Review Defender for Cloud protection plans

Description

Defender for Cloud’s Free tier provides basic security features but may not include paid threat protection required by a workload. Review the needed coverage by resource type and select an appropriate plan.

Setting Standard does not enable every resource type and extension at once. Coverage and costs depend on resource_type, subplans and extension settings.

Potential impact

Missing threat detection or assessment features may leave organizational security requirements unmet.
Enabling a plan without reviewing scope and costs can cause unexpected charges.

Remediation

Determine the required Defender plans from workload needs and existing security tools.
Where paid protection is required, configure tier = "Standard" with the appropriate resource_type, subplan and extensions.
Review the resources affected within the subscription and estimated costs, then verify actual protection and alert collection after activation.

Examples

These examples compare pricing tiers only. In AzureRM 4.50.0, omitting resource_type selects VirtualMachines by default. They do not configure every Defender plan in the subscription.

Before

hcl

resource "azurerm_security_center_subscription_pricing" "example" {
  tier = "Free"
}

The Free tier is selected for the resource type. Check whether other controls provide the required protection.

After

hcl

resource "azurerm_security_center_subscription_pricing" "example" {
  tier = "Standard"
}

The Standard tier is selected for that type. Verify actual features, extensions and costs separately.