Whenever I work with Microsoft Defender for Servers, the same question comes up sooner or later, and it sounds simpler than it is: Plan 1 or Plan 2? In the tenants I've reviewed, this has never been a matter of ticking a box. You're weighing security requirements against operational effort and the budget you actually have. Once the estate includes Azure VMs, on-premises servers connected through Azure Arc and perhaps a few AWS workloads, the decision turns into a governance and architecture question as well.
Plan 1 brings Defender for Endpoint to your servers
Plan 1 gives you native Microsoft Defender for Endpoint (MDE) integration for servers, which I consider the baseline every environment should have. Windows and Linux servers can be monitored centrally, protected with Endpoint Detection and Response (EDR) and fed by Microsoft's threat intelligence. The MDE license is included for every server protected by Defender for Servers P1, so you don't have to assign it separately. You configure it in the Defender for Cloud portal under Environment settings → your subscription → Defender plans.
One point people tend to overlook is that Plan 1 gives you a decent set of security alerts and recommendations but no in-depth vulnerability management. For plenty of mid-sized environments that mostly want visibility and basic protection, that's enough. And if a vulnerability management product such as Qualys or Rapid7 is already running, Plan 1 slots in nicely and fits into the routines you already have.
Plan 2 earns its price with a handful of extra features
Defender for Servers Plan 2 goes quite a bit further. These are the features that matter most to me:
- Agentless vulnerability scanning (especially in Azure VMs, no MDE agent required)
- Premium Defender Vulnerability Management (DVM) features, meaning vulnerability assessment and advanced recommendations
- Just-in-time (JIT) VM access, so only the ports you need are opened, and only when you need them
- File integrity monitoring (FIM), which alerts you when critical files change
- 500 MB/day/server free Log Analytics ingestion for specific security tables
For security teams that can't or don't want to put an agent on every machine, agentless scanning and the DVM premium features are a real benefit. The 500 MB per day and server also tends to cover the security logging needs of many environments. Prices change, so look at the official pricing page for the current figures.
Azure Arc brings on-premises and multi-cloud servers into scope
To protect servers that don't run in Azure, you need Azure Arc. Arc turns Windows and Linux servers, wherever they're hosted, into regular Azure resources, and that makes them eligible for Defender for Servers. You pick Plan 1 or Plan 2 per resource or group. With Arc, on-prem servers get agentless scanning (Plan 2) or EDR (Plan 1/2) just like machines in Azure.
My tip: Automate the Arc onboarding, either with Azure Policy or with command-line tools. Then the Defender rollout runs smoothly from the first day.
Microsoft Learn has a short walkthrough of how Arc works with Defender for Servers.
CSPM Foundation and Defender CSPM sit on a different layer
People often mix up Cloud Security Posture Management (CSPM) and Defender for Servers, but they cover different layers. CSPM Foundation comes built into Defender for Cloud and handles the basic checks, such as configuration reviews and overall cloud posture. Deeper capabilities like attack path analysis and advanced workbooks only come with the paid Defender CSPM.
Defender for Servers focuses specifically on the server layer and adds to what CSPM does. With CSPM Foundation alone you get no endpoint detection, no vulnerability assessment and no FIM. Those only arrive with Defender for Servers, Plan 1 or 2. If you want the details of the CSPM architecture, this Learn page explains it well.
A quick diagram usually makes the relationship clearer:
flowchart TD
CloudEnv["Cloud Environment"] --> CSPM["CSPM Foundation/Defender"]
VM["Azure/Arc Server"] --> P1["Defender for Servers P1"]
VM --> P2["Defender for Servers P2"]
P1 --> EDR["EDR (Defender for Endpoint)"]
P2 --> EDR
P2 --> DVM["Defender Vulnerability Mgmt"]
P2 --> JIT["JIT/Agentless/FIM/500MB Logs"]
Figure: CSPM, Defender for Servers Plan 1/2 and the add-ons, and how they relate.
Configuration is simple, but a few details catch people out
You set Plan 1 or Plan 2 at subscription level in the Defender for Cloud portal. Defender plans can be turned on per resource group or for the entire subscription. Switching between plans is easy, but the change applies immediately and affects your licensing costs. On-premises servers have to be onboarded through Arc first, otherwise they won't appear when you assign Defender.
If you plan to use the 500 MB/day/server Log Analytics benefit, check which tables it covers (e.g., Security, SecurityBaseline, WindowsEvent). Anything outside those tables is billed extra. You'll find the details under Defender for Servers → Data collection in the portal.
A mistake I see a lot is turning on Plan 2 and then never rolling out JIT or FIM through policy, or leaving the Defender for Endpoint integration half configured. If you're not sure, going through the MDE integration steps will spare you some trouble later.
My decision usually follows a short practical path
In the end I tend to ask myself three questions:
- Do I need vulnerability management and agentless scanning? Then it's Plan 2.
- Are EDR and baseline monitoring enough? Plan 1 will do.
- Is a vulnerability management tool already in place? Then Plan 1 is often the sensible choice.
In heavily regulated or cloud-native setups I almost always choose Plan 2, for the agentless features and the better forensics. In mature hybrid environments where cost and basic protection come first, Plan 1 is often the better match. The licensing decision is rarely an academic one. It should line up with your governance model, your security budget and the tools you already run.
