Question 1,235 of 209
hardMultiple ChoiceObjective-mapped
Automatically Enable Defender Plans on New Subscriptions
An organization manages multiple Azure subscriptions under a single management group. They want to automatically enable Microsoft Defender for Cloud's enhanced security plans (e.g., Defender for Servers) on any new subscription added to the management group. Which configuration method should they use?
Quick Answer
The correct configuration method is to create an Azure Policy that assigns the Defender for Cloud pricing tier at the management group level. This works because Azure Policy can enforce compliance at scale—by assigning the built-in policy initiative “Configure Microsoft Defender for Cloud plans to be enabled” to the management group, any new subscription added under that group automatically inherits the Standard pricing tier for plans like Defender for Servers, ensuring consistent security posture without manual setup. On the SC-200 exam, this scenario tests your understanding of policy-based governance versus manual per-subscription configuration; a common trap is selecting Azure Blueprints or direct API calls, but Azure Policy is the only native method that continuously evaluates and remediates new subscriptions. Remember the tip: “Policy at the parent, protection for the child”—assigning policy at the management group level automatically covers all current and future subscriptions, making it the scalable, exam-correct answer.
⚠ Common exam trap
Candidates often confuse auto-provisioning (which installs agents) with policy-based enforcement of pricing tiers, leading them to select Option B instead of recognizing that Azure Policy at the management group level is the correct method for automatic, scalable plan activation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an Azure Policy that assigns the Defender for Cloud pricing tier at the management group level
Azure Policy can be assigned at the management group scope to enforce the 'Configure Microsoft Defender for Cloud plans to be enabled' policy, which automatically sets the pricing tier (e.g., Standard) for Defender for Servers on any new subscription added to that management group. This ensures compliance without manual intervention, as the policy evaluates and remediates new subscriptions upon creation or addition.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create an Azure Policy that assigns the Defender for Cloud pricing tier at the management group level
Why this is correct
Azure Policy can enforce the 'Pricing tier' setting at a scope. When new subscriptions are added under the management group, they automatically get the policy and the plan is enabled.
- ✗
Enable auto-provisioning in Defender for Cloud's settings
Why it's wrong here
Auto-provisioning installs the Log Analytics agent but does not enable the enhanced security plans themselves. It only addresses data collection.
- ✗
Use Azure Blueprints to define the subscription configurations
Why it's wrong here
Azure Blueprints are designed to define and deploy consistent environments, including security policies and resource configurations, across Azure subscriptions. While they can enforce Defender for Cloud settings, they do not automatically trigger their assignment or application to a *new* subscription simply because it is added to a management group. Blueprints are assigned *to* subscriptions, typically during provisioning or as a post-provisioning step, to apply a baseline configuration. This option is tempting because Blueprints excel at ensuring compliance and standardisation for subscription configurations, making them ideal for initial setup or ongoing governance of existing subscriptions.
- ✗
Manually enable plans per subscription as they are added
Why it's wrong here
Manual configuration is not scalable and defeats the purpose of automatic enforcement. It also increases the risk of human error.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SC-200
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A large organization manages multiple Azure subscriptions under a single management group. The security team wants to ensure that when new subscriptions are added to the management group, the Microsoft Defender for Cloud plans (e.g., Defender for Servers) are automatically enabled. What is the most efficient way to achieve this?
easy- ✓ A.Assign the Azure Policy initiative 'Configure Azure Defender to be enabled on subscriptions' to the management group with appropriate policy parameters.
- B.Enable all Microsoft Defender plans at the management group level in the Microsoft Defender for Cloud portal.
- C.Manually enable the Defender plans on each new subscription as they are created.
- D.Use an Azure Blueprint to assign the Defender plans to the subscription.
Why A: Assigning the built-in Azure Policy initiative 'Configure Azure Defender to be enabled on subscriptions' to the management group ensures that any new subscription added under that management group automatically inherits the policy. This initiative uses DeployIfNotExists effect to enable the specified Defender plans (e.g., Defender for Servers) on subscriptions that do not already have them enabled, providing a fully automated, scalable solution without manual intervention.
Last reviewed: Jun 11, 2026
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.