Microsoft Defender XDR
GeneralUnderstanding Defender Experts coverage for servers and cloud workloads
In brief
The FAQ now states that Plan 2 does not cover Microsoft Defender for Cloud workloads. It extends expert coverage to supported third-party, including multicloud, sources ingested through Microsoft Sentinel; the page metadata was also refreshed.
What Defender admins need to know
Administrators should use this clarification when assessing workload coverage. No action is required.
Summaries are generated from the documentation change itself.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
Understanding Defender Experts coverage for servers and cloud workloads
|Can I configure which servers the Defender Experts will cover? | This service covers all your servers in your tenant that have Defender for Servers protection enabled in Defender for Cloud. |
|Do the Defender Experts investigate all Defender for Servers alerts? | The Defender for Servers plan in Defender for Cloud covers multicloud servers, such as Microsoft Azure, Amazon Web Services, and Google Cloud Platform, provided the Microsoft Defender for Endpoint is installed on the servers. All Defender for Servers P1 and P2 alerts (Detection Source = Microsoft Defender for Servers) are in scope except for DNS alerts due to limited data available for investigation. |
|I only have Microsoft Defender Endpoint. How can I get server coverage? | If you have servers that have Defender for Endpoint deployed on them with a Microsoft Defender for Endpoint for Server license, you can get the server coverage through the Defender Experts MDR service. The service doesn't cover Microsoft Defender for Cloud workloads. Learn more
If you want coverage for servers in Defender for Cloud, you need to avail the Microsoft Defender Experts for Servers or Defender Experts Hunting - Servers. |
|Does Defender Experts MDR Plan 2 cover my Microsoft Defender for Cloud workloads? | No. Plan 2 extends expert coverage to supported third-party sources, including multicloud sources, that you ingest through Microsoft Sentinel. That telemetry coverage is separate from Microsoft Defender for Cloud workload protection, and neither Defender Experts MDR plan covers Defender for Cloud workloads such as storage, containers, and databases. For expert coverage of servers protected by Defender for Cloud, use Microsoft Defender Experts for Servers or Defender Experts Hunting - Servers. Learn more about the Defender Experts MDR plans |
See also
@@ -13,7 +13,9 @@ ms.topic: faq ms.custom: - cx-ti - cx-dex-ms.date: 05/18/2026+- msecd-doc-authoring-1018+ms.date: 07/27/2026+ai-usage: ai-assisted --- # Understanding Defender Experts coverage for servers and cloud workloads@@ -29,6 +31,7 @@ The following section lists down questions you or your SOC team might have regar |**Can I configure which servers the Defender Experts will cover?** | This service covers **all** your servers in your tenant that have [Defender for Servers](/azure/defender-for-cloud/defender-for-servers-overview) protection enabled in Defender for Cloud. | |**Do the Defender Experts investigate all Defender for Servers alerts?** | The Defender for Servers plan in Defender for Cloud covers multicloud servers, such as Microsoft Azure, Amazon Web Services, and Google Cloud Platform, provided the Microsoft Defender for Endpoint is installed on the servers. All Defender for Servers P1 and P2 alerts (Detection Source = Microsoft Defender for Servers) are in scope except for [DNS alerts](/azure/defender-for-cloud/alerts-dns) due to limited data available for investigation. | |**I only have Microsoft Defender Endpoint. How can I get server coverage?** | If you have servers that have Defender for Endpoint deployed on them with a Microsoft Defender for Endpoint for Server license, you can get the server coverage through the Defender Experts MDR service. The service doesn't cover Microsoft Defender for Cloud workloads. [Learn more](defender-experts-mdr-prerequisites.md#product-configuration-and-service-coverage)<br><br>If you want coverage for servers in Defender for Cloud, you need to avail the Microsoft Defender Experts for Servers or Defender Experts Hunting - Servers. |+|**Does Defender Experts MDR Plan 2 cover my Microsoft Defender for Cloud workloads?** | No. Plan 2 extends expert coverage to supported third-party sources, including multicloud sources, that you ingest through Microsoft Sentinel. That telemetry coverage is separate from Microsoft Defender for Cloud workload protection, and neither Defender Experts MDR plan covers Defender for Cloud workloads such as storage, containers, and databases. For expert coverage of servers protected by Defender for Cloud, use Microsoft Defender Experts for Servers or Defender Experts Hunting - Servers. [Learn more about the Defender Experts MDR plans](defender-experts-mdr-overview.md) | ### See also