Microsoft announced the Defender Workload Unit (DWU) as an upcoming billing and management experience for Microsoft Defender for Cloud. The model converts workload-specific usage into a common unit so teams can estimate and track supported cloud-security consumption in one place.
This is a budget-planning change, not a promise of lower bills. Microsoft says billing remains usage based, while several workload pricing models and the place admins manage plans are changing. The October 20 announcement gives no rollout date or universal DWU price.
Which Defender for Cloud pricing models change
| Workload | Current model described by Microsoft | DWU model described by Microsoft | What to check |
|---|---|---|---|
| Containers | vCore-based pricing | Per-node pricing | Node count, cluster growth, and how each protected node maps to usage. |
| APIs | Multiple plans | One consolidated plan at a reduced price | Which API plans are enabled today and whether the consolidated plan fits their usage. |
| Database protection | Multiple instance-per-hour plans | One instance-per-hour plan | Protected database instances, tiers, and expected hours of coverage. |
| Other supported usage | Workload-specific measures and plans | Usage is translated into the shared unit behind the scenes | Servers, storage, posture management, AI and app services, Key Vault, and Azure Resource Manager usage in scope. |
Microsoft says the new model uses a consistent global per-unit price, calculates usage hourly, and bills monthly. Estimation, reporting, and billing share the DWU framework. The announcement does not publish a single price that can be applied across all customers; actual cost depends on resource type and volume, commercial agreement, and applicable discounts.
Plan scope is a decision, not a passive dashboard change
The new experience changes how customers estimate, enable, and manage selected Defender for Cloud plans. Microsoft says tenant-level enablement applies to Azure subscriptions and management groups connected to the Defender portal, and admins can also enable plans for an individual connected management group or subscription. If a subscription is opted in, its workloads move together.
Microsoft also says the new container and API pricing models are available only through the DWU experience in the Defender portal, rather than the existing Azure pay-as-you-go experience. That makes the comparison a commercial and operational choice: include every workload that would move together, then confirm the current portal shows the expected plan and scope before approving the change.
A practical cost review before adoption
- Inventory what is protected. Export or document the Defender for Cloud plans, subscriptions, management groups, clusters, APIs, databases, and other resources in scope.
- Estimate with the published tool. Use Microsoft's signed-in Cloud Security Cost Estimator and record the quantities, assumptions, and pricing arrangement behind the result.
- Compare like for like. Put the DWU estimate beside current Azure Cost Management spend for the same resources and time window. Separate workload changes from the billing-model change.
- Check the move boundary. Confirm whether the decision applies to a subscription, management group, or tenant scope; include all workloads that move together and assign an owner for each.
- Set monitoring before expansion. After any change, reconcile Defender portal reporting with Azure Cost Management and set budget alerts for the subscriptions involved.
- Document the decision. Capture the expected protection scope, estimate, exclusions, approver, and review date so a later increase in usage is explainable.
Initial DWU support is focused on Azure. Microsoft says multicloud and hybrid coverage is planned over time, and Security Copilot is not included. Do not assume one DWU estimate covers every cloud or security product your team owns.
Keep the optional trial separate from a paid rollout
Microsoft's announcement also describes an optional 30-day platform trial for eligible subscriptions that are new to Cloud Security. The trial is subscription-level and covers the platform's plans. Microsoft says billing begins when the trial ends unless all cloud security plans are disabled before expiration.
Frequently asked questions
Is the Defender Workload Unit billing model available now? Microsoft describes DWU as an upcoming Defender for Cloud improvement and does not provide a rollout date in the announcement. Check the Defender portal and cost estimator for current availability.
Does DWU guarantee lower security costs? No. Microsoft says billing remains tied to usage, and actual cost depends on workload mix, usage, pricing arrangement, and discounts. The announcement gives no universal unit price or savings guarantee.
Which workload pricing models change? The announcement says containers move from vCore-based to per-node pricing, APIs consolidate to one reduced-price plan, and database protection moves to one instance-per-hour plan.
Does DWU cover multicloud and Security Copilot? Initial support focuses on Azure; broader multicloud and hybrid coverage is planned. Microsoft says DWU does not cover Security Copilot.
What should I know about the optional trial? Eligible subscriptions that are new to Cloud Security can start an optional 30-day subscription-level trial. Billing begins after it ends unless all cloud security plans are disabled before expiration.
Need a clearer cloud security cost baseline?
Build an inventory, compare current and proposed Defender for Cloud pricing, and set budget and approval guardrails before changing plan scope.
Plan a Security Cost Review