API evidence was captured September 11, 2026, approximately 23:24–23:28 UTC; portal verification followed at 23:54–23:55 UTC. One existing Azure lab subscription was inspected. No plan, policy, resource or billing configuration was changed.
Actual observations
| Evidence | Observed result | What it establishes |
|---|---|---|
| Defender pricing list | 18 entries returned successfully | Current subscription pricing configuration is readable |
| FoundationalCspm entry | pricingTier = Standard; subPlan and enablementTime = null; freeTrialRemainingTime = 0:00:00 | An explicit FoundationalCspm configuration entry is present, with the exact value shown |
| CloudPosture entry | pricingTier = Standard; enablementTime in April 2026 | Separate Defender CSPM configuration exists in this established lab |
| Discovery entry | pricingTier = Standard | Separate discovery configuration is present |
| Security settings list | Five data-export/alert-sync entries; no FoundationalCspm switch returned | This settings collection is not the free-plan enablement signal in this response |
| Security assessments | 110 records spanning 65 distinct assessment-definition IDs | Assessment data is available in this subscription at read time |
| Assessment statuses | 44 Healthy, 53 Unhealthy, 13 NotApplicable | Distribution of the returned records, not a comprehensive certification of resource coverage |
| Defender plans portal | Foundational CSPM labelled Free, with On selected | Independent visible confirmation of the named free plan’s current state |
| Environment settings portal | October 27 opt-in notice displayed | The future change is announced inside the tenant UI; its future default was not exercised |
The API’s literal tier value Standard appears on the FoundationalCspm object. The later portal check explicitly showed Free and On for that plan, separately from the paid Defender CSPM entry. Microsoft likewise distinguishes the two plans. The tier string alone is not a price or invoice. CSPM plans.
Supported conclusion
The lab has an explicit foundational-plan configuration entry and accessible assessment data today. This gives the article a concrete current-state example rather than only a generic CloudPosture flag.
It does not establish:
- The future default for subscriptions created after October 27.
- That every eligible resource is assessed, every assessment is recently reevaluated, or all controls are healthy.
- That every returned recommendation was produced exclusively by the free plan; this lab also has separate Standard protection configurations.
- Exact invoiced charges or a universal mapping from every pricingTier value to price.
- A tested post-transition opt-in API contract.
October 27 remains a documented future change for new subscriptions; existing subscription configurations are retained. The free plan remains available at no cost. Official opt-in notice.
Settings interpretation
The returned entries were MCAS, WDATP, WDATP_EXCLUDE_LINUX_PUBLIC_PREVIEW, WDATP_UNIFIED_SOLUTION and Sentinel. They were typed DataExportSettings or AlertSyncSettings.
The Sentinel entry’s false value belongs to this alert-sync setting. It is not evidence that no Sentinel workspace is onboarded to Defender, and must not be used to declare the playbook-generator prerequisite unmet.
Reading and verification details
Successful read commands were:
- az security pricing list
- az security setting list
- az security assessment list
Each command explicitly targeted the one authorized subscription and exited 0. Raw output and timestamped metadata are retained privately under work/roundup-evidence/cspm-*.
Direct REST pricing/settings reads and subsequent individual pricing-show reads encountered ConnectionResetError10054. Their failures and metadata are preserved; they were not interpreted as absent configuration. Specialized list commands succeeded. No additional cloud permission or configuration changes were made.
The assessment JSON includes case-distinct keys in nested data. PowerShell ConvertFrom-Json -AsHashtable correctly parses it; plain ConvertFrom-Json reports a casing collision. This parser issue does not invalidate the original API JSON.
Portal evidence
The current plan screenshot shows the named free and paid plans. The October notice screenshot preserves the announced change.
Caption: “Current configuration in an existing lab subscription. The CLI returned separate FoundationalCspm, CloudPosture and Discovery entries; this screenshot does not represent the future new-subscription default.”
Private evidence manifest
- cspm-pricing-cli.json and cspm-pricing-cli-metadata.json — successful 18-entry pricing response.
- cspm-setting-cli.json and cspm-setting-cli-metadata.json — successful settings response.
- cspm-assessments.json and cspm-assessments-metadata.json — successful 110-record assessment response.
- cspm-read-summary.json — sanitized aggregate/selected-plan projection.
- Other cspm-* metadata/stderr files — failed transient read attempts.
The public summary intentionally omits tenant, subscription, resource and account identifiers.