Microsoft Defender · FinOps Profile

Microsoft Defender Finops

FOCUS-aligned FinOps for Microsoft Defender — hybrid model. User-licensed Defender products (Endpoint, Identity, Office 365, Cloud Apps) bill per user per month and roll up through M365 commerce. Defender for Cloud (Servers, Storage, Databases, Containers, CSPM) bills per Azure resource per hour and rolls up through Azure Cost Management with FOCUS-aligned exports. Optimization centers on right-sizing seat coverage, scoping Defender for Cloud plans per subscription, and avoiding double-coverage on E5 customers.

Microsoft Defender Finops is the FinOps profile for Microsoft Defender on the APIs.io network, aligned with the FinOps Foundation Framework.

It defines 9 billable meters, billed in USD (settlement varies), on a monthly cycle, and pricing category subscription (per seat) + pay-as-you-go (per resource).

The profile maps 9 FOCUS columns for cost-allocation reporting.

Tagged areas include Security, XDR, Cloud Security, Endpoint, and Microsoft.

Category: Security / XDR Pricing: Subscription (per Seat) + Pay-As-You-Go (per Resource) Billing: Monthly FOCUS v1.3
SecurityXDRCloud SecurityEndpointMicrosoftFinOpsFOCUS

Framework Alignment

Framework
FinOps Foundation Framework
Data Spec
FOCUS v1.3

Charge Categories

UsagePurchaseTaxAdjustmentCredit

FOCUS Columns

BillingCurrency
USD
ChargeCategory
Usage
InvoiceIssuerName
Microsoft Corporation
PricingCategory
Hybrid (Subscription + Usage)
PricingUnit
varies (user-month, server-hour, resource-month)
ProviderName
Microsoft Corporation
PublisherName
Microsoft Corporation
ServiceCategory
Security
ServiceName
Microsoft Defender

Meters

defender_endpoint_seats
Unit: user-month
Defender for Endpoint Plan 1/2 user seats.
defender_office_seats
Unit: user-month
Defender for Office 365 Plan 1/2 user seats.
defender_identity_seats
Unit: user-month
Defender for Identity user seats.
defender_servers_hours
Unit: server-hour
Defender for Servers Plan 1/2 server-hour consumption.
defender_storage_accounts
Unit: account-month
Defender for Storage protected accounts.
defender_storage_transactions
Unit: 1000-transactions
Storage operations metered by Defender for Storage.
defender_databases_vcore_hours
Unit: vcore-hour
Defender for SQL / Cosmos DB protection.
defender_containers_vcore_hours
Unit: vcore-hour
Defender for Containers per-vCore-hour.
defender_cspm_resources
Unit: resource-month
Resources covered by Defender CSPM (Plan 2).

Sources