Forum Discussion
Sinisa_Zupanic
Aug 28, 2023Copper Contributor
Microsoft Defender for Server Plan2 is automatic turned on!
Hi Community,
on a completely new subscription I create windows server 2022 VM and after a few days I noticed that the MDE.windows extension was installed and Plan2 is turned on for subscription. I checked the policies and Activity log but I couldn't find anything.
Thanks in advance.
- CruzAz
Microsoft
Hi Sinisa,
I'm unsure if you found out yet. If you want to know when and how was MDC -servers enabled, you may use this link:
https://learn.microsoft.com/en-us/azure/defender-for-cloud/faq-general#how-can-i-track-who-in-my-organization-enabled-a-microsoft-defender-plan-in-defender-for-cloud-
In general, any Azure activity will be logged for 90 days. So, if this happened within the last 90 days, you might still find out who and how via Azure Activity logs.
Then, the MDE integration is enabled by default with the enhanced features.
From the screenshot you shared, make sure that the scope for Policy is at the MG level, and not only at the subscription level. It could be that it is at a higher level. Sinisa_Zupanic Hi, you can turn of the servers' option on the subscription from your environment settings in MDC as below and then turn on MDC for each server aside
also, you can change the plan from plan 2 to plan 1 if you don't want to use the advanced features.
Please click Mark as Best Response & Like if my post helped you to solve your issue. This will help others to find the correct solution easily.
- Sinisa_ZupanicCopper ContributorThank you for your reply. I know I can turn it off, but do you have any idea why it turned on automatically?
- do you have auto managed profile applied on your servers? if it was on before it will automatically affect every server you add to your environment in your subscription