MDE

When speaking with customers and colleagues, I often encounter questions and misconceptions about Defender for Servers in Microsoft Defender for Cloud. In this post, I explore these questions: Why should I care about Defender for Servers? How should I onboard my servers to Microsoft Defender for Servers? What happens under the hood when I onboard servers? How can I selectively deploy Defender for Servers (e.g., for a pilot)? How can I enforce and maintain full coverage of Defender for Servers? How can I monitor and query Defender for Servers coverage? Typical confusion of Defender for Servers Defender for Servers Plans and Licensing # While client devices in Microsoft Defender for Endpoint (MDE) are usually licensed through Microsoft 365 subscriptions such as Microsoft 365 E5, servers do not benefit from this licensing model. Instead, server licensing follows the Azure consumption model. If you work with the Microsoft account team, you might also be able to obtain Microsoft Defender for Endpoint Server licenses. These are not consumption-based, so they do not require an Azure subscription and are usually part of enterprise agreements.