@artgola.
You are correct that when you enable Microsoft Defender for Servers at the Azure subscription level, the billing information is rolled up at the subscription level. However, if you need to see the cost for the Defender for Servers Plan for a particular Virtual Machine resource or resource group, you can use a workaround to estimate the cost distribution.
To get an estimation of the cost per VM, you can follow these steps:
1- Export the Azure Cost Management data: Navigate to the Azure Cost Management and Billing section in the Azure Portal. Select the "Cost analysis" option under "Cost Management." Set the desired date range, and group the data by "Resource." Then, click on "Export" to download the data in a format of your choice, such as CSV.
2- Calculate the usage: Open the exported data and identify the usage for the Defender for Servers Plan by filtering the data based on the 'Meter' or 'Meter Category' column. Calculate the total usage for Defender for Servers Plan across all VMs in the subscription.
3- Calculate the cost per VM: Divide the total cost for Defender for Servers by the total usage to find the cost per unit. Then, multiply this cost per unit by the usage for each individual VM to estimate the cost for the Defender for Servers Plan for each VM.
4- Group the costs by resource group: To view the cost distribution at the resource group level, you can aggregate the estimated costs for all the VMs within a resource group.
Please note that this method provides an estimation and may not be completely accurate. To get more granular cost data, you can provide feedback to Microsoft to request support for itemizing costs at the VM level in future updates of Azure Cost Management and Billing.