# Defender For Servers > Guidance for Microsoft Defender for Servers (Plan 1 and Plan 2) — server-specific protection in Microsoft Defender for Cloud. Covers plan selection, agentless vs agent-based scanning, MDE for Servers integration, file integrity monitoring (FIM via MDE), just-in-time VM access, vulnerability assessment, adaptive application controls, network hardening, and free data ingestion to Sentinel/Log Analytics. Applies to Azure VMs, Azure Arc-enabled servers (on-prem, AWS EC2, GCP Compute), and Azure VMSS. WHEN: Defender for Servers, MDE for Servers, server EDR, FIM, file integrity monitoring, JIT VM access, just-in-time access, agentless scanning servers, vulnerability assessment for VMs, hybrid server protection, Arc-enabled servers security, AWS EC2 in Defender for Cloud, GCP Compute in Defender for Cloud, server hardening Azure, Plan 1 vs Plan 2 servers. DO NOT USE for endpoint client devices (use defender-for-endpoint), generic Azure resource posture (use defender-for-cloud-hardening), or container hosts (use defe - Skill: `vinayaklatthe/defender-for-servers` (Agent Skill) - Install (CLI): `npx skillmds@latest add vinayaklatthe/defender-for-servers` - Raw SKILL.md: https://api.skillmd.com/api/skills/vinayaklatthe/defender-for-servers/raw - Safety review: pending - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: DevOps & Infra - License: MIT - Author: vinayaklatthe (https://skillmd.com/u/vinayaklatthe) - Updated: 2026-09-17 - Page: https://skillmd.com/skills/vinayaklatthe/defender-for-servers --- # Microsoft Defender for Servers Defender for Servers is the server-focused plan inside Microsoft Defender for Cloud. It extends **Microsoft Defender for Endpoint (MDE)** to Azure VMs, Azure Arc-enabled machines (on-prem, AWS EC2, GCP Compute), and VM Scale Sets, and adds server-specific controls: just-in-time VM access, file integrity monitoring, agentless disk scanning, and vulnerability assessment. ## When to use Designing or hardening protection for **server workloads** — IaaS VMs, hybrid/multicloud servers via Arc, jump hosts, domain controllers, line-of-business servers. Use this skill for plan selection, MDE-for-Servers onboarding, FIM, JIT, and agentless vs agent-based scanning trade-offs. **Do not use this skill** for client endpoints (`defender-for-endpoint`), AKS/container hosts (`defender-for-containers`), Azure storage accounts (`defender-for-storage`), or generic Defender for Cloud posture (`defender-for-cloud-hardening`). ## Pick the plan | If you need... | Plan | |---|---| | Free foundational CSPM only (no server EDR) | **Defender CSPM** (no server plan) | | MDE Plan 2 EDR, threat detection, free 500 MB/day Log Analytics ingestion | **Defender for Servers Plan 1** (per-server) | | Everything in P1 plus FIM, JIT, agentless scanning, vuln assessment, adaptive app controls, network hardening, regulatory compliance, 500 MB free ingestion | **Defender for Servers Plan 2** | > **Rule of thumb:** Plan 1 = "I just need EDR everywhere." Plan 2 = "I need EDR + posture + > compliance + FIM." Most enterprises pick **P2 for production, P1 for dev/test**. ## Onboarding paths | Estate | Path | |---|---| | Azure VMs | Enable plan at subscription scope; auto-provisioning deploys MDE + Azure Monitor Agent | | On-prem / VMware servers | **Azure Arc** onboarding, then enable plan | | AWS EC2 / GCP Compute | Connect AWS account / GCP project to Defender for Cloud; auto-provisioning via Arc | | VMSS (uniform) | Plan applies; agentless scan covers ephemeral instances | ## Approach 1. **Inventory and connect first.** Onboard non-Azure servers via Arc before enabling the plan; otherwise you pay per-server but get no coverage on hybrid estate. *Verify: Defender for Cloud → Inventory shows all expected resources with a Defender plan column = Plan 1/2.* 2. **Enable Plan 2 at subscription scope** (not resource group) so new VMs inherit automatically. Use Azure Policy *Configure Microsoft Defender for Servers to be enabled* at the management group for multi-sub estates. 3. **Turn on auto-provisioning of MDE integration.** This pushes the MDE sensor via the unified solution; do **not** also onboard servers directly through Intune or local script — it causes telemetry duplication and double billing. *Verify: a sample VM appears in security.microsoft.com → Device inventory within 1 hour.* 4. **Enable agentless disk scanning.** Reads VM disk snapshots to find malware, secrets, and vulnerabilities without any agent — runs once per 24h, no performance impact. *Verify: Recommendations → "Machines should have a vulnerability assessment solution" green for VMs without MDE Vulnerability Management agent.* 5. **Configure JIT VM access** for any VM with management ports (RDP 3389, SSH 22, WinRM 5985/5986). Default to 3-hour max request, source IP = requestor only. *Verify: NSGs show JIT-managed deny rules for the protected ports; access requests show in activity log.* 6. **File Integrity Monitoring** via MDE (the Log Analytics-based FIM is being retired). Enable on tier-0 servers (DCs, PKI, jump hosts) first. Tune the rule set — default includes Windows system files; add your app's config paths. *Verify: FIM events appear in MDE advanced hunting `DeviceFileEvents` with ActionType = FileCreated/Modified on the monitored paths.* 7. **Adaptive application controls** (Plan 2). Run in audit for 14 days to learn the app baseline per VM group, then enforce. Skip on highly dynamic workloads (CI build agents). 8. **Free 500 MB/day Log Analytics ingestion.** Stream the security event set to a workspace you can query from Sentinel — but keep the volume budget in mind; high-volume DCs blow past 500 MB easily. 9. **Review the regulatory compliance dashboard** (PCI, ISO 27001, NIST 800-53, CIS) monthly and turn failed controls into Azure Policy assignments. ## Guardrails - **Onboard hybrid via Arc, not local MDE script.** Direct MDE onboarding bypasses Defender for Cloud billing/posture and you lose JIT, FIM, agentless scan. - **Do not enable both Plan 1 and Plan 2 in the same scope.** P2 supersedes P1; configure at the highest scope and let inheritance work. - **JIT changes NSG rules, not Azure Firewall / NVA rules.** If management traffic flows through a firewall, JIT alone won't protect — add firewall policy. - **Agentless scan is point-in-time.** It catches drift every 24h, not real-time. Keep MDE on for runtime detection. - **FIM via MDE is the supported path.** The legacy Log Analytics-agent FIM is deprecated — do not architect new deployments around it. - **Do not run two AV engines active.** If a third-party AV is primary, set Defender to passive + EDR in block mode (see `defender-for-endpoint`). ## Common anti-patterns - **"We turned on Plan 1 everywhere to save money" then asked for FIM/JIT** — those are P2 features. Move prod to P2. - **"MDE onboarded directly through GPO on Arc servers"** — bypasses DfC, loses billing integration, double-onboarded. Always via DfC auto-provisioning. - **"JIT request window = 24 hours, any source IP"** — defeats the point. Cap at 3h, source IP locked. - **"FIM enabled on every file path on every server"** — alert fatigue. Tier-0 systems + app-specific config paths only. - **"Adaptive application controls enforce on day one"** — blocks legitimate admin tooling. 14 days audit, then enforce. - **"Skipped agentless scan because we already run MDE Vulnerability Management"** — they're complementary; agentless catches unmanaged disks and stopped VMs. ## Example prompts - `Plan Defender for Servers P1 vs P2 for a 2,000-VM estate split 70/30 prod/dev.` - `Onboard 500 on-prem Windows Servers via Arc and enable P2.` - `Roll out JIT VM access to all production Linux jump hosts with a 2-hour max window.` - `Configure FIM via MDE on tier-0 domain controllers — which paths and registry keys?` - `Stream Defender for Servers events into Sentinel using the 500 MB free allowance — what do we ingest?` - `Connect an AWS account with 300 EC2 instances and enable Defender for Servers P2.` - `Tune adaptive application controls for a fleet of IIS web servers.` ## Microsoft Learn - Overview: https://learn.microsoft.com/azure/defender-for-cloud/defender-for-servers-introduction - Plan features: https://learn.microsoft.com/azure/defender-for-cloud/plan-defender-for-servers-select-plan - MDE integration: https://learn.microsoft.com/azure/defender-for-cloud/integration-defender-for-endpoint - Just-in-time VM access: https://learn.microsoft.com/azure/defender-for-cloud/just-in-time-access-overview - File Integrity Monitoring: https://learn.microsoft.com/azure/defender-for-cloud/file-integrity-monitoring-overview - Agentless scanning for machines: https://learn.microsoft.com/azure/defender-for-cloud/concept-agentless-data-collection - Adaptive application controls: https://learn.microsoft.com/azure/defender-for-cloud/adaptive-application-controls - Connect AWS / GCP: https://learn.microsoft.com/azure/defender-for-cloud/multicloud - Azure Arc onboarding: https://learn.microsoft.com/azure/azure-arc/servers/overview