Microsoft Defender Pricings API

openapi: 3.2.0
info:
  title: Microsoft Defender for Cloud REST API (Microsoft.Security)…
  version: stable-composite
  description: Composite of the latest stable Microsoft.Security resource-manager swagger files published by Microsoft in Azure/azure-rest-api-specs. Each path keeps its own api-version via x-source.
  x-source-repo: https://github.com/Azure/azure-rest-api-specs/tree/main/specification/security/resource-manager/Microsoft.Security/Security
servers:
- url: https://management.azure.com
security:
- azure_auth:
  - user_impersonation
tags:
- name: Pricings
paths:
  /{scopeId}/providers/Microsoft.Security/pricings:
    get:
      operationId: Pricings_List
      tags:
      - Pricings
      description: 'Lists Microsoft Defender for Cloud pricing configurations of the scopeId, that match the optional given $filter. Valid scopes are: subscription id or a specific resource id (Supported resources are: ''VirtualMachines, VMSS and ARC Machines''). Valid $filter is: ''name in ({planName1},{planName2},...)''. If $filter is not provided, the unfiltered list will be returned. If ''$filter=name in (planName1,planName2)'' is provided, the returned list includes the pricings set for ''planName1'' and ''planName2'' only.'
      parameters:
      - $ref: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/common-types/resource-management/v5/types.json#/parameters/ApiVersionParameter
      - name: scopeId
        in: path
        description: The fully qualified Azure Resource manager identifier of the resource.
        required: true
        x-ms-skip-url-encoding: true
        schema:
          type: string
      - name: $filter
        in: query
        description: OData filter. Optional.
        required: false
        schema:
          type: string
      responses:
        '200':
          description: Azure operation completed successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PricingList'
        default:
          description: An unexpected error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Common.CloudError'
      x-ms-examples:
        Get pricings on resource:
          $ref: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/security/resource-manager/Microsoft.Security/Security/stable/2026-07-01/examples/Pricings/ListResourcePricings_example.json
        Get pricings on subscription:
          $ref: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/security/resource-manager/Microsoft.Security/Security/stable/2026-07-01/examples/Pricings/ListPricings_example.json
        Get pricings on subscription with plans filter:
          $ref: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/security/resource-manager/Microsoft.Security/Security/stable/2026-07-01/examples/Pricings/ListPricingsWithPlanFilter_example.json
      x-source: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/security/resource-manager/Microsoft.Security/Security/stable/2026-07-01/pricings.json
      summary: Pricings list
      x-summary-source: derived
  /{scopeId}/providers/Microsoft.Security/pricings/{pricingName}:
    get:
      operationId: Pricings_Get
      tags:
      - Pricings
      description: Get the Defender plans pricing configurations of the selected scope (valid scopes are resource id or a subscription id). At the resource level, supported resource types are 'VirtualMachines, VMSS and ARC Machines'.
      parameters:
      - $ref: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/common-types/resource-management/v5/types.json#/parameters/ApiVersionParameter
      - name: scopeId
        in: path
        description: The fully qualified Azure Resource manager identifier of the resource.
        required: true
        x-ms-skip-url-encoding: true
        schema:
          type: string
      - name: pricingName
        in: path
        description: name of the pricing configuration
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Azure operation completed successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Pricing'
        default:
          description: An unexpected error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Common.CloudError'
      x-ms-examples:
        Get pricings on resource - Containers plan:
          $ref: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/security/resource-manager/Microsoft.Security/Security/stable/2026-07-01/examples/Pricings/GetResourcePricingByNameContainers_example.json
        Get pricings on resource - VirtualMachines plan:
          $ref: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/security/resource-manager/Microsoft.Security/Security/stable/2026-07-01/examples/Pricings/GetResourcePricingByNameVirtualMachines_example.json
        Get pricings on subscription - CloudPosture plan:
          $ref: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/security/resource-manager/Microsoft.Security/Security/stable/2026-07-01/examples/Pricings/GetPricingByNameCloudPosture_example.json
        Get pricings on subscription - Containers plan:
          $ref: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/security/resource-manager/Microsoft.Security/Security/stable/2026-07-01/examples/Pricings/GetPricingByNameContainers_example.json
        Get pricings on subscription - Dns plan:
          $ref: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/security/resource-manager/Microsoft.Security/Security/stable/2026-07-01/examples/Pricings/GetPricingByNameDns_example.json
        Get pricings on subscription - Managed by M365 security rule:
          $ref: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/security/resource-manager/Microsoft.Security/Security/stable/2026-07-01/examples/Pricings/GetPricingByNameExternallyUpdated_example.json
        Get pricings on subscription - StorageAccounts plan:
          $ref: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/security/resource-manager/Microsoft.Security/Security/stable/2026-07-01/examples/Pricings/GetPricingByNameStorageAccounts_example.json
        Get pricings on subscription - VirtualMachines plan:
          $ref: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/security/resource-manager/Microsoft.Security/Security/stable/2026-07-01/examples/Pricings/GetPricingByNameVirtualMachines_example.json
      x-source: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/security/resource-manager/Microsoft.Security/Security/stable/2026-07-01/pricings.json
      summary: Pricings get
      x-summary-source: derived
    put:
      operationId: Pricings_Update
      tags:
      - Pricings
      description: 'Updates a provided Microsoft Defender for Cloud pricing configuration in the scope. Valid scopes are: subscription id or a specific resource id (Supported resources are: ''VirtualMachines, VMSS and ARC Machines'' and only for plan=''VirtualMachines'' and subPlan=''P1'').'
      parameters:
      - $ref: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/common-types/resource-management/v5/types.json#/parameters/ApiVersionParameter
      - name: scopeId
        in: path
        description: The fully qualified Azure Resource manager identifier of the resource.
        required: true
        x-ms-skip-url-encoding: true
        schema:
          type: string
      - name: pricingName
        in: path
        description: name of the pricing configuration
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Resource 'Pricing' update operation succeeded
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Pricing'
        '201':
          description: Resource 'Pricing' create operation succeeded
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Pricing'
        default:
          description: An unexpected error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Common.CloudError'
      x-ms-examples:
        Update pricing on resource (example for Containers plan):
          $ref: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/security/resource-manager/Microsoft.Security/Security/stable/2026-07-01/examples/Pricings/PutResourcePricingByNameContainers_example.json
        Update pricing on resource (example for VirtualMachines plan):
          $ref: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/security/resource-manager/Microsoft.Security/Security/stable/2026-07-01/examples/Pricings/PutResourcePricingByNameVirtualMachines_example.json
        Update pricing on subscription (example for CloudPosture plan):
          $ref: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/security/resource-manager/Microsoft.Security/Security/stable/2026-07-01/examples/Pricings/PutPricingByName_example.json
        Update pricing on subscription (example for CloudPosture plan) - partial success:
          $ref: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/security/resource-manager/Microsoft.Security/Security/stable/2026-07-01/examples/Pricings/PutPricingByNamePartialSuccess_example.json
        Update pricing on subscription (example for VirtualMachines plan):
          $ref: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/security/resource-manager/Microsoft.Security/Security/stable/2026-07-01/examples/Pricings/PutPricingVMsByName_example.json
      x-source: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/security/resource-manager/Microsoft.Security/Security/stable/2026-07-01/pricings.json
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Pricing'
        description: Pricing object
        required: true
      summary: Pricings update
      x-summary-source: derived
    delete:
      operationId: Pricings_Delete
      tags:
      - Pricings
      description: 'Deletes a provided Microsoft Defender for Cloud pricing configuration in a specific resource. Valid only for resource scope (Supported resources are: ''VirtualMachines, VMSS, ARC Machines, and Containers'').'
      parameters:
      - $ref: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/common-types/resource-management/v5/types.json#/parameters/ApiVersionParameter
      - name: scopeId
        in: path
        description: The fully qualified Azure Resource manager identifier of the resource.
        required: true
        x-ms-skip-url-encoding: true
        schema:
          type: string
      - name: pricingName
        in: path
        description: name of the pricing configuration
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Resource deleted successfully.
        '204':
          description: Resource does not exist.
        default:
          description: An unexpected error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Common.CloudError'
      x-ms-examples:
        Delete a pricing on resource:
          $ref: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/security/resource-manager/Microsoft.Security/Security/stable/2026-07-01/examples/Pricings/DeleteResourcePricing_example.json
        Delete a pricing on resource (example for Containers plan):
          $ref: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/security/resource-manager/Microsoft.Security/Security/stable/2026-07-01/examples/Pricings/DeleteResourcePricingByNameContainers_example.json
      x-source: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/security/resource-manager/Microsoft.Security/Security/stable/2026-07-01/pricings.json
      summary: Pricings delete
      x-summary-source: derived
components:
  schemas:
    Common.CloudError:
      type: object
      description: Common error response for all Azure Resource Manager APIs to return error details for failed operations. (This also follows the OData error response format.).
      properties:
        error:
          $ref: '#/components/schemas/Common.CloudErrorBody'
          description: The error object.
          x-ms-client-flatten: true
      x-ms-external: true
    originatedFrom:
      type: string
      description: Indicates the origin of the most recent pricing configuration change.
      enum:
      - M365
      x-ms-enum:
        name: originatedFrom
        modelAsString: true
        values:
        - name: M365
          value: M365
          description: Indicates that the configuration change originated from Microsoft 365.
    Enforce:
      type: string
      description: If set to "False", it allows the descendants of this scope to override the pricing configuration set on this scope (allows setting inherited="False"). If set to "True", it prevents overrides and forces this pricing configuration on all the descendants of this scope. This field is only available for subscription-level pricing.
      enum:
      - 'False'
      - 'True'
      x-ms-enum:
        name: Enforce
        modelAsString: true
        values:
        - name: 'False'
          value: 'False'
          description: Allows the descendants of this scope to override the pricing configuration set on this scope (allows setting inherited="False")
        - name: 'True'
          value: 'True'
          description: Prevents overrides and forces the current scope's pricing configuration to all descendants
    Common.CloudErrorBody:
      type: object
      description: The error detail.
      properties:
        code:
          type: string
          description: The error code.
          readOnly: true
        message:
          type: string
          description: The error message.
          readOnly: true
        target:
          type: string
          description: The error target.
          readOnly: true
        details:
          type: array
          description: The error details.
          items:
            $ref: '#/components/schemas/Common.CloudErrorBody'
          readOnly: true
          x-ms-identifiers: []
        additionalInfo:
          type: array
          description: The error additional info.
          items:
            $ref: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/common-types/resource-management/v5/types.json#/definitions/ErrorAdditionalInfo
          readOnly: true
          x-ms-identifiers: []
      x-ms-external: true
    PricingTier:
      type: string
      description: 'Indicates whether the Defender plan is enabled on the selected scope. Microsoft Defender for Cloud is provided in two pricing tiers: free and standard. The standard tier offers advanced security capabilities, while the free tier offers basic security features.'
      enum:
      - Free
      - Standard
      x-ms-enum:
        name: PricingTier
        modelAsString: true
        values:
        - name: Free
          value: Free
          description: Get free Microsoft Defender for Cloud experience with basic security features
        - name: Standard
          value: Standard
          description: Get the standard Microsoft Defender for Cloud experience with advanced security features
    Inherited:
      type: string
      description: '"inherited" = "True" indicates that the current scope inherits its pricing configuration from its parent. The ID of the parent scope that provides the inherited configuration is displayed in the "inheritedFrom" field. On the other hand, "inherited" = "False" indicates that the current scope has its own pricing configuration explicitly set, and does not inherit from its parent. This field is read only and available only for resource-level pricing.'
      enum:
      - 'True'
      - 'False'
      x-ms-enum:
        name: Inherited
        modelAsString: true
        values:
        - name: 'True'
          value: 'True'
          description: Indicates that the current scope is inheriting its pricing configuration from its parent
        - name: 'False'
          value: 'False'
          description: Indicates that the current scope sets its own pricing configuration and does not inherit it from its parent
    PricingList:
      type: object
      description: List of pricing configurations response.
      properties:
        value:
          type: array
          description: List of pricing configurations
          items:
            $ref: '#/components/schemas/Pricing'
      required:
      - value
    Common.OperationStatus:
      type: object
      description: A status describing the success/failure of the enablement/disablement operation.
      properties:
        code:
          type: string
          description: The operation status code.
        message:
          type: string
          description: Additional information regarding the success/failure of the operation.
    ResourcesCoverageStatus:
      type: string
      description: 'This field is available for subscription-level only, and reflects the coverage status of the resources under the subscription. Please note: The "pricingTier" field reflects the plan status of the subscription. However, since the plan status can also be defined at the resource level, there might be misalignment between the subscription''s plan status and the resource status. This field helps indicate the coverage status of the resources.'
      enum:
      - FullyCovered
      - PartiallyCovered
      - NotCovered
      x-ms-enum:
        name: ResourcesCoverageStatus
        modelAsString: true
        values:
        - name: FullyCovered
          value: FullyCovered
          description: This value indicates that all resources associated with the subscription have the Defender plan enabled.
        - name: PartiallyCovered
          value: PartiallyCovered
          description: This value indicates that some resources under the subscription have the Defender plan enabled, while others have it disabled. There is a mixed coverage status among resources.
        - name: NotCovered
          value: NotCovered
          description: This value indicates that the Defender plan is disabled for all resources under the subscription. None of the resources are protected by the Defender plan.
    PricingProperties:
      type: object
      description: Pricing properties for the relevant scope
      properties:
        pricingTier:
          $ref: '#/components/schemas/PricingTier'
          description: 'Indicates whether the Defender plan is enabled on the selected scope. Microsoft Defender for Cloud is provided in two pricing tiers: free and standard. The standard tier offers advanced security capabilities, while the free tier offers basic security features.'
        subPlan:
          type: string
          description: The sub-plan selected for a Standard pricing configuration, when more than one sub-plan is available. Each sub-plan enables a set of security features. When not specified, full plan is applied. For VirtualMachines plan, available sub plans are 'P1' & 'P2', where for resource level only 'P1' sub plan is supported.
        freeTrialRemainingTime:
          type: string
          format: duration
          description: The duration left for the subscriptions free trial period - in ISO 8601 format (e.g. P3Y6M4DT12H30M5S).
          readOnly: true
        enablementTime:
          type: string
          format: date-time
          description: Optional. If `pricingTier` is `Standard` then this property holds the date of the last time the `pricingTier` was set to `Standard`, when available (e.g 2023-03-01T12:42:42.1921106Z).
          readOnly: true
        enforce:
          $ref: '#/components/schemas/Enforce'
          description: If set to "False", it allows the descendants of this scope to override the pricing configuration set on this scope (allows setting inherited="False"). If set to "True", it prevents overrides and forces this pricing configuration on all the descendants of this scope. This field is only available for subscription-level pricing.
        inherited:
          $ref: '#/components/schemas/Inherited'
          description: '"inherited" = "True" indicates that the current scope inherits its pricing configuration from its parent. The ID of the parent scope that provides the inherited configuration is displayed in the "inheritedFrom" field. On the other hand, "inherited" = "False" indicates that the current scope has its own pricing configuration explicitly set, and does not inherit from its parent. This field is read only and available only for resource-level pricing.'
          readOnly: true
        inheritedFrom:
          type: string
          description: The id of the scope inherited from. "Null" if not inherited. This field is only available for resource-level pricing.
          readOnly: true
        resourcesCoverageStatus:
          $ref: '#/components/schemas/ResourcesCoverageStatus'
          description: 'This field is available for subscription-level only, and reflects the coverage status of the resources under the subscription. Please note: The "pricingTier" field reflects the plan status of the subscription. However, since the plan status can also be defined at the resource level, there might be misalignment between the subscription''s plan status and the resource status. This field helps indicate the coverage status of the resources.'
          readOnly: true
        extensions:
          type: array
          description: Optional. List of extensions offered under a plan.
          items:
            $ref: '#/components/schemas/Extension'
          x-ms-identifiers: []
        deprecated:
          type: boolean
          description: Optional. True if the plan is deprecated. If there are replacing plans they will appear in `replacedBy` property
          readOnly: true
        replacedBy:
          type: array
          description: Optional. List of plans that replace this plan. This property exists only if this plan is deprecated.
          items:
            type: string
          readOnly: true
        securityOperatorResourceId:
          type: string
          description: Resource ID of the security operator associated with the pricing configuration.
        originatedFrom:
          $ref: '#/components/schemas/originatedFrom'
          description: Indicates the origin of the most recent configuration change.
          readOnly: true
        managedBy:
          type: string
          description: Indicates who exclusively manages the pricing configuration.
          readOnly: true
      required:
      - pricingTier
    IsEnabled:
      type: string
      description: Indicates whether the extension is enabled.
      enum:
      - 'True'
      - 'False'
      x-ms-enum:
        name: IsEnabled
        modelAsString: true
        values:
        - name: 'True'
          value: 'True'
          description: Indicates the extension is enabled
        - name: 'False'
          value: 'False'
          description: Indicates the extension is disabled
    Extension:
      type: object
      description: A plan's extension properties
      properties:
        name:
          type: string
          description: 'The extension name. Supported values are: <br><br>**AgentlessDiscoveryForKubernetes** - Provides zero footprint, API-based discovery of Kubernetes clusters, their configurations and deployments. The collected data is used to create a contextualized security graph for Kubernetes clusters, provide risk hunting capabilities, and visualize risks and threats to  Kubernetes environments and workloads.<br>Available for CloudPosture plan and Containers plan.<br><br>**OnUploadMalwareScanning** - Limits the GB to be scanned per month for each storage account within the subscription. Once this limit reached on a given storage account, Blobs won''t be scanned during current calendar month.<br>Available for StorageAccounts plan (DefenderForStorageV2 sub plans).<br><br>**SensitiveDataDiscovery** - Sensitive data discovery identifies Blob storage container with sensitive data such as credentials, credit cards, and more, to help prioritize and investigate security events.<br>Available for StorageAccounts plan (DefenderForStorageV2 sub plan) and CloudPosture plan.<br><br>**ContainerRegistriesVulnerabilityAssessments** - Provides vulnerability management for images stored in your container registries.<br>Available for CloudPosture plan and Containers plan.<br><br>**MdeDesignatedSubscription** - Direct onboarding is a seamless integration between Defender for Endpoint and Defender for Cloud that doesn''t require extra software deployment on your servers. The onboarded resources will be presented under a designated Azure Subscription you configure<br>Available for VirtualMachines plan (P1 and P2 sub plans).<br><br>**AgentlessVmScanning** - Scans your machines for installed software, vulnerabilities, malware and secret scanning without relying on agents or impacting machine performance. Learn more here https://learn.microsoft.com/en-us/azure/defender-for-cloud/concept-agentless-data-collection.<br>Available for CloudPosture plan, VirtualMachines plan (P2 sub plan) and Containers plan.<br><br>**EntraPermissionsManagement** - Permissions Management provides Cloud Infrastructure Entitlement Management (CIEM) capabilities that helps organizations to manage and control user access and entitlements in their cloud infrastructure - important attack vector for cloud environments.<br>Permissions Management analyzes all permissions and active usage, and suggests recommendations to reduce permissions to enforce the principle of least privilege. Learn more here https://learn.microsoft.com/en-us/azure/defender-for-cloud/permissions-management.<br>Available for CloudPosture plan. <br><br>**FileIntegrityMonitoring** - File integrity monitoring (FIM), examines operating system files.<br>Windows registries, Linux system files, in real time, for changes that might indicate an attack.<br>Available for VirtualMachines plan (P2 sub plan). <br><br>**ContainerSensor** - The sensor is based on IG and provides a rich threat detection suite for Kubernetes clusters, nodes, and workloads, powered by Microsoft leading threat intelligence, provides mapping to MITRE ATT&CK framework.<br>Available for Containers plan. <br><br>**AIPromptEvidence** - Exposes the prompts passed between the user and the AI model as alert evidence. This helps classify and triage the alerts with relevant user context. The prompt snippets will include only segments of the user prompt or model response that were deemed suspicious and relevant for security classifications. The prompt evidence will be available through Defender portal as part of each alert.<br>Available for AI plan. <br><br>'
        isEnabled:
          $ref: '#/components/schemas/IsEnabled'
          description: Indicates whether the extension is enabled.
        additionalExtensionProperties:
          type: object
          description: Property values associated with the extension.
          additionalProperties: {}
        operationStatus:
          $ref: '#/components/schemas/Common.OperationStatus'
          description: Optional. A status describing the success/failure of the extension's enablement/disablement operation.
          readOnly: true
        securityOperatorResourceId:
          type: string
          description: Resource ID of the security operator associated with the extension.
      required:
      - name
      - isEnabled
    Pricing:
      type: object
      description: 'Microsoft Defender for Cloud is provided in two pricing tiers: free and standard. The standard tier offers advanced security capabilities, while the free tier offers basic security features.'
      properties:
        properties:
          $ref: '#/components/schemas/PricingProperties'
          description: Pricing data
          x-ms-client-flatten: true
      allOf:
      - $ref: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/common-types/resource-management/v5/types.json#/definitions/ProxyResource
  securitySchemes:
    azure_auth:
      type: oauth2
      flows:
        implicit:
          scopes:
            user_impersonation: impersonate your user account
          authorizationUrl: https://login.microsoftonline.com/common/oauth2/authorize
      description: Azure Active Directory OAuth2 Flow.