workspace or subscription?

[andrePKI]

In a note on this page is written

"The Microsoft Defender plans available at the workspace level are: Microsoft Defender for Servers, Microsoft Defender for SQL servers on machines."

Is it workspace or subscription?

---

Document Details

⚠ Do not edit this section. It is required for learn.microsoft.com ➟ GitHub issue linking.

• ID: e27ad53d-6fe6-2c18-a86e-39a98794f691
• Version Independent ID: c3ac8fc2-2e39-f576-275f-1349504dd770
• Content: Connect your Azure subscriptions - Microsoft Defender for Cloud
• Content Source: articles/defender-for-cloud/connect-azure-subscription.md
• Service: defender-for-cloud
• GitHub Login: @dcurwin
• Microsoft Alias: dacurwin

[RamanathanChinnappan-MSFT]

@andrePKI Thanks for your feedback! We will investigate and update as appropriate.

[ElazarK]

@andrePKI the page indicates that both are supported. Can you clarify the issue?

[SaibabaBalapur-MSFT]

@andrePKI Since we have not heard back from you, we will now proceed to close this thread.If there are further questions regarding this matter, please tag me in your reply. We will gladly continue the discussion and we will reopen the issue.

[andrePKI]

Hello @SaibabaBalapur-MSFT, the plans for Microsoft Defender for Servers, Microsoft Defender for SQL servers on machines, you enable on the subscription level, not workspace.

[SaibabaBalapur-MSFT]

@ElazarK Can you please check and add your comments on this doc update request as applicable.

[SaibabaBalapur-MSFT]

@dcurwin please review it.

[ElazarK]

assign:Alizabernstein

[ElazarK]

reassign:Alizabernstein

[AlizaBernstein]

Work item opened https://dev.azure.com/msft-skilling/Content/_workitems/edit/201575

label:"backlog-item-created"

[TPavanBalaji]

@rayne-wiselman Could you please review it.

[dcurwin]

reassign:ElazarK

[ElazarK]

@andrePKI Microsoft Defender for SQL is a subscription level bundle that utilizes workspaces (either the default one, or your own)

[ElazarK]

The documentation will be updated to more clearly reflect that

[ElazarK]

please-close

[andrePKI]

The original text of my remark is still there? "The Microsoft Defender plans available at the workspace level are:" It must say subscription, not workspace And there is another instance where workspace is written, but subscription is meant. (I looked at the modified source, not the published page)

[andrePKI]

"4. Select the subscription or workspace that you want to protect." You protect a subscription or resource, the data goes to the associated workspace

[ElazarK]

The original text of my remark is still there? "The Microsoft Defender plans available at the workspace level are:" It must say subscription, not workspace And there is another instance where workspace is written, but subscription is meant. (I looked at the modified source, not the published page)

@andrePKI I just want to make sure i'm understanding correctly, your issue is that section in question refers to enabling on a subscription but the instructions for a workspace are mixed in because it is essentially the same process?

Because you can also enable on a workspace by selecting it and then enabling plans on the workspace as shown below

[andrePKI]

Well, one can enable plans via "resources reporting to the workspace", but a log analytics workspace is not a resource that can be protected byu a DfC plan. So in my view there aren't any plans "available on the workspace level". Also, you don't "protect the workspace" , you protect other resources that report to that workspace. I wasn't aware of the way you show above to get to the plans, but I would describe it differently.

[ElazarK]

@andrePKI I completely understand where you are coming from and agree that there should be an extra page explaining the process I showed you. I am creating a work item for myself to add that process to the documentation now.

As for the wording, "Microsoft Defender for SQL is a subscription level bundle that utilizes workspaces (either the default one, or your own)". This is almost word for word the description I got from the PM in charge of Defender for SQL. I understand the distinction you are trying to make but because it can be enabled on the workspace and therefore protect all of the resources that report to it, it still makes sense. I will try to rewrite this section a bit clearer and explain it more when I create the new page.

The work item will be added to my backlog and will be followed up based on priority.

Thank you for your feedback.