Defender for Cloud's free CSPM tier becomes opt-in for new Azure subscriptions

What did Microsoft announce?

In the Defender for Cloud release notes, in an entry dated 30 July 2026, Microsoft says that from 27 October 2026 Foundational CSPM will no longer be enabled by default on new Azure subscriptions. Existing subscriptions keep it. AWS and Google Cloud connectors are not affected. The tier remains free. We read the release notes on 27 September 2026; this briefing covers that entry.

What is Foundational CSPM?

It is the free posture layer of Defender for Cloud: configuration checks and recommendations for cloud resources. The paid Defender CSPM plan adds attack path analysis, the cloud security explorer, agentless VM and secrets scanning, agentless Kubernetes discovery, code-to-cloud mapping, AI-SPM, DSPM and external attack surface management. Paid plans bill per resource, with pricing on the Azure pricing page and calculator and a free first 30 days.

Who does the change affect?

Teams that rely on Foundational CSPM being switched on automatically as new Azure subscriptions appear. After 27 October, a new subscription created without an explicit step will have no posture coverage from Defender for Cloud. Nothing alerts anyone, because there is nothing running to raise an alert.

It does not affect teams that already enable Defender plans through policy at the management group level, as long as that policy covers new subscriptions, or teams using another platform for posture.

Why does a coverage site care?

Because the change is a coverage gap created by a default, not by a product limit. The pattern repeats across every platform: coverage that depends on someone remembering a step decays as the estate grows. Lesson 9 covers how to make connection part of creating any new environment.

Does it change Defender for Cloud's score?

Not materially. Our path to first findings reason already notes the change, and Defender for Cloud scores 8.0 there. Its pricing score, 9.2, the highest in set, rests on a free tier, published per-resource pricing and a public calculator, and all three remain. It ranks 4 of 9 at 7.86.

What should Azure teams do before 27 October?

1. List how new subscriptions are created today: portal, templates, a landing-zone pipeline.
2. Add an explicit step, or a policy at the management group level, that enables Foundational CSPM, or the paid plans you use, on every new subscription.
3. Add a monthly check that compares subscriptions in billing with subscriptions reporting to Defender for Cloud.
4. If you also run AWS or Google Cloud, confirm the connectors are in place; Microsoft says they are not affected.

What should teams on other platforms take from it?

Ask your vendor the same question: if a new account, subscription or project appears tomorrow, is it covered without anyone doing anything? If the answer depends on an organization-level connection, check it is in place for every cloud you run.