Cloud Security Billing, Simplified: Introducing the Defender Workload Unit

That's the thinking behind an upcoming improvement to Microsoft Defender for Cloud: the Defender Workload Unit, or DWU. It's a new billing model and product experience that translates workload-specific usage into a common billing unit, with one unit price and one place to estimate and track costs.

Why we’re improving our billing model

We heard two things consistently: cloud security pricing can be complex, and tracking cost can take real work. DWU simplifies this with one unit price. Workload usage still converts behind the scenes. What changes is that organizations see a single unit and have one place to estimate, track, and explain cloud security spend.

How DWU helps:

• Simplify pricing. Bring multiple workload-specific measures under one common billing model.
• Simplify onboarding and expansion. Make it easier to enable and extend protection across cloud environments.
• Match how you evaluate cloud security. Understand protection across your entire cloud environment, rather than workload by workload.
• Reduce cost-tracking friction. Make costs easier to estimate, track, and explain.

One thing we deliberately kept unchanged: billing stays tied to what is used.

How it compares

DWU translates workload-specific usage into a common billing unit with a consistent per-unit price. Each workload continues to convert into DWUs according to its applicable usage measure. Workloads still count behind the scenes, including servers, databases, storage, containers, posture management, APIs, AI services, app services, Key Vault, and Azure Resource Manager. What changes are what customers see: one unit and one price.

Workload-specific usage is converted into DWUs and aggregated across your environment, based on a consistent global per-unit price calculated hourly and billed monthly. Estimation, reporting, and billing use the same DWU framework, making it easier to understand how usage translates into cost.

What changes is how customers estimate, buy, manage, and track consumption. DWU brings together changes to the billing model, supporting tools, and management experience. Here is how the new experience compares with the existing model.

 

The benefits of DWU

DWU is designed to make Defender for Cloud consumption easier to estimate and track by translating supported workload usage into a common billing unit. Actual consumption and cost will depend on your workload mix, usage, pricing arrangement, and applicable discounts. We are committing to pricing that's easier to understand and manage.

Clearer cost planning. As your estate grows, you can watch how costs scale.

Transparency you can show your finance team. The new cost estimator requires you to sign in and shows the pricing formula and how your estimate is calculated.

The same ways to buy. DWU is available through Enterprise Agreement, Microsoft Customer Agreement Enterprise, Cloud Solution Provider, and buy-online channels.

Streamlined onboarding. Enable selected Defender for Cloud plans across subscriptions and management scopes through a unified experience.

Easier expansion. Extend protection as your cloud environment grows without introducing a new customer-facing pricing construct for every workload.

More holistic visibility. Understand protection and consumption across your cloud environment, rather than workload by workload.

What's new to help you

A cost estimator. Enter resource quantities to receive an immediate list-price estimate.

A path from estimate to deployment. The experience follows a simple flow: estimate, deploy, and track.

Move directly from your estimate to deployment, then monitor cost through the Defender portal.

A dashboard that answers the next question. See total spend, which workloads drive it, and how it trends over time.

New pricing models for some workloads. Containers move from vCore-based pricing to per-node. APIs consolidate multiple plans into one with a reduced plan. Database workload protection is consolidated from multiple instance-per-hour plans into one.

What stays in your control

Simpler doesn't mean less flexible. Choose which workload plans to enable and change them at any time. In the product, tenant-level enablement applies to Azure subscriptions and management groups connected to the Defender portal. You can also enable plans for an individual connected management group or subscription. When you opt into a subscription, its workloads move together.

Where to start

A 30-day platform trial. Eligible subscriptions that are new to Cloud Security can start a Defender for Cloud trial in the Defender portal. The trial is optional, is granted at the subscription level, and is limited to one trial per subscription. It covers the full platform, including all plans, rather than one capability at a time.

 After the trial ends, billing begins for the subscription, unless all cloud security plans are disabled before the trial expires.

Two questions worth bringing to your next planning review:

1. How clearly can we estimate and explain Defender for Cloud consumption across supported workloads? If we cannot do so clearly, that's the gap DWU can close.
2. When did we last compare our intended protection scope with our current cloud-resource inventory? The read-only discovery script can tell you, with nothing leaving your environment.

One common unit and a more consistent way to estimate and track consumption can make it easier to understand and explain what you’re protecting.

Learn more and get started

• Calculate your DWU estimates with the new Cloud Security Cost Estimator.
• Learn more about DWU and start onboarding.

FAQ

• Does DWU cover multicloud environments? Initial support is focused on Azure, with broader multicloud and hybrid support planned over time.
• Does DWU cover Security Copilot? No, DWU does not offer coverage for Security Copilot.
• Can I use the new container and API models through the existing PAYG experience in Azure? No, they are available only through the DWU experience in the Defender portal.