Microsoft.Security/pricings/write
Azure
Microsoft.Security/pricings/write
Event
Changes the pricing tier (plan) for Microsoft Defender for Cloud on a subscription or specific resource type.
Security Context
- Impairing defenses allows adversaries to operate freely by removing security controls that would otherwise detect or block their activity.
- Tampering with cloud security services blinds defenders to threats and may indicate an adversary is preparing for further malicious activity.
Log Source
Azure Activity Log
Sample Event
Adversarial. draco@fantasticlogs.cloud downgrades Defender for Servers from Standard (paid plan with EDR/agentless scanning/etc.) to Free on the production subscription. This silently disables Defender for Servers protections, EDR alerts on VMs, and the agentless vulnerability assessment.
{ "authorization": { "action": "Microsoft.Security/pricings/write", "scope": "/subscriptions/20000000-0000-4000-8000-000000000001/providers/Microsoft.Security/pricings/VirtualMachines" }, "caller": "draco@fantasticlogs.cloud", "channels": "Operation", "claims": { "appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46", "ipaddr": "203.0.113.66", "name": "Draco Malfoy", "http://schemas.microsoft.com/identity/claims/objectidentifier": "30000000-0000-4000-8000-001010011010", "puid": "1003200000000666", "http://schemas.microsoft.com/identity/claims/tenantid": "10000000-0000-4000-8000-000000000001", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "draco@fantasticlogs.cloud", "http://schemas.microsoft.com/identity/claims/wids": "e8611ab8-c189-46e8-94e1-60213ab1f814", "uti": "secPri215ExampleUtid01", "ver": "1.0" }, "correlationId": "90000000-0000-4000-8000-000100101010", "description": "", "eventDataId": "90000000-0000-4000-8000-000100101011", "eventName": { "value": "EndRequest", "localizedValue": "End request" }, "category": { "value": "Administrative", "localizedValue": "Administrative" }, "eventTimestamp": "2026-04-15T17:32:18.5028104Z", "id": "/subscriptions/20000000-0000-4000-8000-000000000001/providers/Microsoft.Security/pricings/VirtualMachines/events/90000000-0000-4000-8000-000100101011/ticks/638798198185028104", "level": "Informational", "operationId": "90000000-0000-4000-8000-000100101100", "operationName": { "value": "Microsoft.Security/pricings/write", "localizedValue": "Create or Update Pricing" }, "resourceGroupName": "", "resourceProviderName": { "value": "Microsoft.Security", "localizedValue": "Microsoft.Security" }, "resourceType": { "value": "Microsoft.Security/pricings", "localizedValue": "Microsoft.Security/pricings" }, "resourceId": "/subscriptions/20000000-0000-4000-8000-000000000001/providers/Microsoft.Security/pricings/VirtualMachines", "status": { "value": "Succeeded", "localizedValue": "Succeeded" }, "subStatus": { "value": "OK", "localizedValue": "OK (HTTP Status Code: 200)" }, "submissionTimestamp": "2026-04-15T17:32:19.0492881Z", "subscriptionId": "20000000-0000-4000-8000-000000000001", "tenantId": "10000000-0000-4000-8000-000000000001", "properties": { "statusCode": "OK", "serviceRequestId": null, "eventCategory": "Administrative", "entity": "/subscriptions/20000000-0000-4000-8000-000000000001/providers/Microsoft.Security/pricings/VirtualMachines", "message": "Microsoft.Security/pricings/write", "hierarchy": "10000000-0000-4000-8000-000000000001/20000000-0000-4000-8000-000000000001", "requestbody": "{\"properties\":{\"pricingTier\":\"Free\"}}" }, "relatedEvents": []}MITRE ATT&CK Mapping
Tactics: Defense Impairment
Techniques:
- T1685 — Disable or Modify Tools — Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities. This may include stopping spec...