Defender CSPM for AI Pricing: What AI-SPM, Defender for AI Services and Agent 365 Cost in 2026

Securing AI in a Microsoft estate now takes up to three separate purchases: the Defender CSPM plan for AI security posture management at 0.007 USD per billable resource per hour, the Defender for AI Services plan for threat protection on model traffic at 0.0008 USD per 1,000 tokens, and, since July 1, 2026, a Microsoft Agent 365 license for anything at the agent level. Those are Azure list prices in US regions as published in Microsoft's retail price feed in September 2026. The third one is the line most budgets missed.

Microsoft's transition notice is blunt about it: "Effective July 1, 2026, AI agent security capabilities for Microsoft Copilot Studio and Microsoft Foundry agents require a Microsoft Agent 365 license. These capabilities are no longer covered by existing Defender for Cloud Apps or Defender for Cloud licenses." If your team signed off on Defender CSPM last year partly because it discovered Foundry agents, that coverage moved to a different SKU mid-year.

What each Microsoft meter covers, and what it costs

One detail changes the arithmetic more than any price in that table. Defender CSPM bills only on compute, databases, storage and serverless resources, so the Azure OpenAI or Foundry resources it inventories for AI-SPM are not themselves the billable unit. You pay for posture on the servers, databases and functions around your AI workloads, and the AI coverage rides on that. For most Azure estates that already run Defender CSPM, AI-SPM costs nothing extra. For estates that never enabled it, AI-SPM is the reason to start paying for the whole plan.

A worked example for a mid-sized Azure estate

Take a US company with 300 Defender CSPM billable resources, about 1 billion model tokens a month through Azure OpenAI, and 500 employees who build or use agents in Copilot Studio and Foundry.

The agent line is roughly three quarters of the bill, and it scales with headcount rather than with the number of agents you run. That is the real budgeting consequence of the July change: a team with 12 agents and 500 licensed users pays the same Agent 365 cost as a team with 200 agents and 500 users. Enterprise agreements, Microsoft 365 E7 bundling and Commit Units all move these numbers, so treat list prices as a ceiling for the conversation with your Microsoft account team, not a quote.

Defender charges land on the same Azure invoice as the workloads they protect, which makes them easy to lose inside a large bill. If you already break cloud spend down by service and team, tag these three meters separately so the AI security cost is visible on its own line when the renewal comes around.

The change that quietly turned off blocking

Pricing is the visible part of the transition. The operational part is worse for anyone who relied on Microsoft to stop an agent action. Microsoft's notice says: "Tenants currently configured to Block on existing Agent 365 rules will stop blocking on July 1, 2026." To resume blocking, rules have to be redefined under the new real-time protection policy experience in the Defender portal.

So there are three checks worth running this week, whatever you decide to buy.

1. Confirm the licensing state of the tenant. Tenants without an Agent 365 eligible license lost agent discovery, posture and threat detection on July 1, 2026, and the Defender portal now shows licensing guidance in place of the agent inventory.
2. Re-create any blocking rules. If you had Agent 365 real-time protection set to block, check whether anyone redefined those rules after July 1. If nobody did, the rules audit and nothing is stopped.
3. Update hunting queries and third-party agent discovery. The AIAgentsInfo table is being replaced by AgentsInfo, and third-party cloud agents now need the Agent 365 registry sync instead of Defender for Cloud connectors.

If you are evaluating Agent 365 now, Microsoft offers admin-led trials for 25 seats for 30 days. Our Microsoft Agent 365 security page covers what its rules do and do not stop, and Microsoft Agent 365 alternatives covers the options for teams that do not want per-user licensing for agent security.

Should you pay for all three?

Buy Defender CSPM if you run AI workloads on Azure and already use Defender for Cloud; buy Defender for AI Services if you expose Azure OpenAI deployments to untrusted input; buy Agent 365 only if most of your agents live in Copilot Studio and Foundry and you want Microsoft's registry as the source of truth. That is the honest answer, and it means many teams should buy at least one Microsoft meter before they buy anything from us.

The last row is where AgentShield fits, and it is a narrow fit on purpose. Every Microsoft meter above either describes your AI estate or detects threats in it. None of them decides, per tool call, that this agent may read the order but not refund it, or that this refund above 500 USD waits for a person. That is AI agent permissions management and human approval gates, applied in the action path for agents on any cloud. For Foundry specifically, our Microsoft Foundry security page maps which Microsoft control covers which layer.

Our prices are on the pricing page, billed per plan rather than per user, so you can compare them to the Agent 365 line in the example above without a sales call.