Resource-level billing change for Defender for Servers Customers


Who does this change applies to:

This update is relevant for users with for Servers activated on their Workspaces (with agent installed) or those utilizing the AWS Connector with for Servers enabled.

What's new: 

Effective Friday, April 26th, only when for Servers is enabled for the resources' subscription or the subscription hosting a Connector for AWS resources: 

  • Direct Billing to Resources: We're changing how we report your billing. Instead of using a general workspace ID, your bills will now be directly linked to each compute resource ID. This means each Virtual Machine (), Virtual Machine Scale Set (VMSS), Azure Arc-enabled server and EC2 Instance will have its own billing entry. 
  • More Detailed Billing: Customers will no longer receive one large bill for all workspace resources. Starting March 11, customers will see individual costs for each of the above resources. This granular view will provide a clearer picture of what subscriptions your costs are allocated to.
  • AWS Specifics: For those using AWS resources, the subscription hosting the AWS Connector will be billed for the resources used. 

Why This Matters: 

We're aiming to make your billing experience more transparent and accurate. By linking costs directly to each resource, you'll have a better understanding of your expenses, allowing for more effective resource management. Get ready for a clearer, more detailed view of your billing! 

Note: This update does not affect the amount you are being charged for using Defender for Servers. It only changes the way we report your billing and, in some cases, the source of payment (if the workspace was under a different subscription). You will still pay the same rate per hour for each D4Server resource as before. 


There are two subscriptions, S1 and S2. Each subscription has different resources associated with it:

Subscription S1 includes two VM1 and VM2.

Subscription S2 includes a Workspace (W1), which itself includes VM1 as part of its resources.

The payment method for these subscriptions is set up as follows:

Subscription S1 charges are billed to credit card 123.

Subscription S2 charges are billed to credit card 456.

Additionally, Defender for Servers plan is activated for Subscription S1 and for Workspace W1 within S2.

Billing before the change:

Subscription S1 (with card 123) is billed for VM2 only, at $15.

Workspace W1 under Subscription S2 (with card 456) is billed for a single unit (VM1 is not mentioned), at $15.

This setup suggests that VM1's costs are being attributed to S2 (or more specifically, W1 within S2), even though it is also a part of S1.

Billing after the change:

Subscription S1 (with card 123) is billed for both VM1 and VM2, at $15 each (total of $30).

Action Required – No

You don't need to take any action for this billing change.


This article was originally published by Microsoft's Defender for Cloud Blog. You can find the original article here.