give teams a baseline for hardening. It would be wrong to describe the free plan as offering no guidance: the recommendations are useful.

The operational problem I see is a backlog with no clear owner. A test environment may remain exposed months after a project ends, or an identity may retain access to sensitive resources after troubleshooting is finished. A recommendation only reduces risk when someone can evaluate it, approve the change, and verify the result.

Supporting reference: Protect your resources with Defender CSPM - Microsoft Defender for Cloud ↗

Where the paid plan adds context

Defender CSPM adds capabilities such as attack path analysis, cloud security explorer, governance, regulatory compliance, and agentless scanning. Attack paths help connect findings that are easy to underestimate separately. An exposed workload, a vulnerability, and excessive access to a sensitive resource can become a more consequential chain.

Use that context to guide investigation and remediation, rather than treating every modeled path as a proven successful exploit. Coverage depends on the connected environment, enabled components, permissions, and supported resource types. Microsoft notes that the Subscription Owner is required to enable all components, including the agentless scanner; simply seeing the plan enabled does not prove those components are working.

Verify the plan and its evidence

Review each relevant subscription and cloud connector, confirm the enabled plans and components, and check whether the findings correspond to assets the team recognizes. Pick one recommendation and one attack path, then follow each through an owned remediation process. Ask what changed, how the team verified it, and whether the same configuration can return through deployment automation.

For current deployments, check the foundational plan’s opt-in requirements. Microsoft’s documentation describes a change for new Azure subscriptions beginning October 27, 2026. That is a future change relative to this Nexlinks publication date, and existing enabled subscriptions are described separately. Use the current setup guide when implementing rather than assuming April’s default behavior still applies.

Posture and workload protection need separate decisions

Once posture is understood, select workload protection based on the resources and business data at risk. Defender for Storage may be a useful place to start where storage contains sensitive information, but it is a separate plan with configuration and cost considerations. Servers, databases, and containers need their own coverage review.

I would rather see a small, supported rollout with evidence and an owner than a broad activation nobody can operate. Model the bill, confirm the supported features, and establish how alerts reach the team responsible for response. A better-looking dashboard is useful only when it changes what the organization does.