Microsoft has introduced public-preview management of Defender for Cloud plans in the Microsoft Defender portal. This is more than a UI change: subscriptions moved to the new model use Defender Workload Unit (DWU) billing, while the corresponding plan configuration becomes read-only in the Azure portal.
Architecture summary
- Status: public preview as of October 20, 2026.
- Availability: Azure commercial environments; AWS, GCP, and unsupported Azure environments remain managed in the Azure portal.
- Access: customers with at least one paid Defender for Cloud plan.
- Financial impact: subscriptions moved to the new model are measured and billed through DWUs.
What the new experience provides
- Connect Azure subscriptions and management groups.
- Apply plans globally or to selected management groups and subscriptions.
- Include current and future environments in global configuration.
- Estimate DWU consumption and track cloud-security cost.
- Bring posture, exposure, vulnerabilities, incidents, and response into one portal.
Why cloud architects should care
Defender governance can no longer be documented only as per-subscription settings in the Azure portal. In the new model, cloud scopes, Unified RBAC, and global configurations can segment visibility and management by business unit, region, or workload.
The second consequence is financial. A portal migration can also be a metering migration. Architecture, security, and FinOps teams should agree on a coverage, consumption, and cost baseline before moving production subscriptions.
Risks to assess
- Dual operating model: capabilities remain split between the Defender and Azure portals during the transition.
- RBAC: cloud scopes are not Azure RBAC; test positive and negative access using real SOC personas.
- Cost: compare projected DWU usage with historical plan and server spending.
- Infrastructure as code: validate Bicep, Terraform, Azure Policy, and subscription-vending processes against the active configuration authority.
- Preview risk: avoid moving all production environments without a pilot and documented support path.
Recommended adoption plan
- Select a representative nonproduction subscription.
- Export the current plan, extension, and exclusion configuration.
- Record coverage and monthly cost as a baseline.
- Design cloud scopes and least-privilege roles for SecOps, platform, and FinOps.
- Connect the environment in the Defender portal and allow up to 24 hours for data to appear.
- Compare recommendations, inventory, alerts, coverage, and estimated DWU usage.
- Validate IaC pipelines and Policy controls before expanding scope.
Related change: expanded server onboarding
The same release expands onboarding guidance for Azure virtual machines and on-premises servers. It supports Azure VMs, Azure Arc-enabled servers, and on-premises servers through Arc or direct onboarding. Servers already running Defender for Endpoint do not need reinstallation to keep their existing protection.
Conclusion
The unified portal can simplify security operations, but it also introduces decisions about configuration authority, segmentation, and cost. Treat it as an operating-model and financial change—not merely a portal migration.
For more on governance and automation, read our guide to the Microsoft AZ-401 Agentic DevOps certification.