Microsoft Announce Defender Workload Units
Microsoft Defender for Cloud: A New Era of Simpler Billing and Security Management
Microsoft is introducing Defender Workload Units and a unified management experience. But beyond simplifying billing, could this be a meaningful step toward making cloud security more accessible, predictable, and manageable?
Microsoft has revealed major changes to Microsoft Defender for Cloud, including a new billing model and changes to how organisations configure, manage, and monitor cloud security protection.
Announced on 20 October 2026, the changes introduce Defender Workload Units (DWUs) and bring cloud security plan management into the Microsoft Defender portal.
While billing changes might not sound particularly exciting at first, these developments tackle longstanding challenges around cost predictability, operational complexity, and security governance.
Introducing Defender Workload Units
Historically, Defender for Cloud pricing has relied on different consumption models depending on the workload being protected.
Servers, databases, storage accounts, containers and other resources have each introduced their own pricing considerations. For organisations operating at scale, this can make forecasting and explaining security expenditure unnecessarily complicated.
DWUs aim to simplify this.
Instead of multiple workload-specific billing metrics, Microsoft is introducing a common consumption unit with a consistent price.
Importantly, this doesn’t mean every workload costs the same. Microsoft converts underlying resource consumption into DWUs using workload-specific calculations, then aggregates and bills usage monthly.
Microsoft is also introducing cost estimation and reporting capabilities to help organisations understand their spend before and after enabling protection.
What’s Changing Beyond Billing?
Alongside DWUs, Microsoft is changing how Defender for Cloud plans are managed through the unified Microsoft Defender portal.
Organisations can configure protection at the tenant, management group, or subscription level, with inheritance supporting consistent deployment across connected Azure environments.
This introduces several notable changes:
- Centralised management: Cloud security plans can be configured through the Defender portal rather than managed individually via Azure.
- Simplified workload pricing: Containers move towards per-node billing, while database and API plans are consolidated.
- Steady protection: Supported resources within an enabled subscription automatically inherit protection, including newly deployed resources.
- Improved cost visibility: A common reporting experience helps organisations understand consumption and expenditure.
However, there are important considerations.
Existing resource-level configurations are not preserved when migrating to the new management experience. Some capabilities, including Defender for DNS, require particular attention, while certain Defender CSPM capabilities become included by default without an opt-out.
Once migrated, plan configuration becomes read-only in the Azure portal.
The experience is also currently in preview and initially focuses on Azure commercial environments, with wider multicloud and hybrid support planned.
What Should Organisations Consider?
Although the changes offer opportunities to simplify administration, organisations should approach migration as more than a billing exercise.
Organisations should review existing configurations, protection requirements, and cost assumptions before adopting the new model.
In particular, organisations should assess whether subscription-wide protection changes their existing security coverage or expenditure.
A simpler pricing model doesn’t automatically mean lower costs, and centralised management shouldn’t come at the expense of deliberate governance.
The 30-day trial for eligible subscriptions offers an opportunity to evaluate the experience, but organisations should understand the eligibility requirements and when billing begins.
Security Shouldn’t Be Difficult to Consume
For me, the most encouraging aspect of this announcement isn’t necessarily the introduction of another consumption unit. It’s the direction Microsoft appears to be taking.
Security should enable cloud adoption, not create administrative or financial obstacles.
For years, organisations have been recommended to adopt security by design, yet understanding the commercial implications of enabling security controls has sometimes required considerable effort.
Simplifying consumption, consolidating management and improving cost transparency can help security teams have more meaningful conversations with finance, procurement and business stakeholders.
There is also an opportunity to shift the conversation from “How much will this security feature cost?” towards “Are we protecting the right workloads, and can we demonstrate the value of that protection?”
That distinction matters.
As cloud environments grow increasingly complex, security platforms need to become easier to operate without sacrificing control, visibility or accountability.
Microsoft’s latest direction is a positive step towards that objective. The real measure of success will be whether organisations experience the promised simplicity in practice, particularly as the model expands beyond Azure.
Ultimately, making security easier to understand makes it easier to justify, adopt and sustain.
Sources and further reading
- Introducing the Defender Workload Unit , Microsoft Tech Community, 20 October 2026.
- Manage cloud security plans in the Defender portal, Microsoft Learn.
- What changes when managing cloud security plans, Microsoft Learn.