Microsoft Defender for Servers should be enabled

What does the recommendation "Microsoft Defender for Servers should be enabled" check?

Flags any subscription where the Defender for Servers plan is set to 'Off' in Microsoft Defender for Cloud, so your Windows and Linux virtual machines have no server-tier threat detection. The check is about whether the plan (Plan 1 or Plan 2) is switched on for the subscription, not whether every individual machine is healthy or whether the underlying Defender for Endpoint agent has actually reported in. It does not cover Defender plans for other resource types such as Storage, Key Vault, App Service or containers, each of which is billed and enabled separately.

Why does "Microsoft Defender for Servers should be enabled" matter?

Without Defender for Servers your VMs run blind: no endpoint detection and response from the Defender for Endpoint integration, no behavioural alerting on a compromised host, and on Plan 2 no agentless vulnerability assessment, file integrity monitoring or secrets scanning. An attacker who lands on an unmonitored server through a stolen credential or an exposed RDP or SSH port can move laterally for days before anyone notices, because the signals that would have raised an alert are simply never collected. The business consequence is a longer dwell time, a wider blast radius and an incident you reconstruct from fragments after the fact rather than catch in progress. For most compliance frameworks, server-tier threat detection is also an expected control, so an off plan is both a real security gap and an audit finding waiting to be raised.

How do I fix "Microsoft Defender for Servers should be enabled"?

1. Decide between Plan 1 and Plan 2 before enabling: Plan 1 gives you the core endpoint detection and response from Defender for Endpoint, while Plan 2 adds agentless scanning, vulnerability assessment, file integrity monitoring, malware and secrets scanning. Most regulated estates want Plan 2.
2. Turn the plan on per subscription in Microsoft Defender for Cloud under Environment settings, or with the CLI: 'az security pricing create -n VirtualMachines --tier standard --subplan P2'. Note that Plan 2 cannot be scoped to individual machines, it applies subscription-wide.
3. Make it the default for new subscriptions rather than a manual step: enforce the plan through Azure Policy at the management-group level so any subscription that lands underneath inherits Defender for Servers automatically, without anyone remembering to switch it on, and review the per-machine status afterwards so you catch any VM that is not yet reporting.

# Enable the three high-value Defender plans on the current subscription.
# Servers on Plan 2 (adds JIT access, FIM and vulnerability scanning).
az security pricing create --name VirtualMachines \
  --tier Standard --subplan P2

# Storage on the current per-account plan.
az security pricing create --name StorageAccounts --tier Standard

# Azure SQL Database servers (VA + Advanced Threat Protection).
az security pricing create --name SqlServers --tier Standard

# Verify what is now active on this subscription.
az security pricing list \
  --query "value[?pricingTier=='Standard'].name" -o tsv

# Ratchet it shut for the estate: assign the built-in DeployIfNotExists
# policies that turn each plan on for any subscription where it is missing.
# Servers (built-in 'Configure Azure Defender for servers to be enabled').
az policy assignment create \
  --name enable-defender-servers \
  --policy 8e86a5b6-b9bd-49d1-8e21-4bb8a0862222 \
  --scope "/providers/Microsoft.Management/managementGroups/contoso-root"

# Look up the matching Storage and SQL policies by display name rather than
# hard-coding a GUID, then assign each the same way at the same scope.
az policy definition list \
  --query "[?contains(displayName, 'Configure Microsoft Defender for Storage') || contains(displayName, 'Configure Azure Defender to be enabled on SQL servers')].{name:name, displayName:displayName}" \
  -o table