Question

A financial services company runs 400 Windows and Linux VMs across Azure and on-premises (Arc-enabled). The compliance team requires the following capabilities on all servers: file integrity monitoring (FIM) for regulatory audits, integrated vulnerability management from Microsoft Defender Vulnerability Management, and the ability to license Microsoft Defender for Endpoint (MDE) on each server. Cost must be controlled — they do not want to pay for capabilities they will not use. Which Defender for Servers configuration should the architect specify?

Accepted Answer

Enable Defender for Servers Plan 2, which includes MDE integration, file integrity monitoring, and Defender Vulnerability Management.

Answer

Enable Defender for Servers Plan 1, which provides MDE integration and covers FIM and integrated vulnerability management.

Answer

Enable Defender CSPM only, since it delivers agentless vulnerability scanning and FIM at the lowest cost.

Answer

Enable Defender for Servers Plan 1 on Azure VMs and rely on Azure Policy machine configuration to provide FIM on the Arc-enabled servers.