services / Azure / Defender for Cloud pricing plans

Per-resource-type pricing settings that enable or disable Microsoft Defender for Cloud plans (Defender for Servers, Storage, Containers, Key Vault, etc.) at a scope, controlling whether workload threat protection is active.

These settings are the master on/off switch for Defender workload threat protection across the subscription; toggling them off blinds detection for entire resource classes.

Microsoft.​Security/​pricings/​action

Applies a batch of pricing settings at once, letting an attacker disable multiple Defender plans in a single call to broadly turn off workload protection.

Risks

1. Defense destruction (EVASION)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links