Microsoft Defender for Cloud – Watch for CSPM Surprises

A new paid tier of cloud security posture management (CSPM) capabilities is now generally available. The new set of paid capabilities is now referred to as Microsoft Defender CSPM, while the original free set of capabilities are referred to as foundational CSPM. Foundational CSPM is limited to asset discovery, continuous assessment, and security recommendations. Defender CSPM capabilities (currently limited to compute resources, databases, and storage accounts) add attack path analysis to identify potential attack vectors, cloud security explorer, and threat hunting tools, as well as additional tools to help assess the security and regulatory compliance of specific resources. Defender CSPM supports Azure-based resources across all features. Some features support AWS-based resources, and a small subset support resources in Google Cloud Platform (GCP) and on-premises resources. Microsoft began charging for Defender CSPM capabilities in May 2023. Customers with applicable Defender for Cloud services assigned to resources monitored by Defender CSPM are eligible for discounts. Customers who do not want to pay for Defender CSPM should ensure they now have resources set to foundational CSPM. More details about forthcoming charges for Defender CSPM are discussed at https://learn.microsoft.com/azure/defender-for-cloud/concept-cloud-security-posture-management#defender-cspm-plan-options.