@@ -2,9 +2,10 @@ title: Plan a Defender for Servers deployment description: Design a solution to protect on-premises and multicloud servers with Microsoft Defender for Servers. ms.topic: concept-article-ms.date: 03/05/2025+ms.date: 08/07/2026 #customer intent: As a cloud solution architect, I want to plan a Defender for Servers deployment so that I can protect on-premises and multicloud servers. ai-usage: ai-assisted+ms.custom: msecd-doc-authoring-1015 ---  # Plan Defender for Servers deployment@@ -44,7 +45,7 @@ The following table summarizes Defender for Servers deployment steps. | **Connect AWS/GCP machines** | To protect AWS and GCP machines with Defender for Servers, [connect AWS accounts](quickstart-onboard-aws.md) and [GCP projects](quickstart-onboard-gcp.md) to Defender for Cloud.<br/><br/> You can enable Defender for Cloud plans, including Defender for Servers, as part of the connection process.<br/><br/> To take full advantage of Defender for Servers features, we recommend onboarding AWS and GCP machines as Azure Arc VMs. Installation of the Azure Arc agent is available as part of the connection process. | AWS and GCP machines are successfully onboarded to Defender for Cloud. | | **Connect on-premises machines** | To protect on-premises machines, we recommend [onboarding on-premises machines as Azure Arc VMs](quickstart-onboard-machines.md).<br/><br/> You can [directly onboard on-premises machines to Defender for Cloud](onboard-machines-with-defender-for-endpoint.md). However, with direct onboarding you won't have full access to Defender for Servers Plan 2 features. | On-premises machines are successfully onboarded to Defender for Cloud | | **Enable Defender for Servers** | [Deploy a Defender for Servers plan](tutorial-enable-servers-plan.md). | Defender for Cloud starts protecting supported machines within the deployment scope. |-| **Take advantage of free data ingestion** | To take advantage of 500 MB of free daily ingestion for specific data types, machines must be running the Azure Monitor Agent (AMA), and be connected to a Log Analytics workspace. [Learn more](data-ingestion-benefit.md).<br/><br/> The benefit is granted for the supported data types on the Log Analytics workspace to which machines report. | Free daily ingestion is configured for supported data types. |+| **Take advantage of free data ingestion** | To take advantage of 500 MB of free daily ingestion per node for eligible security data, enable Defender for Servers Plan 2 on the Log Analytics workspace to which the machines report. Data must be collected through a supported method, such as Azure Monitor Agent (AMA). Creating a data collection rule alone doesn't enable the benefit. For more information, see [Defender for Servers data ingestion benefit](data-ingestion-benefit.md). | Free daily ingestion is configured for supported data types. | | **Prepare for OS assessment** | For Defender for Servers Plan 2 to [assess operation system configuration settings](operating-system-misconfiguration.md) against compute security baselines in Microsoft Cloud Security Benchmark, machines must be running the Azure Policy machine configuration extension. [Learn more](security-baseline-guest-configuration.md) about setting up the extension. | Defender for Servers Plan 2 collects OS configuration information for assessment. | | **Set up file integrity monitoring** | After enabling Defender for Servers Plan 2, you [set up file integrity monitoring after enabling the plan](file-integrity-monitoring-overview.md).<br/><br/> You need a Log Analytics workspace for file integrity monitoring. You can use an existing workspace, or create a new workspace when you configure the feature. | Defender for Servers monitors critical file changes. |