Forum Discussion

Sinisa_Zupanic's avatar
Sinisa_Zupanic
Copper Contributor
Aug 28, 2023

Microsoft Defender for Server Plan2 is automatic turned on!

Hi Community,

on a completely new subscription I create windows server 2022 VM and after a few days I noticed that the MDE.windows extension was installed and Plan2 is turned on for subscription. I checked the policies and Activity log but I couldn't find anything. 

Thanks in advance.
 
 
  • Hi Sinisa,
    I'm unsure if you found out yet. If you want to know when and how was MDC -servers enabled, you may use this link:
    https://learn.microsoft.com/en-us/azure/defender-for-cloud/faq-general#how-can-i-track-who-in-my-organization-enabled-a-microsoft-defender-plan-in-defender-for-cloud-

    In general, any Azure activity will be logged for 90 days. So, if this happened within the last 90 days, you might still find out who and how via Azure Activity logs.

    Then, the MDE integration is enabled by default with the enhanced features.
    From the screenshot you shared, make sure that the scope for Policy is at the MG level, and not only at the subscription level. It could be that it is at a higher level.
  • Sinisa_Zupanic Hi, you can turn of the servers' option on the subscription from your environment settings in MDC as below and then turn on MDC for each server aside 

     

    also, you can change the plan from plan 2 to plan 1 if you don't want to use the advanced features. 

    Please click Mark as Best Response & Like if my post helped you to solve your issue. This will help others to find the correct solution easily.

    • Sinisa_Zupanic's avatar
      Sinisa_Zupanic
      Copper Contributor
      Thank you for your reply. I know I can turn it off, but do you have any idea why it turned on automatically?
      • eliekarkafy's avatar
        eliekarkafy
        MVP
        do you have auto managed profile applied on your servers? if it was on before it will automatically affect every server you add to your environment in your subscription

Resources