Forum Discussion
Sentinel - Defender for Cloud P2 Benefit
Hi all, To receive the the benefit of the Sentinel / Defender for Cloud P2 500mb benefit is the following correct: Enabled Defender for Cloud P2 on the server or via Azure Arc (these are mainly ...
Hi, the key point is that the 500 MB/day benefit comes from Defender for Servers Plan 2 being enabled on the Log Analytics workspace, with AMA on the machines, and only eligible security data counts. A DCR alone is not enough. Microsoft’s current doc also notes the benefit is calculated across machines and may apply differently depending on Sentinel billing model.
Thanks. Yes, DCR isn't enough, it's enabling Defender for Cloud P2 on the Sentinel LOg Analystics workspace that I was missing. Thanks