Editja

Use the data ingestion benefit in Microsoft Defender for Cloud

When you enable Defender for Servers Plan 2 in Microsoft Defender for Cloud, you receive 500 MB of free data ingestion per node daily.

  • The total daily data allowance granted equals the number of machines × 500 MB.
  • The daily data allowance is calculated across all machines in a subscription, not enforced per machine.
  • You aren’t charged for ingestion as long as the total data ingested across all machines in the subscription remains within the daily allowance, even if individual machines ingest more than 500 MB.
  • The benefit is applied at the Log Analytics workspace level.
  • The benefit doesn't appear on your invoice because it has zero cost. You can see it in the product UI and in Microsoft Cost Management exports. Learn how to view your data allocation benefits.

How the data ingestion benefit is applied

The 500 MB/day data ingestion benefit applies when:

  • Defender for Servers Plan 2 is enabled on the Log Analytics workspace that your machines report to. The allowance is calculated daily and applies only while Plan 2 is active.
  • Eligible security data is ingested into that workspace through Azure Monitor Agent (AMA), the Microsoft Defender for Endpoint sensor, or agentless file integrity monitoring (FIM). Agentless FIM events are reported to the MDCFileIntegrityMonitoringEvents table.

No separate configuration is required. The benefit is applied automatically to eligible tables.

Note

The benefit is applied based on the workspace billing model:

  • Microsoft Sentinel classic meters: Applies to Log Analytics ingestion only.
  • Microsoft Sentinel simplified (unified) meters: Applies to Microsoft Sentinel ingestion.

Supported data types

The benefit supports the following security data types. For the full category list, see Tables in the Security category.

Note

Although WindowsEvent is listed, only security events from the Microsoft-SecurityEvent stream that go to the SecurityEvent table qualify for the 500 MB/day allowance. Application, System, or other event log channels aren't covered and are billed as regular ingestion.

Configure a workspace

Follow Azure Monitor instructions to create a Log Analytics workspace.

Enable Defender for Servers Plan 2

To get the 500 MB/day data ingestion benefit, enable Defender for Servers Plan 2 on the Log Analytics workspace.

  1. Sign into the Azure portal.

  2. Go to Microsoft Defender for Cloud.

  3. Select Environment settings.

  4. Select the Log Analytics workspace that you want to configure.

  5. Turn on Defender for Servers Plan 2, and then select Save.

    Screenshot that shows the plan enablement page at the Log Analytics workspace level.

Note

To disable Defender for Servers Plan 2, turn it off on each Log Analytics workspace where it's enabled.

Related content

  • Last updated on