Daily Defender News
Aboutmerill.net
Microsoft Defender for Cloud
Cloud and workloads

Disable Microsoft Defender for Cloud Plans - Microsoft Defender for Cloud | Microsoft Learn

29 September 2026Doc update+27 / −28 lines

In brief

The page updates terminology and UI steps, adds instructions for disabling all four Defender for Databases subplans, and clarifies autoprovisioning, Azure Policy assignments, and resource-level plan settings.

What Defender admins need to know

Administrators should follow the revised navigation and control names. Review the listed settings to prevent agent reinstallation and continued charges.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Disable Microsoft Defender for Cloud plansPlans - Microsoft Defender for Cloud | Microsoft Learn

You can disable Microsoft Defender for Cloud plans on your connected environments to manage your security costs. When you disable a plan, the associated security features, recommendations, and alerts for that plan stop appearing in Defender for Cloud.

Each Defender for Cloud plan has a different pricing structure based on attached resources and enabled subplans. For more information, see the Defender for Cloud pricing page. You can also estimate costs by using the Defender for Cloud cost calculator.

Disable plans on the subscription level

  1. Sign in to the Azure portal.

  2. Go to Microsoft Defender for Cloud > Environment settings.

  3. Select the relevant Azure, Amazon Web Services (AWS),Azure subscription, AWS account, or Google Cloud Project (GCP) subscription.project.

    Screenshot of the Environment settings page in Defender for Cloud showing Azure, AWS, and GCP subscription entries.

Disable plans by multicloud environment

After selecting the subscription, select the tab for your multicloud environment (Azure,Azure, AWS, or GCP)GCP to continue.

Azure

  1. Find the plans you want to disable and toggle the switch toselect Off.

    Screenshot that shows all of the Defender for Cloud plans toggled to off in an Azure environment.

    1. (Optional) To disable the Defender for Databases plan, use the pop-upcontext menu to turn off all four Defender for Databases subplans.

      Screenshot that shows the four Defender for Databases subplans toggled to Off.

  2. Select Continue.

  3. Select Save.

AWS

  1. Find the plans you want to disable and toggle the switch toselect Off.

    Screenshot that shows the Defender for Cloud plans disabled in an Amazon environment.

  2. Select Next: Configure access.

    Screenshot that shows deployment options and instructions for configuring access.

  3. Follow the on-screen instructions for the selected deployment method to complete the required dependencies on AWS.

  4. Select the check boxcheckbox to confirm you followed the instructions.

  5. Select Next: Review and generate.

  6. Select Create.

GCP

  1. Find the plans you want to disable and toggle the switch toselect Off.

    Screenshot that shows the Defender for Cloud plans disabled in a Google environment.

  2. Select Next: Configure access.

  3. Follow the on-screen instructions for the selected deployment method to complete the required dependencies on Google Cloud.

    Screenshot that shows the GCP configure access page with Cloud Shell and Terraform deployment options.

  4. Select the check boxcheckbox to confirm you followed the instructions.

  5. Select Next: Review and generate.

  6. Select Create.

Note

To confirm that charges stop, check your billing meters in Cost Management + Billing.Billing.

Disable autoprovisioning

Autoprovisioning can silently reinstall agents or extensions after you turn off plans. To prevent reinstallation, disable autoprovisioning for Endpoint protection and Guest Configuration agentagents in Defender for Cloud settings.

  1. Sign in to the Azure portal.

  2. Go to Microsoft Defender for Cloud > Environment settings > relevant subscription or resource.resource.

  3. Select Settings for the relevant plans.

    Screenshot that shows an example of where the settings button is located on the plans page.

  4. ToggleSet Guest configuration agent to Off.

  5. ToggleSet Endpoint protection to Off.

  6. Select Continue.

  7. Select Save.

Disable Azure Policy assignments

As a security measure, Defender for Cloud includes Azure Policy initiatives that automatically redeploy Defender for Cloud components if you uninstall them. To prevent this automatic redeployment, identify and disable any relevant Azure Policy assignments.

  1. Sign in to the Azure portal.

Check resource-level settings

YouEven if you turn off the subscription-level plan, you can enable Microsoft Defender for Cloud for individual resources, even if you turn off the subscription-level plan.resources. To fully stop charges, check and disable Microsoft Defender for Cloud on each supported resource type.

To check and disable Defender for Cloud at the resource level:

The following resource types are the most common where Defender for Cloud stays enabled.

App Service

Azure App Service is the most common place where Defender for Cloud stays enabled accidentally. You pay for Defender for App Service per App Service plan. It can stay enabled even when the subscription plan is off.

  1. Sign in to the Azure portal.

  2. Open the App Service plan (not the individual app).

    Screenshot that shows the status displaying as Unknown.

  3. If Microsoft Defender for Servers displays On, go to Microsoft Defender for Cloud > Environment settings > relevant subscription or resource.

  4. ToggleSet Defender for Servers to Off.

  5. Select Save.

SQL / Databases

  1. Select Configure.

    Screenshot that shows where the Configure button is located on the SQL resource's Defender for Cloud page.

  2. ToggleSet Microsoft Defender for SQL to Off.

  3. Select Save.

Servers

At the resource level, you can enable or disable Defender for Servers plan 1. For plan 2, you can disable it for specific resources only when plan 2 remains enabled at the subscription level.

For example, you can enable Defender for Servers plan 2 at the subscription level and disable it for specific resources within the subscription. However, youYou can't enable plan 2 only on specific resources. If you're still being billed even after you disable the plan, use the Coverage workbook to see what resources remain covered.

  1. Sign in to the Azure portal.
  2. Search for and select Microsoft Defender for Cloud.
  3. Go to Environment settings.
  4. Select a relevant subscription or workspace.
  5. ToggleSet Defender for Servers plan 1 or plan 2 to Off.
  6. Select Save.
  7. Repeat for each relevant subscription or workspace.