I disable Microsoft Defender For Cloud but am still being charged for it.

Hello DJ Neill

Thank you for posting your query on Microsoft Q&A platform.In most cases, that daily charge comes from a specific Defender plan still being enabled in most commonly Microsoft Defender for App Service (it bills per App Service compute instance at roughly $0.02 per hour, which is ~$0.48/day). Turning off Defender “in general” doesn’t always flip every plan or stop auto‑provisioning/policies that can re‑enable protections.

Free is okay: Foundational CSPM is free and can stay on. Only the paid plans (Defender CSPM, Servers, App Service, Storage, Databases, etc.) generate cost.

References: https://learn.microsoft.com/en-us/azure/defender-for-cloud/concept-cloud-security-posture-management

To stop charges:

1. Turn OFF paid plans at the subscription level in Azure Portal → Microsoft Defender for Cloud → Environment settings → your subscription → Defender plans. Toggle Off for any paid plans you see (e.g., Defender for App Service, Servers, Storage, Databases, Defender CSPM). Reference: https://learn.microsoft.com/en-us/azure/defender-for-cloud/tutorial-enable-cspm-plan
2. Disable Auto‑provisioning (this is what re‑deploys agents/extensions) In Environment settings → Auto‑provisioning, turn off items like Defender for Endpoint, Azure Monitor Agent, legacy Log Analytics agent.
3. Check Azure Policy assignments in Azure Portal → Policy → Assignments. If you see policies like Deploy Microsoft Defender for Endpoint or Deploy Azure Monitor Agent, disable/remove them so the extensions don’t come back.
4. Verify the meter that’s billing you in Azure Portal → Cost Management + Billing → Cost analysis. Filter by Service/Meter to confirm if the charge is Defender for App Service or Defender CSPM. If you still see Defender meters after steps 1–3, there’s likely a plan enabled at resource/plan level.
5. Double‑check at App Service plan level Open each App Service plan → Microsoft Defender for Cloud pane and ensure Defender for App Service is Off. Reference: https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-app-service-introduction
6. If you delete anything created only for Defender (e.g., a dedicated Log Analytics workspace), do it only if nothing else uses it. Some environments share that workspace.

Free ways to learn without billing:

• Microsoft Learn “Sandbox” many modules have Activate sandbox, which gives you a free, temporary subscription for the lab.
• Run Learn exercises in your own subscription carefully: create a dedicated resource group, clean up after each lab, and keep paid Defender plans off.

Hope the provided information helps. If you have any other questions or need further support, please feel free to contact us.

Thanks,

Suchitra.

If you have disabled Microsoft Defender for Cloud but are still being charged, it is important to ensure that you have completely turned off all related services. Microsoft Defender for Cloud has different pricing tiers, and while there is a free tier, certain features, like malware scanning in Defender for Storage, are charged from the first day of usage and are not included in the free trial.

To avoid charges, make sure you have disabled Defender for Storage and any other related services that may incur costs. You can check your Azure subscription for any active services that might still be generating charges.

Additionally, if you are using the free tier for other Azure services, those services should not incur charges unless you exceed the free usage limits.

For learning purposes, Microsoft does offer free services, but it's crucial to monitor your usage and ensure that any paid features are disabled to avoid unexpected charges.