Half of what Plan 2 does needs your servers onboarded to Azure Arc. Buy the plan without the Arc work and you paid for features you cannot use.
Plan 1 is endpoint detection and response for servers, anywhere. Plan 2 adds agentless vulnerability, malware and secrets scanning, file integrity monitoring, just-in-time access and baseline assessment. Several of those are documented as applicable only to machines onboarded through Azure Arc, which makes Arc the real prerequisite rather than an implementation detail.
- Two plansPlan 1 EDR, Plan 2 adds twelve capabilities
- Azure, AWS, GCPPlus on-premises Windows and Linux
- AgentlessMost Plan 2 scanning needs no agent
- 30 day trialCannot be stopped, paused or extended
Seven things that decide which plan you need and what it will actually deliver.
Windows and Linux, across three clouds and on-premises
Microsoft states it protects Windows and Linux machines in multicloud environments spanning Azure, Amazon Web Services and Google Cloud Platform, and on-premises. For UAE groups whose estate accumulated across an Azure migration, an acquisition running on AWS and a data centre nobody has decommissioned, that single coverage statement is usually the reason it gets evaluated.
Plan 1 is endpoint detection and response, delivered automatically
Plan 1 focuses on the endpoint detection and response capability provided by the Defender for Endpoint integration, with automatic onboarding, integrated alerts and incidents, software inventory discovery, regulatory compliance assessment and agent-based vulnerability scanning. For an organisation whose servers currently run traditional antivirus, that is already a substantial change.
Plan 2 is mostly agentless, which changed the deployment story
Agentless vulnerability scanning, agentless malware scanning and agentless machine secrets scanning are all Plan 2 capabilities. Microsoft also notes that Defender for Servers no longer uses the Log Analytics agent or Azure Monitor Agent for most plan features, with agentless scanning and the Defender for Endpoint integration replacing them, which removes most of the historic agent burden.
Just-in-time access, file integrity monitoring and baselines
Plan 2 adds just-in-time virtual machine access on Azure and AWS, file integrity monitoring, and assessment of operating system configuration against the compute security baselines in the Microsoft Cloud Security Benchmark. Those three together are what turn the product from threat detection into posture management, and they are the ones most often cited in an audit finding.
Azure Arc is a dependency, not a nice to have
The published feature table is explicit. Operating system system updates and baseline misconfiguration assessment are applicable only to machines onboarded with Azure Arc. File integrity monitoring is applicable to AWS and GCP machines only when onboarded with Arc. And for on-premises, Microsoft states that with direct onboarding you will not have full access to Plan 2 features.
Defender Experts for Servers, if you have no analysts
A managed extended detection and response service for server workloads, where Microsoft analysts triage, investigate and contain incidents then hand off with guided steps. It covers all Plan 1 and Plan 2 alerts where the detection source is Defender for Servers, across Windows and Linux on Azure, AWS, GCP and on-premises. It is sold separately, and DNS alerts are not in scope.
A thirty day trial that cannot be paused
Microsoft states that enabling a plan starts a 30-day trial period which you cannot stop, pause or extend, and advises planning ahead to meet your evaluation goals. That is worth reading before somebody enables it during a quiet week to have a look. An evaluation that begins two weeks before a holiday period effectively has half the time it appears to.
Plan 2 without Azure Arc is a partial deployment, and the gaps are documented.
The Arc dependency is stated in the published feature table rather than hidden, and it is the single most common reason a Defender for Servers deployment underdelivers.
- Operating system system updates, and operating system baseline misconfiguration assessment against the Microsoft Cloud Security Benchmark, are both listed as only applicable to machines onboarded with Azure Arc.
- File integrity monitoring is listed as available on Azure, AWS and GCP, but only applicable to AWS and GCP machines onboarded with Azure Arc.
- For on-premises machines, Microsoft recommends onboarding as Azure Arc virtual machines and states that with direct onboarding to Defender for Cloud you will not have full access to Plan 2 features.
- So the sequencing that works is Arc first, plan second. Organisations that buy the plan and schedule the Arc work afterwards spend the first quarter explaining why the capabilities in the business case are not visible yet.
Four things that stop a server protection project delivering half of what was bought.
We scope the Azure Arc work before the plan decision
Operating system updates and baseline misconfiguration assessment only apply to Arc-onboarded machines. File integrity monitoring on AWS and GCP only applies to Arc-onboarded machines. On-premises direct onboarding does not give full Plan 2 access. Arc is therefore the first line item in the plan, not a task somebody picks up in phase three.
We split the estate rather than buying one plan for everything
Microsoft allows Plan 1 to be enabled and disabled at the resource level per server, while Plan 2 cannot be enabled per resource but can be disabled per resource. That asymmetry is a design tool. A subscription on Plan 2 with specific resources disabled behaves very differently commercially from a blanket decision, and it is worth modelling.
We act on the secrets scanning findings, because nobody expects them
Agentless machine secrets scanning is a Plan 2 capability and it consistently produces the most uncomfortable output of any first run. Credentials in scripts, keys in configuration files, and connection strings on servers nobody has logged into for years. Those findings need an owner and a rotation plan before the report is circulated.
We time the thirty day trial around an actual evaluation
Microsoft is explicit that the trial cannot be stopped, paused or extended, and advises planning ahead to meet your evaluation goals. We agree what will be tested, who will look at it, and what decision the evaluation is meant to support, before anybody enables the plan. Otherwise the trial expires having proved nothing.
Six UAE situations where server protection needs modernising.
A group with servers spread across three clouds and a data centre
Defender for Servers protects Windows and Linux across Azure, AWS, GCP and on-premises. The practical route Microsoft recommends is onboarding AWS and GCP machines as Azure Arc virtual machines to get full feature access, and connecting AWS accounts and GCP projects to Defender for Cloud, which can enable the plan as part of the connection process.
A regulated firm with a file integrity monitoring requirement
File integrity monitoring is a Plan 2 capability and needs a Log Analytics workspace, either existing or created during configuration. On AWS and GCP it applies only to machines onboarded with Azure Arc. Where an obligation names file integrity monitoring specifically, that combination of dependencies is the actual project rather than the licence purchase.
An organisation that has never scanned its servers for secrets
Agentless machine secrets scanning, in Plan 2, finds credentials sitting on machines. In practice that means service account passwords in scripts, keys in configuration files and connection strings in places nobody remembers putting them. It is the finding that most often changes the priority of the wider secrets management conversation.
An operator that cannot deploy agents everywhere
The agent story changed. Microsoft states Defender for Servers no longer uses the Log Analytics agent or Azure Monitor Agent for most plan features, with agentless machine scanning and the Defender for Endpoint integration replacing them. For estates with change control that makes agent deployment slow, agentless scanning removes most of the obstacle.
An organisation with no server security analysts
Defender Experts for Servers is a managed extended detection and response service where Microsoft analysts triage, investigate and contain incidents then hand off with guided steps, and it includes proactive threat hunting and the ability to ask Microsoft experts about specific incidents. It is sold separately and requires Plan 1 or Plan 2 with Defender for Endpoint deployed.
A business trying to close down standing management access
Just-in-time virtual machine access, a Plan 2 capability on Azure and AWS, closes management ports until access is requested and approved. For organisations that have been trying to remove permanently open remote desktop and secure shell access for years, it is a more achievable route than a network redesign.
How UAE organisations protect servers today.
| Feature | Defender for Servers Plan 2 with Arc | Traditional antivirus on servers | Inconsistent or unknown |
|---|---|---|---|
Endpoint detection and response on servers | Yes | No | No |
Vulnerability scanning without an agent | Yes | No | No |
Secrets found on machines | Yes | No | No |
Operating system baselines assessed | Yes, with Arc | No | No |
File integrity monitoring | Yes | Sometimes | No |
Just-in-time management access | Yes | No | No |
Covers AWS and GCP machines too | Yes | Separately | No |
Alerts correlate with the rest of the estate | Yes | No | No |
Regulatory compliance assessed continuously | Yes | No | No |
Answer to what is running on that server | Inventory | Guess | None |
Nineteen capabilities, and where each one applies.
| Capability | Plan 1 | Plan 2 | Where it applies | |
|---|---|---|---|---|
| Multicloud and hybrid support | Yes | Yes | Azure, AWS, GCP and on-premises machines connected to Defender for Cloud | |
| Defender for Endpoint automatic onboarding | Yes | Yes | All supported machines | |
| Defender for Endpoint endpoint detection and response | Yes | Yes | Azure, AWS and GCP | |
| Integrated alerts and incidents | Yes | Yes | Azure, AWS and GCP | |
| Software inventory discovery | Yes | Yes | Azure, AWS and GCP | |
| Regulatory compliance assessment | Yes | Yes | Different standards for different environments | |
| Vulnerability scanning, agent based | Yes | Yes | Azure, AWS and GCP | |
| Vulnerability scanning, agentless | No | Yes | Azure, AWS and GCP | |
| Defender for DNS alerts | No | Yes | Azure, AWS and GCP | |
| Threat detection at the Azure network layer | No | Yes | Azure | |
| Operating system system updates | No | Yes | Only machines onboarded with Azure Arc | |
| Baseline misconfigurations, Microsoft Cloud Security Benchmark | No | Yes | Only machines onboarded with Azure Arc | |
| Defender Vulnerability Management premium features | No | Yes | Available in the Defender portal only | |
| Malware scanning, agentless | No | Yes | Azure, AWS and GCP | |
| Machine secrets scanning, agentless | No | Yes | Azure, AWS and GCP | |
| File integrity monitoring | No | Yes | AWS and GCP machines only when onboarded with Azure Arc | |
| Just-in-time virtual machine access | No | Yes | Azure and AWS | |
| Network map | No | Yes | Azure | |
| Free data ingestion, 500 MB per node per day | No | Yes | Requires a supported collection method such as Azure Monitor Agent |
Five steps, and Arc comes before the plan.
- 1
Inventory the estate and its connection state
How many Windows and Linux machines, in Azure, AWS, GCP and on-premises, and which of them are already Arc-enabled. Microsoft recommends onboarding AWS and GCP machines as Azure Arc virtual machines to take full advantage of the features, and notes that direct onboarding of on-premises machines limits Plan 2 access.
- 2
Decide the plan against the capabilities you need
Plan 1 for endpoint detection and response, which can be enabled and disabled per resource. Plan 2 for agentless vulnerability, malware and secrets scanning, file integrity monitoring, just-in-time access, network map and baseline assessment, enabled at subscription level with the option to disable specific resources.
- 3
Do the Arc and prerequisite work first
Azure Arc onboarding for the machines that need the Arc-dependent features. The Azure Policy machine configuration extension where operating system baseline assessment against the Microsoft Cloud Security Benchmark is required. A Log Analytics workspace where file integrity monitoring is in scope, and a supported collection method for the ingestion benefit.
- 4
Enable deliberately, with the trial clock in mind
The Defender for Endpoint extension installs automatically on supported machines, vulnerability management is enabled by default where that extension is present, and agentless scanning is enabled by default with Plan 2. The 30 day trial starts and cannot be paused, so the evaluation criteria and the people who will assess them are agreed beforehand.
- 5
Work the findings and decide the operating model
Secrets scanning results owned and rotated. Baseline misconfigurations prioritised. Just-in-time access configured for the machines with standing management ports. Then who works the alerts, whether Defender Experts for Servers fills that gap, and who owns remediation of posture recommendations on an ongoing basis.
What organisations ask about Defender for Servers.
Fifteen checks that prevent a partial deployment.
Estate reality
- How many servers, and where?Azure, AWS, GCP, on-premises.
- How many are Windows and how many Linux?Both are supported.
- Are AWS accounts and GCP projects connected?That is the onboarding path.
- Are on-premises machines Arc-enabled?Direct onboarding limits Plan 2 features.
- Which servers genuinely need Plan 2?Plan 1 can be enabled per resource.
Prerequisites
- Is Azure Arc deployment scoped and funded?Several Plan 2 features depend on it.
- Is the machine configuration extension deployed?Required for OS baseline assessment.
- Do you have a Log Analytics workspace?Needed for file integrity monitoring.
- Is a supported collection method in place?For the 500 MB ingestion benefit.
- Is Defender for Endpoint already deployed?Required for Defender Experts for Servers.
After enabling
- Is the 30 day trial timed deliberately?It cannot be stopped, paused or extended.
- Do you want automatic provisioning on?The extension installs automatically by default.
- Who works the alerts?Or is Defender Experts for Servers in scope.
- Who owns remediation of the recommendations?Posture findings need an owner.
- Which resources should be excluded?Plan 2 can be disabled per resource.
Count how many of your servers are Azure Arc connected. That number sets the timeline.
Several of the Plan 2 capabilities people buy the product for are documented as only applying to Arc-onboarded machines. Establishing that number first is the difference between a deployment that delivers and one that explains.
Related Services
Explore more solutions that work great with this service
Defender for Cloud
Azure posture, and the free tier almost nobody has enabled
Defender for Endpoint
Business, Plan 1 or Plan 2, and what each actually gives you
Server Management
Windows and Linux server administration
Defender Vulnerability Management
Certificates, browser extensions and firmware, not just patching
Azure Security Audit
Subscription audit, starting with the free tier you already own
Azure Cloud Solutions
Azure landing zone, migration, FinOps, managed
Microsoft Security Dubai
Entra, Defender, Purview, Sentinel, and what you already own
Endpoint Security
Defender for Endpoint and Intune managed