Only two lock-lab resource groups need Microsoft Defender for Serve…

Question

Only two lock-lab resource groups need Microsoft Defender for Servers, but billing and enablement are subscription-wide. How should the Azure security engineer think about plan enablement scope?

Accepted Answer

Enable the plan at Azure subscription scope (or connected AWS account / GCP project scope), then use official exclusions or per-resource settings when documentation allows — Plans light up at the subscription—or the connected AWS account or GCP project—not at a make-believe per-VM storefront SKU. After that, use the product’s real exclusions or per-resource knobs when the docs allow.

Answer

Purchase a unique per-virtual-machine marketplace SKU for each lock-lab VM outside Defender for Cloud

Answer

Enable Defender for Servers only inside Microsoft Sentinel workspace settings so resource groups inherit automatically

Answer

Enable the plan once in Security Copilot and assume every resource group is covered

Only two lock-lab resource groups need Microsoft Defender for Servers, but billing and enablement are subscription-wide. How should the Azure security engineer think about plan enablement scope?

Short Explanation

Full Explanation