Direct answer: at the Azure Retail Prices API on 10 November 2026 (eastus, USD, excluding tax and discounts), Defender for Servers P1 is $0.00672/node-hour = $4.91/month, P2 is $0.02/node-hour = $14.60/month, and customers who already own Microsoft Defender for Endpoint P2 can use P2 MDATP Benefit at $0.0137/hour = $10.00/month. P2 adds agentless vulnerability/malware/secrets scanning, file integrity monitoring, JIT, network map, DNS/network-layer threat detection, and 500 MB/node/day of free eligible security-data ingestion (subscription total, applied per workspace). At Log Analytics $2.30/GB, the $9.69 P2-P1 gap equals about 4.21 GB/month/node = 140 MB/day; with MDATP the $5.09 gap equals about 2.21 GB/month = 74 MB/day. For 100 servers: P1 $490.56, P2 $1,460, P2 MDATP $1,000.08. Adjacent plans: CSPM $5.11/resource-month, Storage $9.78/account-month + $0.1492/million transactions + $0.15/GB malware scanning, Key Vault $0.25/vault-month, Containers $6.87/vCPU-month.
This guide is for cloud security budget owners, SOC/platform, compliance, finance and procurement. It separates official price facts, editorial calculations and exclusions, covering P1/P2 capability gaps, per-server TCO, the 500 MB break-even, adjacent CSPM/Storage/Key Vault/Containers plans, hidden costs and a 90-day checklist. Prices come from the Defender for Cloud pricing page, Azure Retail Prices API and Microsoft Learn (10 November 2026). This is not procurement advice.
(1) P2's 500 MB/day covers eligible security tables only, calculated on the subscription total—not all logs; Application/System and other tables still bill at Log Analytics rates. (2) P2 can only be enabled at subscription level (disabled per resource), while P1 can be enabled per resource; the 30-day trial cannot be paused or extended. (3) The bill may be dominated by Storage transactions/malware scanning or CSPM resource counts, not the P1/P2 unit price.
P1 vs P2: agentless and data rights
P1 is entry-level: Defender for Endpoint EDR, automatic onboarding, integrated alerts/incidents, software inventory, compliance assessment and agent-based vulnerability scanning. P2 adds agentless vulnerability scanning, agentless malware/secrets scanning, file integrity monitoring, JIT VM access, network map, DNS alerts, Azure network-layer threat detection, OS update assessment and 500 MB/node/day eligible data ingestion. If you need agentless scanning, secrets, FIM, JIT or heavy security logs, P2's increment is real; for EDR plus basic vulnerability, P1 is enough.
| Capability | P1 | P2 | Note |
|---|---|---|---|
| MDE onboarding/EDR | Yes | Yes | Core endpoint detection |
| Alerts/incidents | Yes | Yes | Defender portal |
| Software inventory/compliance | Yes | Yes | Baseline posture |
| Agent-based vulnerability | Yes | Yes | Agent required |
| Agentless vulnerability | — | Yes | P2 increment |
| Malware/secrets scanning | — | Yes | Agentless |
| File integrity monitoring | — | Yes | P2 increment |
| JIT/network map | — | Yes | P2 increment |
| 500 MB/node/day | — | Yes | Eligible tables |
Sources: Learn "Select a Defender for Servers plan" and "Defender for Servers overview" (10 November 2026). P2 is subscription-level with per-resource disable; P1 is per-resource. Features follow the official comparison.
Unit prices: P1 $4.91, P2 $14.60, MDATP $10.00
At 730 hours: P1 0.00672×730=$4.91/node-month; P2 0.02×730=$14.60; P2 MDATP Benefit 0.0137×730=$10.00. The $9.69 P2-P1 gap is the price of agentless + FIM + JIT + 500 MB data; the MDATP gap is only $5.09. If you already buy MDE P2 for endpoints, confirm the MDATP benefit to avoid paying for endpoint licensing twice.
| Plan | Hourly | Monthly/node | Gap vs P1 |
|---|---|---|---|
| P1 | $0.00672 | $4.91 | — |
| P2 | $0.02000 | $14.60 | +$9.69 |
| P2 MDATP Benefit | $0.01370 | $10.00 | +$5.09 |
Sources: Retail API (productName=Microsoft Defender for Servers, eastus, 10 November 2026). 730 hours; excludes tax, discounts, Log Analytics, Storage, CSPM and Sentinel.
Fleet: 10/100/500/1,000 servers
Scaling linearly: 10 servers P1 $49.06, P2 $146.00, P2 MDATP $100.01; 100 $490.56/$1,460.00/$1,000.08; 500 $2,452.80/$7,300.00/$5,000.40; 1,000 $4,905.60/$14,600.00/$10,000.80. The P2-P1 increment is $969.44/month at 100 servers, $4,847.20 at 500 and $9,694.40 at 1,000. Whether it pays depends on the need for agentless/FIM/JIT and actual eligible log volume.
| Nodes | P1/month | P2/month | P2 MDATP/month |
|---|---|---|---|
| 10 | $49.06 | $146.00 | $100.01 |
| 100 | $490.56 | $1,460.00 | $1,000.08 |
| 500 | $2,452.80 | $7,300.00 | $5,000.40 |
| 1,000 | $4,905.60 | $14,600.00 | $10,000.80 |
Editorial calculation: node-month fee × count; excludes Log Analytics, Storage, CSPM, Sentinel, tax and discounts. Actual billing is hourly and prorated for partial months.
500 MB free data: P2's break-even
P2 grants 500 MB/node/day on the subscription total (machines × 500 MB), applied per workspace; only eligible security tables count (SecurityAlert, SecurityBaseline, SecurityEvent, WindowsFirewall, MDCFileIntegrityMonitoringEvents and others), while Application/System logs do not. At $2.30/GB: 100 MB/day/node (3 GB/month) is worth $6.90, so P1+logs $11.81 < P2 $14.60; 140 MB/day (4.2 GB) is $9.66, P1+logs $14.57 ≈ P2; 300 MB/day (9 GB) is $20.70, P1+logs $25.61 > P2; 500 MB/day (15 GB) is $34.50, P1+logs $39.41. With MDATP at $10.00, the break-even is about 74 MB/day.
| Per node/day | GB/month | Log cost | P1+logs | P2 | Lower |
|---|---|---|---|---|---|
| 0 | 0 | $0 | $4.91 | $14.60 | P1 |
| 100 MB | 3.0 | $6.90 | $11.81 | $14.60 | P1 |
| 140 MB | 4.2 | $9.66 | $14.57 | $14.60 | ≈ tie |
| 300 MB | 9.0 | $20.70 | $25.61 | $14.60 | P2 |
| 500 MB | 15.0 | $34.50 | $39.41 | $14.60 | P2 |
Editorial calculation: Log Analytics Analytics Logs $2.30/GB (first 5 GB/month per billing account free, not reflected per node); 500 MB/day is the P2 eligible-table allowance; actuals follow the workspace bill and eligible tables.
Adjacent plans: CSPM, Storage, Key Vault, Containers
Defender for Cloud is not one price: CSPM $0.007/resource-hour = $5.11/resource-month (VMs, storage accounts, OSS DBs, SQL PaaS, serverless containers/functions; 2 serverless containers = 1 resource, 8 functions/apps = 1); Storage $0.0134/account-hour = $9.78/account-month, plus $0.1492/million transactions above 73M/month and $0.15/GB malware scanning; Key Vault $0.00034/vault-hour = $0.25/vault-month; Containers $0.00941/vCPU-hour = $6.87/vCPU-month, with 20 free monthly image vulnerability assessments per charged vCore and $0.29/image digest beyond. Select the plans you need, then multiply by resources—don't enable everything by default.
| Plan | Unit price | Monthly/unit | 100 units |
|---|---|---|---|
| CSPM | $0.007/resource-h | $5.11/resource | $511.00 |
| Storage | $0.0134/account-h | $9.78/account | $978.20 |
| Key Vault | $0.00034/vault-h | $0.25/vault | $24.82 |
| Containers | $0.00941/vCPU-h | $6.87/vCPU | $686.93 |
Sources: Defender for Cloud pricing page and Retail API (eastus/Global, 10 November 2026). Storage adds transactions and malware scanning; CSPM counting rules and Containers scan allowances follow the official docs; excludes tax and discounts.
Selection matrix and hidden costs
Match the need: EDR/alerts/basic vulnerability with eligible logs under 140 MB/day/node use P1; agentless scanning, secrets/FIM/JIT/network map or logs above 140 MB/day use P2; with MDE P2, prefer P2 MDATP (break-even about 74 MB/day); cross-resource posture/attack paths use CSPM; storage malware/transactions use Defender for Storage; Key Vault at $0.25/vault; AKS runtime/images use Containers. Seven hidden costs: P2 is subscription-level only, 500 MB covers eligible tables only, the 30-day trial cannot be paused/extended, Storage transactions/malware scanning, CSPM resource counting, MDE licence overlap, and Sentinel ingestion scope. 90 days: weeks 1–2 inventory nodes, log volume/tables, and agentless/FIM/JIT needs; weeks 2–4 price P1/P2/MDATP and the 500 MB break-even; weeks 4–6 count CSPM/Storage/Key Vault/Containers resources; weeks 6–8 run the 30-day trial with log sampling; weeks 8–10 verify agent/agentless coverage and alerts; weeks 10–12 reconcile plans, tables and resource counts against the bill.
| Scenario | First choice | Check first |
|---|---|---|
| EDR/basic vulnerability only | P1 | Log volume, per-resource switch |
| Agentless/FIM/JIT/secrets | P2 | Subscription-level enable, 500 MB tables |
| Already own MDE P2 | P2 MDATP | Licence overlap, 74 MB break-even |
| Cross-resource posture/attack path | CSPM | Resource counting rules |
| Storage malware/transactions | Defender for Storage | $0.15/GB, 73M transactions |
| AKS runtime/images | Defender for Containers | vCPU count, 20 scans allowance |
Editorial summary, not a vendor recommendation; availability, trials, resource counting and billing follow the official docs.
FAQ
How is Defender for Servers billed?
Per node-hour: P1 $0.00672/h = $4.91/month, P2 $0.02/h = $14.60/month, P2 MDATP $0.0137/h = $10.00/month. Based on 730 hours; Log Analytics, Storage, CSPM, Sentinel and tax are additional.
What is the difference between P1 and P2?
P2 adds agentless vulnerability/malware/secrets scanning, FIM, JIT, network map, DNS/network-layer threat detection, OS update assessment and 500 MB/node/day eligible ingestion. P1 is enough for EDR/basic vulnerability; P2 for agentless/FIM/JIT or heavy security logs.
How does the 500 MB free data work?
P2 grants machines × 500 MB/day on the subscription total, applied per workspace; only eligible security tables count, while Application/System logs bill normally. 100 servers theoretically get 50 GB/day, but billing depends on total ingested volume.
Is P2 worth it over P1?
At Log Analytics $2.30/GB, the $9.69 P2-P1 gap equals about 4.21 GB/month/node (140 MB/day); above that, free ingestion offsets the difference. With the MDATP benefit, the $5.09 gap breaks even at about 74 MB/day.
Can P2 be enabled for only some machines?
P2 is enabled at subscription level but can be disabled per resource; P1 can be enabled per resource. For a mixed fleet, use subscription-level P2 plus per-resource disable/enable according to the official deployment scope.
What about the 30-day trial?
The trial starts automatically and cannot be paused or extended; after 30 days the plan bills. Plan evaluation goals and log sampling first, so the scope is not a surprise at trial end.
How do CSPM/Storage/Key Vault stack?
CSPM $5.11/resource-month (VMs/storage/DB/serverless); Storage $9.78/account-month + $0.1492/million above 73M transactions + $0.15/GB malware; Key Vault $0.25/vault-month; Containers $6.87/vCPU-month. Multiply by resource count—don't enable everything.
How do I reduce cost?
Five steps: (1) enable P2 only where agentless/FIM/JIT is needed; (2) use the MDATP benefit to avoid paying for MDE twice; (3) control eligible-table volume and route ordinary logs to lower-cost tables; (4) review CSPM/Storage/Key Vault resource counts; (5) use the 30-day trial to sample real data before setting scope.
Research method and limitations
Official facts (pricing page, Retail API, Learn): P1 $0.00672, P2 $0.02, P2 MDATP $0.0137/node-hour; CSPM $0.007/resource-hour (Global), Storage $0.0134/account-hour + $0.1492/million + $0.15/GB, Key Vault $0.00034/vault-hour, Containers $0.00941/vCPU-hour; 500 MB/node/day eligible tables on subscription total/workspace; P2 subscription-level. Editorial calculations: 730 hours, Log Analytics $2.30/GB, scaled by nodes/resources.
Seven limitations: (1) only eastus/Global public list prices, excluding tax/CSP/enterprise discounts; (2) log volume and resource counts are editorial assumptions; (3) the 500 MB benefit covers eligible tables only, so value depends on table mix; (4) excludes Sentinel, Storage transactions/scanning details and CSPM counting nuances; (5) no real alert/scan/performance test; (6) P1/P2 features change—follow the official comparison; (7) prices/plans change—recheck official pages and bills before purchase.
Sources and basis
- Microsoft Azure, Microsoft Defender for Cloud Pricing: azure.microsoft.com/en-us/pricing/details/defender-for-cloud. P1/P2, CSPM, Storage, Key Vault, Containers, trials and billing rules. Accessed 10 November 2026.
- Azure Retail Prices API (productName=Microsoft Defender for Servers, eastus): prices.azure.com/api/retail/prices. $0.00672/$0.02/$0.0137, CSPM $0.007, Storage $0.0134, Key Vault $0.00034, Containers $0.00941. Accessed 10 November 2026.
- Microsoft Learn, Select a Defender for Servers plan: plan-defender-for-servers-select-plan. P1/P2 capabilities, deployment scope, 30-day trial. Accessed 10 November 2026.
- Microsoft Learn, Use the data ingestion benefit: data-ingestion-benefit. 500 MB/node/day, subscription total, workspace, eligible tables. Accessed 10 November 2026.
Data cut-off 10 November 2026; prices/availability follow Microsoft official pages and bills; this is not procurement, commercial or legal advice.