Foundational CSPM vs Defender CSPM
Verdict: Foundational CSPM is free and on by default, giving secure score and the Microsoft cloud security benchmark. Defender CSPM is the paid plan that adds attack path analysis, cloud security explorer, and regulatory compliance assessment.
| Criterion | Foundational CSPM | Defender CSPM |
|---|---|---|
| Cost | Free, enabled by default on onboarded subscriptions | Paid plan you enable explicitly |
| Secure score | Included | Included |
| Cloud security benchmark | Included | Included |
| Attack path analysis | Not included | Included |
| Cloud security explorer | Not included | Included |
| Regulatory compliance assessment | Not included | Included |
Rules
- Foundational CSPM is free and enabled by default for all onboarded subscriptions and accounts.
- Secure score and the Microsoft cloud security benchmark assessment are both available in free Foundational CSPM.
- Regulatory compliance assessment is listed only under the paid Defender CSPM plan, so enable it to verify against compliance standards.
Traps
- Attack path analysis, cloud security explorer, and regulatory compliance are paid Defender CSPM features, not part of the free plan.
- Defender for Servers is a workload protection plan, not a CSPM posture plan - do not confuse the two.