What is IT AMC in the USA and why do businesses need it?

IT AMC (Annual Maintenance Contract) in the USA is a comprehensive service agreement for maintaining all IT equipment and systems. Businesses need IT AMC for predictable costs, 24/7 support, preventive maintenance, reduced downtime, and expert technical assistance. It's the most affordable way to ensure reliable IT operations.

How much does IT AMC cost in the USA?

IT AMC pricing in the United States is scoped per engagement and depends on the number of devices, support level, and services included. Small businesses with basic coverage sit at the entry level, and comprehensive packages scale with the size of your estate. We offer the best affordable IT AMC solutions in United States with customized pricing.

What is included in managed IT services in the USA?

Our managed IT services in the USA include complete IT infrastructure management, 24/7 monitoring and support, cybersecurity, cloud services, backup and disaster recovery, help desk support, network management, and proactive maintenance. It's a complete IT department solution with affordable monthly pricing.

What is the response time for IT support in the USA?

GR IT Services responds to P1 critical issues in 5 minutes for managed clients, delivered remotely. We offer 24/7 reliable IT support to businesses across the USA with a guaranteed SLA.

Which areas in the USA does GR IT Services cover?

We provide IT support and managed IT services across all major USA cities including New York, Los Angeles, Chicago, Houston, Phoenix, Philadelphia, San Antonio, San Diego, Dallas, and San Jose. We serve businesses nationwide with complete IT support.

Why is GR IT Services the best IT company in the USA?

GR IT Services combines reliable 24/7 support, a 5-minute P1 response SLA, complete IT solutions, and certified Microsoft CSP and Apple Jamf partner status. We provide IT AMC and managed IT services across the USA with a guaranteed SLA and senior engineers on every engagement.

Microsoft Defender for Servers for US businesses

A large share of Plan 2 only works once your servers are onboarded to Azure Arc. Skip that work and the license still bills you for capabilities the estate cannot reach.

What Plan 1 gives you is endpoint detection and response on servers, wherever they happen to run. Plan 2 layers on agentless scanning for vulnerabilities, malware and secrets, plus file integrity monitoring, just-in-time access and baseline assessment. Read the documentation closely and several of those carry a footnote: applicable only to machines onboarded through Azure Arc. That footnote is the whole project. Arc is not an implementation detail, it is the prerequisite.

Book a server protection review See what each plan includes

Microsoft Defender for Servers for US organizations

Two plansPlan 1 EDR, Plan 2 adds twelve capabilities
Azure, AWS, GCPPlus on-premises Windows and Linux
AgentlessMost Plan 2 scanning needs no agent
30 day trialCannot be stopped, paused or extended

What it does

Seven factors that settle which plan fits, and what you will genuinely get from it.

The vendor description is three-part: it lowers risk and exposure on your machines, it tells you what to fix and how, and it defends those machines against live attack. Which plan you actually need falls out of the shape of your estate and how it is connected, and never out of a feature comparison read on its own.

Windows and Linux, across three clouds and on-premises

Coverage runs to Windows and Linux across Azure, Amazon Web Services, Google Cloud Platform and whatever is still sitting in your own building. American businesses rarely arrive at a tidy estate on purpose. An Azure migration, an acquisition that came with an AWS footprint, and a data center nobody ever got round to shutting down is the normal picture, and that one line about multicloud coverage is usually why the product lands on the evaluation list.

Plan 1 is endpoint detection and response, delivered automatically

The core of Plan 1 is the Defender for Endpoint integration and the detection and response it brings: automatic onboarding, alerts and incidents flowing into one place, software inventory discovered rather than declared, regulatory compliance assessment, and agent-based vulnerability scanning. If your servers are currently running conventional antivirus, that alone is a significant step up.

The agentless shift in Plan 2 rewrote how this gets deployed

Three agentless scanners sit in Plan 2, covering vulnerabilities, malware and secrets held on the machine. Alongside that, Microsoft has moved most plan features off the Log Analytics agent and the Azure Monitor Agent entirely, handing the work to agentless scanning and the Defender for Endpoint integration. If you remember this product as an agent deployment exercise, that memory is out of date.

Just-in-time access, file integrity monitoring and baselines

Three further capabilities arrive with Plan 2: just-in-time access to virtual machines on Azure and AWS, file integrity monitoring, and an assessment of operating system configuration against the compute security baselines published in the Microsoft Cloud Security Benchmark. Together they move the product across the line from detecting threats to managing posture, and between them they answer more audit findings than anything else in the plan.

Azure Arc is a dependency, not a nice to have

Read the feature table carefully, because it says this out loud. Operating system updates and baseline misconfiguration assessment apply only where a machine came in through Azure Arc. File integrity monitoring reaches AWS and GCP machines only when those machines were onboarded with Arc. For anything on-premises, the documentation is blunt: direct onboarding leaves you without full access to Plan 2.

Defender Experts for Servers, if you have no analysts

This is managed extended detection and response for server workloads. Microsoft analysts do the triage, run the investigation, contain what needs containing, and hand back with steps written out. Scope is every Plan 1 and Plan 2 alert whose detection source is Defender for Servers, on Windows and Linux, across Azure, AWS, GCP and on-premises. Two things to know before you plan around it: it carries its own price, and DNS alerts fall outside it.

A thirty day trial that cannot be paused

Turning a plan on begins a thirty day trial, and Microsoft is clear that it cannot be stopped, paused or extended once started. The advice to plan the evaluation in advance is not boilerplate. Somebody flipping it on during a slow week to take a look has just spent the clock, and a trial that opens a fortnight before a holiday period delivers roughly half the evaluation time it appears to offer.

The prerequisite that decides the project

Run Plan 2 without Arc and you have a half deployment. The missing pieces are listed in the vendor documentation.

Nothing about the Arc dependency is hidden. It sits in the published feature table for anyone to read, and ignoring it remains the number one reason these deployments return less than the business case promised.

Two capabilities carry the same restriction: operating system updates, and baseline misconfiguration assessment measured against the Microsoft Cloud Security Benchmark. Both apply only where the machine arrived through Azure Arc.
File integrity monitoring is shown as available on Azure, AWS and GCP, with a qualifier on two of those three. On AWS and GCP it only applies where the machine was onboarded through Azure Arc.
Anything sitting in your own data center should be onboarded as an Azure Arc virtual machine. That is the vendor recommendation, and the reason is stated alongside it: connect those machines directly to Defender for Cloud and Plan 2 will not be fully available to them.
Which leaves one workable order: Arc, then the plan. Do it the other way round and the first three months get spent explaining to whoever signed the business case why the capabilities in it have not appeared.

Ask us to scope the Arc work first

How we approach it

Four disciplines that keep a server protection project from returning half of what you paid for.

Here the licensing choice and the infrastructure choice turn out to be one and the same, and the trial clock begins running regardless of whether anyone was prepared for it.

We scope the Azure Arc work before the plan decision

Three restrictions point the same way. Operating system updates and baseline misconfiguration assessment need Arc. File integrity monitoring on AWS and GCP needs Arc. Direct onboarding of on-premises machines falls short of full Plan 2 access. Put those together and Arc belongs at the top of the project plan, not on a list somebody picks up once the first two phases are done.

The estate gets divided rather than covered by a single blanket purchase

The controls are deliberately uneven. Plan 1 can be turned on and off per server. Plan 2 cannot be turned on per resource, but it can be turned off per resource. That asymmetry is something to design around rather than work around. A Plan 2 subscription with particular resources switched off produces a commercial outcome quite unlike an all-in decision, and the difference is worth modeling before you commit.

Secrets scanning findings get worked, because nobody is ready for what they say

Of everything in a first Plan 2 run, agentless machine secrets scanning produces the report people least want to read. Credentials sitting inside scripts. Keys written into configuration files. Connection strings on machines nobody has signed into since before the last reorganization. Each of those needs a named owner and a rotation plan agreed before the document goes anywhere near a wider distribution list.

We time the thirty day trial around an actual evaluation

Since the trial cannot be halted, suspended or extended once it begins, and the guidance says to plan ahead accordingly, we settle three questions before anyone touches the switch: what is being tested, who is going to look at the results, and which decision this evaluation exists to inform. Without those answers agreed, thirty days pass and nothing has been proven either way.

Where this fits

Six US situations where server protection needs modernizing.

Running through all of these is one pattern: endpoint security advanced and the servers stayed where they were. The reason is rarely technical. Server changes carry consequences, and nobody wanted their name attached to the outage.

A company with servers spread across three clouds and a data center

Windows and Linux are covered across Azure, AWS, GCP and your own data center. The recommended path has two parts. AWS accounts and GCP projects get connected to Defender for Cloud, and the plan can be switched on during that connection. Separately, the machines themselves get onboarded as Azure Arc virtual machines, which is what opens up the complete feature set rather than a subset of it.

A regulated firm with a file integrity monitoring requirement

It sits in Plan 2 and wants a Log Analytics workspace behind it, either one you already run or one created while configuring. On AWS and GCP it reaches only those machines onboarded through Azure Arc. When a PCI DSS assessor, a bank examiner or a framework requirement names file integrity monitoring by name, that stack of dependencies is your real project. The purchase order is the easy part.

An organization that has never scanned its servers for secrets

The agentless secrets scanner in Plan 2 goes looking for credentials left lying on your servers, and it finds them. Service account passwords hard-coded into scripts. Keys committed to configuration files. Connection strings in locations nobody can account for. More than any other output from this product, that report is what moves secrets management up the priority list.

An operator that cannot deploy agents everywhere

Anyone who evaluated this product a few years ago should look again, because the agent requirements changed. Most plan features no longer run on the Log Analytics agent or the Azure Monitor Agent at all, having been handed over to agentless machine scanning and the Defender for Endpoint integration. Where change control turns every agent rollout into a quarter of work, that shift removes most of the friction.

An organization with no server security analysts

Defender Experts for Servers puts Microsoft analysts on the front of your server alerts. They triage, investigate, contain and then hand back with the next steps written out. Proactive threat hunting is included, as is the ability to put a question about a specific incident to the Microsoft team. It carries its own commercial arrangement, and it requires either Plan 1 or Plan 2 with Defender for Endpoint already deployed.

A business trying to close down standing management access

Available on Azure and AWS under Plan 2, just-in-time access keeps management ports shut until somebody asks for them and the request is approved. Plenty of organizations have spent years trying and failing to close standing remote desktop and secure shell exposure, and their cyber insurance application asks about precisely that. This gets there without redesigning the network first.

Three positions

How US organizations protect servers today.

Most organizations recognize themselves in the middle column. Laptop protection got modernized during a Microsoft 365 rollout, and the servers were left running whatever was already on them because nobody was willing to risk restarting them.

Endpoint detection and response on servers

Defender for Servers Plan 2 with ArcYes

Traditional antivirus on serversNo

Inconsistent or unknownNo

Vulnerability scanning without an agent

Defender for Servers Plan 2 with ArcYes

Traditional antivirus on serversNo

Inconsistent or unknownNo

Secrets found on machines

Defender for Servers Plan 2 with ArcYes

Traditional antivirus on serversNo

Inconsistent or unknownNo

Operating system baselines assessed

Defender for Servers Plan 2 with ArcYes, with Arc

Traditional antivirus on serversNo

Inconsistent or unknownNo

File integrity monitoring

Defender for Servers Plan 2 with ArcYes

Traditional antivirus on serversSometimes

Inconsistent or unknownNo

Just-in-time management access

Defender for Servers Plan 2 with ArcYes

Traditional antivirus on serversNo

Inconsistent or unknownNo

Covers AWS and GCP machines too

Defender for Servers Plan 2 with ArcYes

Traditional antivirus on serversSeparately

Inconsistent or unknownNo

Alerts correlate with the rest of the estate

Defender for Servers Plan 2 with ArcYes

Traditional antivirus on serversNo

Inconsistent or unknownNo

Regulatory compliance assessed continuously

Defender for Servers Plan 2 with ArcYes

Traditional antivirus on serversNo

Inconsistent or unknownNo

Answer to what is running on that server

Defender for Servers Plan 2 with ArcInventory

Traditional antivirus on serversGuess

Inconsistent or unknownNone

Feature	Defender for Servers Plan 2 with Arc	Traditional antivirus on servers	Inconsistent or unknown
Endpoint detection and response on servers	Yes	No	No
Vulnerability scanning without an agent	Yes	No	No
Secrets found on machines	Yes	No	No
Operating system baselines assessed	Yes, with Arc	No	No
File integrity monitoring	Yes	Sometimes	No
Just-in-time management access	Yes	No	No
Covers AWS and GCP machines too	Yes	Separately	No
Alerts correlate with the rest of the estate	Yes	No	No
Regulatory compliance assessed continuously	Yes	No	No
Answer to what is running on that server	Inventory	Guess	None

Plan 1 against Plan 2

Nineteen capabilities, and where each one applies.

Lifted from the published plan feature table. Pay attention to the availability column, because that is where the conditions live that decide whether a given capability will work in your environment at all.

Capability

Multicloud and hybrid support

Plan 1: Yes
Plan 2: Yes
Where it applies: Any machine connected to Defender for Cloud, whether it runs in Azure, AWS, GCP or your own racks

Capability

Defender for Endpoint automatic onboarding

Plan 1: Yes
Plan 2: Yes
Where it applies: All supported machines

Capability

Defender for Endpoint endpoint detection and response

Plan 1: Yes
Plan 2: Yes
Where it applies: Azure, AWS and GCP

Capability

Integrated alerts and incidents

Plan 1: Yes
Plan 2: Yes
Where it applies: Azure, AWS and GCP

Capability

Software inventory discovery

Plan 1: Yes
Plan 2: Yes
Where it applies: Azure, AWS and GCP

Capability

Regulatory compliance assessment

Plan 1: Yes
Plan 2: Yes
Where it applies: Different standards for different environments

Capability

Vulnerability scanning, agent based

Plan 1: Yes
Plan 2: Yes
Where it applies: Azure, AWS and GCP

Capability

Vulnerability scanning, agentless

Plan 1: No
Plan 2: Yes
Where it applies: Azure, AWS and GCP

Capability

Defender for DNS alerts

Plan 1: No
Plan 2: Yes
Where it applies: Azure, AWS and GCP

Capability

Threat detection at the Azure network layer

Plan 1: No
Plan 2: Yes
Where it applies: Azure

Capability

Operating system system updates

Plan 1: No
Plan 2: Yes
Where it applies: Only machines onboarded with Azure Arc

Capability

Baseline misconfigurations, Microsoft Cloud Security Benchmark

Plan 1: No
Plan 2: Yes
Where it applies: Only machines onboarded with Azure Arc

Capability

Defender Vulnerability Management premium features

Plan 1: No
Plan 2: Yes
Where it applies: Available in the Defender portal only

Capability

Malware scanning, agentless

Plan 1: No
Plan 2: Yes
Where it applies: Azure, AWS and GCP

Capability

Machine secrets scanning, agentless

Plan 1: No
Plan 2: Yes
Where it applies: Azure, AWS and GCP

Capability

File integrity monitoring

Plan 1: No
Plan 2: Yes
Where it applies: AWS and GCP machines only when onboarded with Azure Arc

Capability

Just-in-time virtual machine access

Plan 1: No
Plan 2: Yes
Where it applies: Azure and AWS

Capability

Network map

Plan 1: No
Plan 2: Yes
Where it applies: Azure

Capability

Free data ingestion, 500 MB per node per day

Plan 1: No
Plan 2: Yes
Where it applies: Needs one of the supported collection methods in place, Azure Monitor Agent among them

Capability	Plan 1	Plan 2	Where it applies
Multicloud and hybrid support	Yes	Yes	Any machine connected to Defender for Cloud, whether it runs in Azure, AWS, GCP or your own racks
Defender for Endpoint automatic onboarding	Yes	Yes	All supported machines
Defender for Endpoint endpoint detection and response	Yes	Yes	Azure, AWS and GCP
Integrated alerts and incidents	Yes	Yes	Azure, AWS and GCP
Software inventory discovery	Yes	Yes	Azure, AWS and GCP
Regulatory compliance assessment	Yes	Yes	Different standards for different environments
Vulnerability scanning, agent based	Yes	Yes	Azure, AWS and GCP
Vulnerability scanning, agentless	No	Yes	Azure, AWS and GCP
Defender for DNS alerts	No	Yes	Azure, AWS and GCP
Threat detection at the Azure network layer	No	Yes	Azure
Operating system system updates	No	Yes	Only machines onboarded with Azure Arc
Baseline misconfigurations, Microsoft Cloud Security Benchmark	No	Yes	Only machines onboarded with Azure Arc
Defender Vulnerability Management premium features	No	Yes	Available in the Defender portal only
Malware scanning, agentless	No	Yes	Azure, AWS and GCP
Machine secrets scanning, agentless	No	Yes	Azure, AWS and GCP
File integrity monitoring	No	Yes	AWS and GCP machines only when onboarded with Azure Arc
Just-in-time virtual machine access	No	Yes	Azure and AWS
Network map	No	Yes	Azure
Free data ingestion, 500 MB per node per day	No	Yes	Needs one of the supported collection methods in place, Azure Monitor Agent among them

How an engagement runs

Five steps, and Arc comes before the plan.

Eight to sixteen weeks in most cases, and the variable is how much Azure Arc onboarding sits in front of you. Configuring Defender itself is fast. Getting the estate connected so that the features genuinely apply to it is where the weeks go.

1
Inventory the estate and its connection state
A count of Windows and Linux machines by location, Azure, AWS, GCP and on-premises, and a second count of how many are Arc-enabled today. That second number drives everything, because AWS and GCP machines should be onboarded as Azure Arc virtual machines to reach the full feature set, and on-premises machines connected directly rather than through Arc end up with limited Plan 2 access.
2
Decide the plan against the capabilities you need
Plan 1 covers endpoint detection and response and can be switched on or off server by server. Plan 2 brings the agentless scanners for vulnerabilities, malware and secrets, plus file integrity monitoring, just-in-time access, the network map and baseline assessment. It is enabled across the subscription, though individual resources can be excluded afterwards.
3
Do the Arc and prerequisite work first
Four pieces get put in place: Arc onboarding for every machine that needs an Arc-dependent feature, the Azure Policy machine configuration extension wherever baseline assessment against the Microsoft Cloud Security Benchmark is required, a Log Analytics workspace if file integrity monitoring is in scope, and a supported collection method so the ingestion benefit is actually claimed.
4
Enable deliberately, with the trial clock in mind
Several things happen on their own here. The Defender for Endpoint extension installs itself on supported machines, vulnerability management comes on by default wherever that extension lands, and Plan 2 turns agentless scanning on without being asked. What does not happen on its own is the evaluation. The thirty day trial begins immediately and cannot be paused, so the criteria and the named people assessing them are agreed in advance.
5
Work the findings and decide the operating model
Someone takes ownership of the secrets findings and rotates them. Baseline misconfigurations get ranked rather than listed. Just-in-time access goes onto the machines still carrying open management ports. After that come the standing questions: who works the alerts day to day, whether Defender Experts for Servers is the answer where that capacity does not exist, and who is accountable for closing posture recommendations from here on.

Straight answers

What US organizations ask about Defender for Servers.

The vendor positions Plan 1 as the entry point, built around the detection and response the Defender for Endpoint integration provides, with Plan 2 described as everything in Plan 1 plus more. Counted out, that is twelve additional capabilities: agentless scanning for vulnerabilities, malware and secrets, file integrity monitoring, just-in-time virtual machine access, the network map, operating system baseline assessment and the included data ingestion benefit among them.

It does. Protection extends to Windows and Linux machines across Azure, Amazon Web Services, Google Cloud Platform and your own premises. The mechanics are that AWS accounts and GCP projects get connected to Defender for Cloud, with the option to enable the plan during that connection. Getting the full feature set, though, depends on onboarding those machines as Azure Arc virtual machines afterwards.

Several Plan 2 capabilities simply will not function without it. Operating system updates and baseline misconfiguration assessment are documented as applying only where the machine came in through Azure Arc. The same restriction governs file integrity monitoring on AWS and GCP. And on-premises machines connected directly, without Arc, are documented as not having full access to Plan 2 features.

Far less than the product once demanded. Most plan features have moved off the Log Analytics agent and the Azure Monitor Agent entirely, with agentless machine scanning and the Defender for Endpoint integration taking their place. Azure Monitor Agent has not vanished altogether, since it remains one of the supported collection methods for claiming the 500 megabyte data ingestion benefit.

Only partly, and the difference is worth designing around. Plan 1 can be turned on and off one server at a time. Plan 2 offers no per-resource enable, only a per-resource disable. What that leaves you with is a single pattern: switch it on for the subscription, then carve out the resources that should not carry it. Building it up machine by machine is not on the table.

Four consequences follow immediately, all of them documented. The thirty day trial clock starts, and there is no stopping, pausing or extending it. Every supported connected machine gets the Defender for Endpoint extension installed automatically, though automatic provisioning can be turned off where that is not wanted. Defender Vulnerability Management then comes on by default on any machine carrying that extension. And if the plan in question is Plan 2, agentless scanning starts as well.

Eligible security data comes with a daily ingestion allowance per node at no extra cost. To claim it, Plan 2 has to be enabled on the Log Analytics workspace those machines actually report into, and the data has to arrive through a supported collection method, Azure Monitor Agent being the common one. One trap catches people out: writing a data collection rule on its own does not turn the benefit on.

It looks for credentials left behind on your servers. A first run typically returns service account passwords sitting inside scripts, keys written into configuration files, and connection strings on machines nobody has signed into in years. The capability belongs to Plan 2 and requires no agent to run. Expect to attach a rotation plan to the output before that report is circulated to anyone.

You get it with Plan 2, subject to two conditions. Configuration happens after the plan is enabled, and it wants a Log Analytics workspace behind it, either one you already have or one created at that point. The second condition applies outside Azure: on AWS and GCP it reaches only Arc-onboarded machines. If a framework such as PCI DSS calls out file integrity monitoring by name, put both conditions into the project plan rather than discovering them later.

Under Plan 2 your operating system configuration gets measured against the compute security baselines published in the Microsoft Cloud Security Benchmark. Two requirements gate it: the machine has to be running the Azure Policy machine configuration extension, and it has to have been onboarded through Azure Arc. When a SOC 2 audit or an insurance assessment asks you to evidence server hardening, this output is among the cleanest answers available.

Managed extended detection and response for server workloads, purchased on its own terms. Microsoft analysts handle triage, investigation and containment, then hand back with guided next steps. Proactive threat hunting comes with it, and specific incidents can be put to the Microsoft team from inside the Defender portal. Coverage is every Plan 1 and Plan 2 alert originating from Defender for Servers, on Windows and Linux in all supported environments. DNS alerts sit outside the scope.

Both plans include the integration and both onboard automatically, so any server covered by Defender for Servers picks up endpoint detection and response as a matter of course. Defender Experts for Servers is stricter. It requires Plan 1 or Plan 2 enabled and Defender for Endpoint genuinely deployed across your Windows and Linux machines, which makes actual deployment state, rather than license state, the thing to check.

Subscription level is the recommended default, with resource level enable and disable available where you need finer control, bounded by the rule that Plan 2 has no per-resource enable. Spend real time on where the subscription boundaries fall, because that boundary is what sets your coverage and your commercial exposure at the same time.

Somewhere between eight and sixteen weeks for a typical estate, with Arc onboarding volume accounting for almost all the variation. Enabling the plan and setting up the features takes very little time. What consumes the calendar is connecting on-premises, AWS and GCP machines to Arc, and deploying the machine configuration extension anywhere baseline assessment is required.

Scoping happens per engagement and the quote follows, shaped by machine count, the number of environments in play and the volume of Arc onboarding ahead of you. Microsoft bills the plan itself on its own published terms, and we size that against your real server count rather than guessing at it on a web page. The Arc conversation comes before all of it, because it sets both the schedule and what the plan will actually deliver once it is on.

Before you enable a plan

Fifteen checks that prevent a partial deployment.

Group one deals with what your estate actually is. Group two covers the prerequisites. Group three is about life after the thirty day trial begins, given that the clock will not stop for anyone.

Estate reality

How many servers, and where?
Azure, AWS, GCP, on-premises.
How many are Windows and how many Linux?
Both are supported.
Are AWS accounts and GCP projects connected?
That is the onboarding path.
Are on-premises machines Arc-enabled?
Direct onboarding limits Plan 2 features.
Which servers genuinely need Plan 2?
Plan 1 can be enabled per resource.

Prerequisites

Is Azure Arc deployment scoped and funded?
Several Plan 2 features depend on it.
Is the machine configuration extension deployed?
Required for OS baseline assessment.
Do you have a Log Analytics workspace?
Needed for file integrity monitoring.
Is a supported collection method in place?
For the 500 MB ingestion benefit.
Is Defender for Endpoint already deployed?
Required for Defender Experts for Servers.

After enabling

Is the 30 day trial timed deliberately?
It cannot be stopped, paused or extended.
Do you want automatic provisioning on?
The extension installs automatically by default.
Who works the alerts?
Or is Defender Experts for Servers in scope.
Who owns remediation of the recommendations?
Posture findings need an owner.
Which resources should be excluded?
Plan 2 can be disabled per resource.

The pages around this one.

Microsoft Defender for Cloud

The broader posture platform that Defender for Servers sits inside as one plan.

Defender for Endpoint

The endpoint detection and response engine both plans integrate.

Server management

The managed service that runs the estate this protects.

Next step

Work out what proportion of your servers are Arc connected today. That single figure drives the schedule.

The capabilities that usually justify buying Plan 2 in the first place are documented as applying only to Arc-onboarded machines. Getting that count on the table at the start is what separates a deployment that delivers from one that spends its first quarter making excuses.

Book a server protection review See Microsoft security services

Related Services

Explore more solutions that work great with this service

A large share of Plan 2 only works once your servers are onboarded to Azure Arc. Skip that work and the license still bills you for capabilities the estate cannot reach.

Seven factors that settle which plan fits, and what you will genuinely get from it.

Feature

Defender for Servers Plan 2 with Arc

Traditional antivirus on servers

Inconsistent or unknown

Endpoint detection and response on servers

Yes

Vulnerability scanning without an agent

Yes

Secrets found on machines

Yes

Operating system baselines assessed

Yes, with Arc

File integrity monitoring

Yes

Sometimes

Just-in-time management access

Yes

Covers AWS and GCP machines too

Yes

Separately

Alerts correlate with the rest of the estate

Yes

Regulatory compliance assessed continuously

Yes

Answer to what is running on that server

Inventory

Guess

None

Capability

Plan 1

Plan 2

Where it applies

Multicloud and hybrid support

Yes

Any machine connected to Defender for Cloud, whether it runs in Azure, AWS, GCP or your own racks

Defender for Endpoint automatic onboarding

Yes

All supported machines

Defender for Endpoint endpoint detection and response

Yes

Azure, AWS and GCP

Integrated alerts and incidents

Yes

Azure, AWS and GCP

Software inventory discovery

Yes

Azure, AWS and GCP

Regulatory compliance assessment

Yes

Different standards for different environments

Vulnerability scanning, agent based

Yes

Azure, AWS and GCP

Vulnerability scanning, agentless

Yes

Azure, AWS and GCP

Defender for DNS alerts

Yes

Azure, AWS and GCP

Threat detection at the Azure network layer

Yes

Azure

Operating system system updates

Yes

Only machines onboarded with Azure Arc

Baseline misconfigurations, Microsoft Cloud Security Benchmark

Yes

Only machines onboarded with Azure Arc

Defender Vulnerability Management premium features

Yes

Available in the Defender portal only

Malware scanning, agentless

Yes

Azure, AWS and GCP

Machine secrets scanning, agentless

Yes

Azure, AWS and GCP

File integrity monitoring

Yes

AWS and GCP machines only when onboarded with Azure Arc

Just-in-time virtual machine access

Yes

Azure and AWS

Network map

Yes

Azure

Free data ingestion, 500 MB per node per day

Yes

Needs one of the supported collection methods in place, Azure Monitor Agent among them

A large share of Plan 2 only works once your servers are onboarded to Azure Arc. Skip that work and the license still bills you for capabilities the estate cannot reach.

Seven factors that settle which plan fits, and what you will genuinely get from it.

Windows and Linux, across three clouds and on-premises

Plan 1 is endpoint detection and response, delivered automatically

The agentless shift in Plan 2 rewrote how this gets deployed

Just-in-time access, file integrity monitoring and baselines

Azure Arc is a dependency, not a nice to have

Defender Experts for Servers, if you have no analysts

A thirty day trial that cannot be paused

Run Plan 2 without Arc and you have a half deployment. The missing pieces are listed in the vendor documentation.

Four disciplines that keep a server protection project from returning half of what you paid for.

We scope the Azure Arc work before the plan decision

The estate gets divided rather than covered by a single blanket purchase

Secrets scanning findings get worked, because nobody is ready for what they say

We time the thirty day trial around an actual evaluation

Six US situations where server protection needs modernizing.

A company with servers spread across three clouds and a data center

A regulated firm with a file integrity monitoring requirement

An organization that has never scanned its servers for secrets

An operator that cannot deploy agents everywhere

An organization with no server security analysts

A business trying to close down standing management access

How US organizations protect servers today.

Nineteen capabilities, and where each one applies.

Multicloud and hybrid support

Defender for Endpoint automatic onboarding

Defender for Endpoint endpoint detection and response

Integrated alerts and incidents

Software inventory discovery

Regulatory compliance assessment

Vulnerability scanning, agent based

Vulnerability scanning, agentless

Defender for DNS alerts

Threat detection at the Azure network layer

Operating system system updates

Baseline misconfigurations, Microsoft Cloud Security Benchmark

Defender Vulnerability Management premium features

Malware scanning, agentless

Machine secrets scanning, agentless

File integrity monitoring

Just-in-time virtual machine access

Network map

Free data ingestion, 500 MB per node per day

Five steps, and Arc comes before the plan.

Inventory the estate and its connection state

Decide the plan against the capabilities you need

Do the Arc and prerequisite work first

Enable deliberately, with the trial clock in mind

Work the findings and decide the operating model

What US organizations ask about Defender for Servers.

What is the difference between Plan 1 and Plan 2?

Does it work outside Azure?

Why does everything keep mentioning Azure Arc?

Do we still need to deploy agents?

Can we apply different plans to different servers?

What happens the moment we turn it on?

What is the 500 megabyte ingestion benefit?

What does agentless secrets scanning find?

Is file integrity monitoring included?

How does baseline assessment work?

What is Defender Experts for Servers?

Do we need Defender for Endpoint separately?

Where should we enable it?

How long does a deployment take?

What does an engagement cost?

Fifteen checks that prevent a partial deployment.

Estate reality

Prerequisites

After enabling

The pages around this one.

Microsoft Defender for Cloud

Defender for Endpoint

Server management

Work out what proportion of your servers are Arc connected today. That single figure drives the schedule.

Related Services

Microsoft Defender for Cloud Services

Microsoft Defender for Containers

Microsoft Defender for SQL

Microsoft Defender for Endpoint Services

Microsoft Defender Vulnerability Management Services