https://nicolasuter.ch/tags/cwpp/Recent content in CWPP on Nicola SuterHugo -- gohugo.ioen-US© 2026 Nicola SuterSat, 03 Oct 2026 20:37:03 +0000https://nicolasuter.ch/defender-for-servers-decompiled/Sat, 03 Oct 2026 20:37:03 +0000https://nicolasuter.ch/defender-for-servers-decompiled/<p>When speaking with customers and colleagues, I often encounter questions and misconceptions about Defender for Servers in Microsoft Defender for Cloud. In this post, I explore these questions:</p> <ul> <li>Why should I care about Defender for Servers?</li> <li>How should I onboard my servers to Microsoft Defender for Servers?</li> <li>What happens under the hood when I onboard servers?</li> <li>How can I selectively deploy Defender for Servers (e.g., for a pilot)?</li> <li>How can I enforce and maintain full coverage of Defender for Servers?</li> <li>How can I monitor and query Defender for Servers coverage?</li> </ul> <figure><img class="my-0 rounded-md" loading="lazy" decoding="async" fetchpriority="auto" alt="Defender for Server Confusion" width="2980" height="1652" src="https://nicolasuter.ch/defender-for-servers-decompiled/meme_hu_faf426a335ca2958.png" srcset="https://nicolasuter.ch/defender-for-servers-decompiled/meme_hu_faf426a335ca2958.png 800w, https://nicolasuter.ch/defender-for-servers-decompiled/meme_hu_c287ab41c2de71c9.png 1280w" sizes="(min-width: 768px) 50vw, 65vw" data-zoom-src="https://nicolasuter.ch/defender-for-servers-decompiled/meme.png"><figcaption>Typical confusion of Defender for Servers</figcaption></figure> <h2 class="relative group">Defender for Servers Plans and Licensing <div id="defender-for-servers-plans-and-licensing" class="anchor"></div> <span class="absolute top-0 w-6 transition-opacity opacity-0 -start-6 not-prose group-hover:opacity-100 select-none"> <a class="text-primary-300 dark:text-neutral-700 !no-underline" href="#defender-for-servers-plans-and-licensing" aria-label="Anchor">#</a> </span> </h2> <p>While client devices in Microsoft Defender for Endpoint (MDE) are usually licensed through Microsoft 365 subscriptions such as Microsoft 365 E5, servers do not benefit from this licensing model. Instead, server licensing follows the Azure consumption model.</p> <p>If you work with the Microsoft account team, you might also be able to obtain <em>Microsoft Defender for Endpoint Server</em> licenses. These are not consumption-based, so they do not require an Azure subscription and are usually part of enterprise agreements.</p>