Defender for Cloud has a lot of plans. Every plan has its own toggle, its own scope rules and its own idea of who's allowed to touch it. My readiness notes for this topic were mostly question marks. So I did what I always do: rebuilt it in my lab and checked every answer against Microsoft Learn (October 2026).

Part 1 is the one-page version: what you get for free, what you pay for, where each plan can be turned on, and who can change what. Part 2 is a mock case: three small puzzles from my notes, each with the answer.

My lab: a Contoso tenant, subscription sub-lab-prod , resource group rg-lab-mdc with a Windows Server VM vm-lab-01 and a storage account stlabmdc01 , a Log Analytics workspace law-lab-mdc , and two test users, [email protected] and [email protected] . All names and numbers are made up.

TL;DR

Defender for Cloud is posture (CSPM) plus workload protection (CWPP). Foundational CSPM is free: recommendations, secure score, asset inventory and the Microsoft cloud security benchmark.…