Forum Discussion

DaithiG's avatar
DaithiG
Steel Contributor
Jul 06, 2026

Sentinel - Defender for Cloud P2 Benefit

Hi all,

To receive the the benefit of the Sentinel / Defender for Cloud P2 500mb benefit is the following correct:

 

Enabled Defender for Cloud P2 on the server or via Azure Arc (these are mainly on-prem servers.

Create a DCR rule to collect events and send to our Sentinel Workspace.

 

Enable Defender on the Sentinel workspace (not subscription)

 

Defender for Servers is far more work than it should be!

data collection
Log Data

2 Replies

  • Jamony's avatar
    Jamony
    MCT
    Jul 06, 2026

    Hi, the key point is that the 500 MB/day benefit comes from Defender for Servers Plan 2 being enabled on the Log Analytics workspace, with AMA on the machines, and only eligible security data counts. A DCR alone is not enough. Microsoft’s current doc also notes the benefit is calculated across machines and may apply differently depending on Sentinel billing model.

    • DaithiG's avatar
      DaithiG
      Steel Contributor
      Jul 06, 2026

      Thanks. Yes, DCR isn't enough, it's enabling Defender for Cloud P2 on the Sentinel LOg Analystics workspace that I was missing. Thanks