Forum Discussion

DaithiG's avatar
DaithiG
Steel Contributor
Jul 06, 2026

Sentinel - Defender for Cloud P2 Benefit

Hi all, To receive the the benefit of the Sentinel / Defender for Cloud P2 500mb benefit is the following correct:   Enabled Defender for Cloud P2 on the server or via Azure Arc (these are mainly ...
data collection
Log Data
Jamony's avatar
Jamony
MCT
Jul 06, 2026

Hi, the key point is that the 500 MB/day benefit comes from Defender for Servers Plan 2 being enabled on the Log Analytics workspace, with AMA on the machines, and only eligible security data counts. A DCR alone is not enough. Microsoft’s current doc also notes the benefit is calculated across machines and may apply differently depending on Sentinel billing model.

  • DaithiG's avatar
    DaithiG
    Steel Contributor
    Jul 06, 2026

    Thanks. Yes, DCR isn't enough, it's enabling Defender for Cloud P2 on the Sentinel LOg Analystics workspace that I was missing. Thanks