Can I use Endpoint Protection without enabling Defender for Servers plan?

Question

Can I use Endpoint Protection without enabling Defender for Servers plan?

Dev SS 20

I'd like to confirm the actual behavior of the Endpoint Protection setting under Defender for Cloud's Settings & monitoring page when Defender for Servers is disabled on the subscription.

Based on this document, I understood that Endpoint Protection is a component of Defender for Servers. However, the portal's behavior looks inconsistent :

The Vulnerability assessment for machines toggle is entirely disabled, with a tooltip stating "Requires Microsoft Defender for servers" (see attached screenshot).
The Endpoint Protection toggle, by contrast, remains editable and can be switched to On even when Defender for Servers is off.

enter image description here

A clarification on this point would help me configure the subscription correctly. Thank you.

Shubham Sharma 17,835 Reputation points Microsoft External Staff Moderator

2026-06-04T06:10:02.1933333+00:00
Hey Dev SS, this isn’t a portal bug so much as a side-effect of how Defender for Servers Plan 1 (P1) vs. Plan 2 (P2) is modelled:

• Vulnerability assessment is a P2-only feature, so that toggle is disabled when you haven’t got Defender for Servers P2 on at the subscription or workspace level.

• Endpoint Protection, on the other hand, is the P1 “EDR” component (Defender for Endpoint integration). P1 can be enabled per resource, so the portal always lets you flip that toggle even if you haven’t got P2 enabled subscription-wide. Turning it on effectively applies the P1 subplan (EDR) to your machines, but it still won’t unlock any of the P2-only bits (vuln scanning, agentless posture, etc.) until you switch your subscription/workspace back to P2.

If you do want Endpoint Protection by itself, you can leave P2 off and click “On” under Endpoint Protection—behind the scenes you’ll get the Defender for Endpoint extension deployed (P1). If you want vulnerability assessment as well, you’ll need to enable the full Defender for Servers P2 plan.

Hope that clarifies things!

Reference docs

Enabling Defender for Servers plans (P1 vs P2): https://aka.ms/ASC-EnableServers

Plan 1 vs Plan 2 comparison chart: https://aka.ms/ASC-ServersPlanCompare

Review/modify Servers coverage settings: https://aka.ms/ASC-ConfigureServersCoverage

If the answer is helpful, kindly upvote it. If you have extra questions about this answer, please click "Comment".
Shubham Sharma 17,835 Reputation points Microsoft External Staff Moderator

2026-06-05T06:27:05.04+00:00

Dev SS

Following up to check if the resolution provided was helpful. Let us know if you need any further assistance.
Dev SS 20 Reputation points

2026-06-09T02:07:01.8266667+00:00

Hi Shubham,

Thank you for the clarification.

P1 can be enabled per resource, so the portal always lets you flip that toggle even if you haven’t got P2 enabled subscription-wide.

I'd like to clarify the above. Does this mean there is a way to enable P1 somewhere else, without flipping the toggle (shown in the image below) on?
Shubham Sharma 17,835 Reputation points Microsoft External Staff Moderator

2026-06-09T06:01:55.0833333+00:00

Dev SS

Thank you for your reply.

No — there is no separate place to “enable P1” independently of the toggle. The Endpoint Protection toggle itself is the mechanism used to enable the Defender for Servers Plan 1 (P1 / MDE integration) at the resource level.

Actual behavior

Endpoint Protection = Defender for Endpoint integration (P1 capability)

It is controlled directly via the “Endpoint protection” setting under Defender for Servers settings

When enabled:

Defender for Endpoint agent is automatically provisioned to machines

Protection features from MDE become active

https://learn.microsoft.com/en-us/azure/defender-for-cloud/configure-servers-coverage

Clarification to your question

There is no alternate UI/API path to enable P1 without this toggle

The portal keeps this toggle editable because:

It allows per-resource activation of MDE (P1-like behavior) even if full Defender for Servers (especially P2 features) is not enabled

So:

Turning Endpoint protection = ON → effectively enables the P1 capability (MDE integration)

There is no hidden/alternative switch elsewhere to enable P1 without using this control

For your reference: https://learn.microsoft.com/en-us/azure/defender-for-cloud/configure-servers-coverage
Shubham Sharma 17,835 Reputation points Microsoft External Staff Moderator

2026-06-11T05:32:34.6966667+00:00

Dev SS

Following up to check if the resolution provided was helpful. Let us know if you need any further assistance.

Answer accepted by question author

Shubham Sharma 17,835 Microsoft External Staff Moderator

Dev SS

1. What the Endpoint Protection toggle actually does

The Endpoint Protection toggle = Defender for Endpoint (MDE) integration control

It does NOT independently license or enable Defender for Servers Plan 1 (P1)

From Guidance:

MDE integration is automatically enabled when a Defender for Servers plan is enabled

The integration relies on the Defender for Servers plan (P1 or P2) for licensing entitlement

So, the toggle controls integration behavior, not licensing activation.

https://learn.microsoft.com/en-us/azure/defender-for-cloud/enable-defender-for-endpoint

https://learn.microsoft.com/en-us/azure/defender-for-cloud/faq-defender-for-servers

2. Your question:

If I enable only Endpoint Protection (toggle ON) but keep Defender for Servers OFF, do I still get P1 capability?

Answer: No

You do NOT get Defender for Servers Plan 1 capabilities just by turning on Endpoint Protection.

Because:

MDE for servers is licensed via Defender for Servers (P1/P2)

Without the plan enabled, there is no entitlement to onboard servers via Defender for Cloud

In short: -

Endpoint Protection ON + Defender for Servers OFF = Integration toggle enabled = BUT no actual P1 functionality available

3. What happens if the plan IS enabled (for comparison)

When Defender for Servers Plan 1 is enabled:

It includes:

MDE onboarding & integration

EDR capabilities (via Defender for Endpoint)

Defender for Cloud:

automatically deploys MDE agent

integrates alerts and telemetry

https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers-select-plan

4. Billing / Charges

If only Endpoint Protection toggle is ON:

No Defender for Servers charges

Because billing is tied to the plan, not the toggle

If Defender for Servers (P1 or P2) is ON:

Billing starts:

per VM (resource-level billing)

charged while VMs are in billed states (e.g., running/stopped but allocated)

Important:

Simply toggling Endpoint Protection does not trigger billing

Billing begins only when Defender for Servers plan is enabled

https://www.bytes.co.uk/info/news/microsoft-defender-servers-cheat-sheet-faq

https://learn.microsoft.com/en-us/azure/defender-for-cloud/faq-defender-for-servers

0 comments

2 additional answers

Your answer

Shubham Sharma 17,835 Reputation points Microsoft External Staff Moderator

2026-06-04T06:10:02.1933333+00:00

Hey Dev SS, this isn’t a portal bug so much as a side-effect of how Defender for Servers Plan 1 (P1) vs. Plan 2 (P2) is modelled:

• Vulnerability assessment is a P2-only feature, so that toggle is disabled when you haven’t got Defender for Servers P2 on at the subscription or workspace level.

• Endpoint Protection, on the other hand, is the P1 “EDR” component (Defender for Endpoint integration). P1 can be enabled per resource, so the portal always lets you flip that toggle even if you haven’t got P2 enabled subscription-wide. Turning it on effectively applies the P1 subplan (EDR) to your machines, but it still won’t unlock any of the P2-only bits (vuln scanning, agentless posture, etc.) until you switch your subscription/workspace back to P2.

If you do want Endpoint Protection by itself, you can leave P2 off and click “On” under Endpoint Protection—behind the scenes you’ll get the Defender for Endpoint extension deployed (P1). If you want vulnerability assessment as well, you’ll need to enable the full Defender for Servers P2 plan.

Hope that clarifies things!

Reference docs

Enabling Defender for Servers plans (P1 vs P2): https://aka.ms/ASC-EnableServers

Plan 1 vs Plan 2 comparison chart: https://aka.ms/ASC-ServersPlanCompare

Review/modify Servers coverage settings: https://aka.ms/ASC-ConfigureServersCoverage

If the answer is helpful, kindly upvote it. If you have extra questions about this answer, please click "Comment".
Shubham Sharma 17,835 Reputation points Microsoft External Staff Moderator

2026-06-05T06:27:05.04+00:00

Dev SS

Following up to check if the resolution provided was helpful. Let us know if you need any further assistance.
Dev SS 20 Reputation points

2026-06-09T02:07:01.8266667+00:00

Hi Shubham,

Thank you for the clarification.

P1 can be enabled per resource, so the portal always lets you flip that toggle even if you haven’t got P2 enabled subscription-wide.

I'd like to clarify the above. Does this mean there is a way to enable P1 somewhere else, without flipping the toggle (shown in the image below) on?
Shubham Sharma 17,835 Reputation points Microsoft External Staff Moderator

2026-06-09T06:01:55.0833333+00:00

Dev SS

Thank you for your reply.

No — there is no separate place to “enable P1” independently of the toggle. The Endpoint Protection toggle itself is the mechanism used to enable the Defender for Servers Plan 1 (P1 / MDE integration) at the resource level.

Actual behavior

Endpoint Protection = Defender for Endpoint integration (P1 capability)

It is controlled directly via the “Endpoint protection” setting under Defender for Servers settings

When enabled:

Defender for Endpoint agent is automatically provisioned to machines

Protection features from MDE become active

https://learn.microsoft.com/en-us/azure/defender-for-cloud/configure-servers-coverage

Clarification to your question

There is no alternate UI/API path to enable P1 without this toggle

The portal keeps this toggle editable because:

It allows per-resource activation of MDE (P1-like behavior) even if full Defender for Servers (especially P2 features) is not enabled

So:

Turning Endpoint protection = ON → effectively enables the P1 capability (MDE integration)

There is no hidden/alternative switch elsewhere to enable P1 without using this control

For your reference: https://learn.microsoft.com/en-us/azure/defender-for-cloud/configure-servers-coverage
Shubham Sharma 17,835 Reputation points Microsoft External Staff Moderator

2026-06-11T05:32:34.6966667+00:00

Dev SS

Following up to check if the resolution provided was helpful. Let us know if you need any further assistance.

Answer 1

Dev SS 20

Hi Shubham,

Thank you for the answer.

I'd like to confirm my understanding of your statement below.

there is no separate place to “enable P1” independently of the toggle. The Endpoint Protection toggle itself is the mechanism used to enable the Defender for Servers Plan 1 (P1 / MDE integration) at the resource level.

Does this mean that enabling only the Endpoint Protection toggle, while leaving the Defender for Servers toggle set to Off (including P1), allows me to use "Defender for Endpoint integration (P1 capability)"?

And if so, does this start P1 charges on the supported VMs?

Dev SS 20 Reputation points

2026-06-15T08:46:27.0433333+00:00

@Shubham Sharma

Thank you for the answer.

I think I fully understood the relationship between the Defender for Servers (P1/P2) toggle and the Endpoint Protection toggle. You can close this ticket.

I appreciate your quick help.
Shubham Sharma 17,835 Reputation points Microsoft External Staff Moderator

2026-06-15T09:20:53.92+00:00

Dev SS

You're welcome.

If the resolution was helpful, please take a moment to accept the answer to make it helpful to the community.

Thank you for contacting Microsoft Q&A!

Answer 2

Endpoint protection in Defender for Cloud is a feature of the Defender for Servers plan and is designed to work together with that plan.

From the documented behavior:

When a Defender for Servers plan is enabled, Endpoint protection is integrated by default. Defender for Cloud then automatically provisions the Microsoft Defender for Endpoint sensor on supported machines and provides EDR and malware protection capabilities.
The same plan enablement also turns on vulnerability assessment by default, which is why the Vulnerability assessment for machines control is explicitly marked as requiring Microsoft Defender for Servers.

The documentation does not describe a supported scenario where Endpoint protection is used independently of Defender for Servers. Instead, it states that:

Defender for Endpoint integration is enabled when a Defender for Servers plan is enabled on the subscription, and
Defender for Servers licensing entitles servers to Defender for Endpoint Plan 2 capabilities.

Therefore, even if the portal UI currently allows toggling Endpoint protection while Defender for Servers is disabled, the supported and documented configuration is to use Endpoint protection as part of an active Defender for Servers plan, not as a standalone feature.

References: