Skip to main content

Workload plans: Storage, Containers, Key Vault, App Service, APIs, Resource Manager

Microsoft documentedDefender for Cloud · Source checked 2026-10-22 · Not yet verified in tenant · Sources: [1][2][3][4][5][6][7][8][9][10][11][12][13][14][15][16][17][18][19][20][21][22][23][24][25][26][27][28]

What it is​

Defender for Cloud sells workload protection as separate plans, one per resource type, each switched on per subscription or per connector. Servers and SQL have their own articles. This one covers the rest: Storage, Containers, Key Vault, App Service, APIs, Resource Manager, the non-SQL database plans and AI Services. They share the same enable surface (Environment settings > Defender plans, the Microsoft.Security/pricings resource) and the same alert pipeline into Defender XDR and Sentinel. They differ in what they watch and how they bill.

Two plans deploy something: Containers (a DaemonSet and an admission webhook) and Storage (an Event Grid system topic and a scanner identity). Everything else is pure platform telemetry. Key Vault, App Service, Resource Manager, APIs, the database plans and AI Services read logs Azure already has as the provider, so there is nothing to install, nothing to break, and nothing you can see from inside the resource.

None of these plans are posture tools. Recommendations come from foundational CSPM for free; Defender CSPM adds attack paths. The paid workload plans add threat detection, and in the Storage and Containers cases, scanning. Read the overview first if the plan and CSPM split is new, and onboarding for how AWS and GCP connectors get a Defender plans page of their own.

Licensing and prerequisites​

Every plan here is bought through Azure consumption on the subscription, not a Microsoft 365 SKU. Prices are on the Defender for Cloud pricing page and the cost calculator; Learn does not print numbers, so neither does this article. Billing units as Learn describes them:

PlanPricing nameBilling unit per LearnSub-plan or extensions
StorageStorageAccountsPer protected storage account per month, plus per GB scanned for malware, plus a transaction charge on high-volume accountsDefenderForStorageV2; extensions OnUploadMalwareScanning, SensitiveDataDiscovery
ContainersContainersPricing page only. TODO: confirm unit after the Defender Workload Unit changeExtensions ContainerSensor, AgentlessDiscoveryForKubernetes, ContainerRegistriesVulnerabilityAssessments, AgentlessVmScanning
Key VaultKeyVaultsPricing page; the Pricings sample shows PerKeyVaultPerKeyVault
App ServiceAppServicesTotal compute instances across all App Service plan tiersnone
APIsApiFive plans by monthly API traffic entitlement, billed per subscription, overage above the entitlement, counter resets monthly. New subscriptions default to Plan 1 with a one million call entitlementP1 default
Resource ManagerArmPricing page; the Pricings sample shows PerSubscriptionPerSubscription
Open-source relational DBsOpenSourceRelationalDatabasesPricing pagenone
Cosmos DBTODO: pricing name not shown in the Learn Pricings samplePricing pagenone
AI ServicesAIPricing page; 30-day trial capped at 75 billion tokens scannedExtension AIPromptEvidence

Prerequisites that matter:

  • Roles. Subscription Owner or Contributor to flip a plan. Storage per-account overrides also take Owner or Contributor on the storage account. AI Services threat detection at subscription level wants Owner or specific data actions. Sample alerts need Subscription Contributor.
  • Storage malware scanning needs Microsoft.EventGrid registered in the subscription. Legacy v1 storage accounts are not supported. On-upload scanning does not cover Azure Files, append blobs, page blobs, NFS 3.0 uploads or client-side encrypted blobs. Malware scanning is charged from day one, it is not in the 30-day trial.
  • Containers needs a supported cluster. EKS and GKE need the AWS or GCP connector first, then Azure Arc on the cluster for the sensor and Azure Policy extensions. Private EKS and GKE API servers must allow 172.212.245.192/28 and 48.209.1.192/28. Sensor egress is HTTPS 443 to *.cloud.defender.microsoft.com.
  • APIs needs the APIs published in Azure API Management. The plan is subscription level; individual APIs are then onboarded through a recommendation.
  • App Service works on any tier. Alert investigation wants diagnostic settings on the app, which cost storage.
  • Open-source relational databases: Azure Database for PostgreSQL and MySQL Flexible Server, all tiers, and Amazon RDS in preview. Not Arc-enabled machines. Cosmos DB: NoSQL API only.
  • AI Services: commercial cloud only, text tokens only, Azure OpenAI and Azure AI Model Inference models.

How it works​

Storage​

Activity monitoring reads data plane and control plane telemetry for Blob, Files and ADLS. No diagnostic logs needed. It flags Tor exit nodes, malicious IPs, leaked or over-permissive SAS tokens, and anomalies against a learned baseline. Hash reputation checks on new blobs and files come with every plan, including classic, but skip SMB shares and blobs written with Put Block and Put Block List.

Malware scanning is the paid extra on the new plan. On-upload scanning hooks BlobCreated and BlobRenamed through an Event Grid system topic that the service creates in the storage account's resource group. A StorageDataScanner resource with a system-assigned identity gets Storage Blob Data Owner and is added to the account's resource instance rules so it can read through a firewall. The blob is read in region, scanned in memory by Defender Antivirus, the result is written and the content discarded. Throughput is capped at 50 GB per minute per account; blobs up to 50 GB, archives included. Results land in two blob index tags (Scan result with No threats found, Malicious, Error or Not scanned, and Scan time (UTC)), a Defender for Cloud alert when malicious, and optionally an Event Grid custom topic and the StorageMalwareScanningResults Log Analytics table. Soft delete of malicious blobs is a built-in response. Subscription-level enablement also creates DefenderForStorageSecurityOperator, which keeps settings applied to new accounts.

Sensitive data threat detection samples blobs with the Purview SIT engine and uses the result to weight alerts. It costs nothing extra and can be turned off.

New plan versus classic: classic is per transaction with no malware scanning or sensitive data detection. The portal shows a New pricing plan available link on classic subscriptions. The migration guide is linked from the intro page; Learn gives no feature matrix.

Containers​

Four capabilities, two delivery models. Image vulnerability assessment, Kubernetes posture and control plane threat detection are agentless. Runtime threat detection needs the sensor.

  • Defender sensor. A DaemonSet in kube-system built on eBPF. Three pods: microsoft-defender-collector-ds-* (DaemonSet, needs SYS_ADMIN, SYS_RESOURCE, SYS_PTRACE, 296Mi and 360m), microsoft-defender-collector-misc-* (Deployment, cluster-level inventory) and microsoft-defender-publisher-ds-* (DaemonSet, the only one with egress, HTTPS 443). On AKS it is a security profile managed by the AKS resource provider; on EKS, GKE and Arc it is an Arc extension. Limits are fixed. It registers with a Log Analytics workspace as a pipeline but audit data is not stored there. It gives you process, network and DNS detections, binary drift, runtime anti-malware and the admission controller for security gating.
  • Azure Policy for Kubernetes. Gatekeeper v3 as an admission webhook, one pod, AKS add-on or Arc extension. This is what produces the data plane hardening recommendations and lets you deny privileged containers.
  • Audit logs. AKS: native, nothing to do, works on private clusters. EKS: CloudWatch into an SQS queue, Kinesis Firehose and S3 bucket that Defender for Cloud creates in your account. GKE: Cloud Logging into Pub/Sub at project level.
  • Agentless discovery. On AKS, Defender for Cloud creates the identity CloudPosture/securityOperator/DefenderForContainersSecurityOperator, gives it Kubernetes Agentless Operator at subscription scope, then uses AKS Trusted Access to create a ClusterRoleBinding to aks:trustedaccessrole:defender-containers:microsoft-defender-operator. On EKS it is the MDCContainersAgentlessDiscoveryK8sRole role; on GKE the mdc-containers-k8s-operator service account. Snapshots stay in the cluster's region.
  • Registry scanning. ACR via the Defender Container Registries role over Azure infrastructure, no network change even for private registries. ECR, GAR and GCR via the connector roles. New or imported images are scanned within hours; a daily rescan covers images pushed or pulled in the last 30 days or currently running in a monitored cluster. Older images drop out of rescans until pulled again. Findings come from Defender Vulnerability Management. Runtime scanning of running containers needs Registry access plus K8s API access or the sensor, or Agentless scanning for machines for registry-agnostic coverage.

Key Vault, App Service, Resource Manager, APIs, databases, AI​

Key Vault watches vault access patterns and raises alerts with the object ID, UPN or caller IP. Fields vary with the caller: an app shows no UPN, an outside-Azure caller shows no object ID. Azure VMs carry Microsoft IPs, so an alert with a Microsoft IP is not automatically internal. Response is the same every time: identify the caller, lock the firewall or trim the access policy, list the secrets touched, rotate them.

App Service inspects requests at the Azure front gateways before they reach the sandbox, plus the sandbox VM, its management interface and App Service internal logs. Because it sees many tenants it can spot a slow crawl across hosts that a single app cannot. Alerts cover MITRE pre-attack through command and control: scanners, known-bad IPs on FTP, high-privilege commands, Linux commands on a Windows app, fileless and mining behaviour. Dangling DNS detection fires when an app is decommissioned and its custom domain still resolves to it; it does not scan the registrar for existing stale records.

Resource Manager watches control plane operations whatever the client: portal, REST, CLI, PowerShell. Detections include operations from malicious IPs, disabling antimalware, suspicious scripts in VM extensions, Microburst and PowerZure toolkits, and lateral movement from management plane to data plane.

APIs ingests API Management traffic and runs anomaly and rule detections for the OWASP API Top 10, exfiltration, volumetric attacks and odd parameters. It also inventories endpoints with last-called date, 30-day inactivity, unauthenticated (no subscription key, JWT, client cert or Entra token policy executed) and data classification of bodies. Only APIs you onboard are protected. After onboarding, allow about 50 minutes for recommendations and 40 minutes for the API security dashboard.

Databases beyond SQL are two plans under Defender for Databases. Open-Source Relational Databases covers PostgreSQL and MySQL Flexible Server and Amazon RDS (Aurora, PostgreSQL, MySQL, MariaDB, preview); it alerts on brute force with success and failure split, and on access from breached hosts talking to mining C2. Cosmos DB covers the NoSQL API only, detects SQL-injection variants that work against Cosmos, Tor and known-bad IPs, and key-listing patterns that look like lateral movement. Neither touches your data or performance.

AI Services wraps Azure OpenAI and Model Inference calls with Prompt Shields and threat intelligence to alert on jailbreak, data leakage, poisoning and credential theft. Text tokens only. Alerts flow to Defender XDR. Suspicious prompt evidence is an opt-in toggle that puts redacted prompt and response fragments in the alert; without it, analysis still runs but the content is masked. Data security for AI interactions hands prompts to Purview and needs a Purview licence.

Configure​

All plans, the common path:

  1. Microsoft Defender for Cloud > Environment settings > pick the subscription (or the AWS or GCP connector).
  2. On Defender plans, toggle the row On. Enable all does every plan at once, which also enables Storage malware scanning at the default cap, so do not use it blind.
  3. Save. Some plans have a Settings link for components, below.

Storage:

  1. Toggle Storage On. On a classic subscription click New pricing plan available and confirm.
  2. Settings lets you turn off On-upload malware scanning or Sensitive data threat detection. Edit configuration sets the per-account monthly GB cap (default 10,000 GB, untick for unlimited), whether results are written as blob index tags, and soft delete of malicious blobs.
Defender plans page, Storage toggled On. Malware scanning and sensitive data detection are on by default from here. Source: Microsoft Learn, CC BY 4.0.
Defender plans page, Storage toggled On. Malware scanning and sensitive data detection are on by default from here. Source: Microsoft Learn, CC BY 4.0. · captured 2026-10-22
  1. Per account: storage account > Security + networking > Microsoft Defender for Cloud. On an unprotected account the pane shows the two feature checkboxes and Enable on storage account. On an account already covered by the subscription, Settings > Override Defender for Storage subscription-level settings On, then set malware scanning, the cap, exclusion filters (prefix, suffix, size, up to 24 values ORed), index tags, soft delete, an Event Grid custom topic and a Log Analytics workspace. Set the plan Off here with override On to exclude the account.
Per-account pane under Security + networking. This is also where you override subscription settings or exclude the account. Source: Microsoft Learn, CC BY 4.0.
Per-account pane under Security + networking. This is also where you override subscription settings or exclude the account. Source: Microsoft Learn, CC BY 4.0. · captured 2026-10-22

Containers:

  1. Toggle Containers On, then Settings.
  2. Azure subscription components: Agentless scanning for machines (node OS and secrets, with exclusion tags), Defender sensor (with Enable Defender Security Gating and Enable Defender Runtime Anti Malware under it), Azure Policy, Kubernetes API access, Registry access with Security findings. Security findings cannot be set through Azure Policy; it must be toggled here.
  3. AWS or GCP connector components: Agentless threat protection (audit logs, with a retention period on AWS), Auto provision Defender's sensor for Azure Arc, Auto provision Azure Policy extension for Azure Arc, Kubernetes API access, Registry access. Save, then Configure access and redeploy the CloudFormation stack or rerun the GCP script, then Update. Sensor install after discovery can take several hours.
Containers plan Settings on an Azure subscription, one toggle per component. Source: Microsoft Learn, CC BY 4.0.
Containers plan Settings on an Azure subscription, one toggle per component. Source: Microsoft Learn, CC BY 4.0. · captured 2026-10-22
Learn's AKS architecture: sensor, Azure Policy add-on, ACR scanning and native audit logs. Source: Microsoft Learn, CC BY 4.0.
Learn's AKS architecture: sensor, Azure Policy add-on, ACR scanning and native audit logs. Source: Microsoft Learn, CC BY 4.0. · captured 2026-10-22

Key Vault, App Service, Resource Manager, databases: toggle the row On, Save. No settings. Open-source relational databases and Cosmos DB can also be enabled per resource from the resource's Microsoft Defender for Cloud blade.

APIs:

  1. Toggle APIs On. Under Pricing click Details and pick the plan that matches 30-day API Management request volume (APIM > Metrics > Requests, Sum, last 30 days, summed across instances). Save.
  2. Recommendations > search Defender for APIs > Azure API Management APIs should be onboarded to Defender for APIs > select Unhealthy resources > Fix > Fix resources.
  3. Track in Workload protections > API security.
The onboarding recommendation. The plan toggle alone protects nothing until APIs are fixed through here. Source: Microsoft Learn, CC BY 4.0.
The onboarding recommendation. The plan toggle alone protects nothing until APIs are fixed through here. Source: Microsoft Learn, CC BY 4.0. · captured 2026-10-22

AI Services: toggle AI services On. Settings > Enable user prompt evidence On for prompt snippets in alerts; Enable data security for AI interactions only if Purview is licensed; AI model security for model scanning in Azure ML registries.

AI services row on the Defender plans page. Source: Microsoft Learn, CC BY 4.0.
AI services row on the Defender plans page. Source: Microsoft Learn, CC BY 4.0. · captured 2026-10-22

Verify​

  • Plan state: az security pricing list -o table, or the Coverage workbook under Workbooks. For Storage the Storage Center view shows protected, partially protected and unprotected accounts.
  • Sample alerts: Security alerts > Sample alerts > subscription > pick plans > Create sample alerts. They land in a few minutes and also flow to Sentinel, email and automations, which makes this the fastest end-to-end test of the alert pipeline. The resources in them are fake.
Sample alerts dialog. Needs Subscription Contributor. Source: Microsoft Learn, CC BY 4.0.
Sample alerts dialog. Needs Subscription Contributor. Source: Microsoft Learn, CC BY 4.0. · captured 2026-10-22
  • Storage, activity monitoring: upload any non-sensitive file to a container, Generate SAS, open the SAS URL in Tor Browser. Learn documents this as the Storage ATP validation. The resources Defender for Storage creates are visible too: an Event Grid system topic in the account's resource group and a StorageDataScanner resource instance in the account's networking rules.
  • Storage, malware scanning: Learn's alert validation page does not document an EICAR upload for Storage; it points to the Ninja training lab on GitHub for a hands-on scan test. TODO: run an EICAR upload in the dev tenant and record the index tag and alert name. After any upload, check the blob's index tags for Scan result and Scan time (UTC), and in the workspace:
Blob index tags written by malware scanning. Tags are not tamper-proof; use alerts, Event Grid or Log Analytics for anything that gates access. Source: Microsoft Learn, CC BY 4.0.
Blob index tags written by malware scanning. Tags are not tamper-proof; use alerts, Event Grid or Log Analytics for anything that gates access. Source: Microsoft Learn, CC BY 4.0. · captured 2026-10-22
StorageMalwareScanningResults
| where TimeGenerated > ago(1d)
| summarize count() by ScanResultType

TODO: confirm the column name for the result in the dev tenant; Learn names the table, not its schema.

  • Containers: kubectl get pods -n kube-system | grep microsoft-defender should list collector-ds on every node, one collector-misc and publisher-ds on every node. The Microsoft Defender for Cloud Attack Simulation tool on GitHub is the documented alert test; run it on a test cluster, alerts arrive between near real time and an hour. Image findings appear as container recommendations within hours of a push.
  • Key Vault: open the vault in Tor Browser through the portal, browse Secrets, sign out. An alert follows after some time.
  • App Service: browse https://<app>.azurewebsites.net/This_Will_Generate_ASC_Alert on an existing app. Learn quotes both about 1.5 hours and 2 to 4 hours for the alert.
  • APIs: Workload protections > API security shows onboarded collections; endpoints with no traffic since onboarding show Awaiting data.
  • Resource Manager, databases, AI: sample alerts only on Learn.

Troubleshoot​

SymptomLikely causeFix
New storage account not protectedSubscription-level protection starts up to 24 hours after account creationWait, or enable on the account directly
Malware scan tag says Not scanned or scanning stoppedMonthly cap hit (alert at 75 percent and at 100 percent), or throughput above 50 GB per minuteRaise the cap, use -1 for unlimited, add prefix or suffix filters for log and temp paths; cap changes take up to an hour
Malware scanning silently stoppedSomeone deleted the Event Grid system topic or StorageDataScanner, or Microsoft.EventGrid not registeredDisable and re-enable malware scanning to recreate the resources; register the provider
Scan result Error or Scan timed outBlob over 50 GB, nested archive beyond the 30 minute to 3 hour window, metadata updated right after upload, append or page blob, NFS 3.0, client-side encryptionFix the upload pattern; set metadata in the write options or delay it
Per-account setting ignoredoverrideSubscriptionLevelSettings not setResend with override true, or tick the override toggle in the portal
Event Grid topic not acceptedTopic uses private endpoint or wrong regionTopic must allow public network access and sit in the account's region
No Defender sensor pods on EKS or GKECluster not Arc-connected, auto provisioning off, or still inside the several-hour install windowCheck Arc, the connector Settings, and wait
Containers inventory empty on private EKS or GKEAPI server blocks the Defender IP ranges, or role lacks eks:UpdateClusterConfig / container.clusters.updateAllow 172.212.245.192/28 and 48.209.1.192/28 or grant the permission so Defender adds them
Image missing from vulnerability resultsNot pushed or pulled in 30 days and not running in a monitored clusterPull it once to re-enter the daily rescan
Runtime VA empty on some nodesWindows nodes, ephemeral OS disks, autoscaled nodes down at scan timeKnown gaps; use registry findings
Dangling DNS alert never firesCustom domain not pointed straight at App Service, or no traffic seen since enablementExpected per Learn
APIs plan on, no findingsAPIs not onboarded through the recommendationFix Azure API Management APIs should be onboarded; wait 40 to 50 minutes
API bill higher than expectedLeft on Plan 1 with more than one million calls a monthRe-pick the plan from Pricing > Details
Entra users missing in Purview Activity Explorer for AIPurview service principal 9ec59623-ce40-4dc8-a635-ed0275b5d58a absent in tenantNew-AzADServicePrincipal -ApplicationId that app ID
Key Vault alert shows a Microsoft IPCaller was an Azure VMStill investigate; Microsoft IP does not mean Microsoft

Gotchas and limits​

  • Storage malware scanning bills from day one and is included when you click Enable all or toggle Storage On. Set the cap before you enable on a high-ingest subscription, not after. Lifecycle management transactions also count toward the per-transaction overage on busy accounts.
  • Each commit is a scan. PutBlock and AppendFile do not trigger, PutBlockList and FlushWithClose do, so chunked uploaders can be scanned once per flush. Chunked fragments can also defeat detection: headers look corrupt and tails look clean.
  • Defender for Storage has less context than an endpoint: no Mark of the Web, no file path, no behaviour. Expect more false negatives than MDE on the same sample. Submit misses to the sample submission portal with Microsoft Defender for Storage as the source.
  • Index tags on ADLS Gen2 accounts need the Blob Tags for Hierarchical Namespace opt-in, still preview. Anyone with tag write rights can flip a tag, so ABAC rules that rely on Scan result are a convenience, not a control.
  • Containers alerts cover only activity after the plan was enabled. Helm-deployed components can lag up to 30 days behind the AKS add-on. Sensor resource limits cannot be changed, so budget 296Mi plus 200Mi per node.
  • Enabling agentless discovery on AKS creates a managed identity, a role assignment and a Trusted Access binding in your subscription. Policy that denies role assignments or trusted access bindings will break discovery quietly.
  • APIs is subscription billing on total traffic, not per APIM instance, and the counter resets monthly. Overage is computed against the plan entitlement.
  • App Service billing is per compute instance across all plans in the subscription, so a Premium plan scaled to ten instances costs ten times a single instance.
  • Open-source relational database protection is PaaS only; PostgreSQL on an Arc server falls under Defender for Servers, not this plan. Cosmos DB covers NoSQL only; Mongo, Cassandra, Gremlin and Table APIs get nothing.
  • AI Services scans text tokens only, commercial cloud only, no AWS. The Purview toggle needs a Purview licence and does not include Foundry agents.
  • Microsoft announced a Defender Workload Unit billing model in October 2026. The Learn pages here still describe per-plan billing. TODO: re-check the Containers and Storage units once the pricing pages change.

Further reading​

Dates for the two Tech Community posts are the page timestamps; the posts do not print a publish date.

My notes​

TODO: Sohail's notes after verification.

Changelog​

DateChangeSource
2026-10-22Drafted from Learn, with Learn images and diagrams[1]