Issue with "MDE Designated Subscription Enabled" Setting Not Reflecting in Azure Security Pricing

It seems you are experiencing an issue where the Azure policy for enabling the "MDE Designated Subscription Enabled" setting is not reflecting correctly in the Azure Security pricing. Here are a few potential reasons and troubleshooting steps you might consider:

1. Policy Assignment Status: Ensure that the policy assignment is in a compliant state. You can check the compliance status in the Azure Policy portal to confirm if the policy is being evaluated correctly.
2. Remediation Task: Since you have already created and executed a remediation task, verify that the task completed successfully. Sometimes, remediation tasks may fail or may not apply changes as expected due to permissions or other issues.
3. Propagation Delay: Changes in Azure policies and settings may take some time to propagate. If you have just executed the remediation task, wait a few minutes and then recheck the status using your PowerShell command.
4. Permissions: Ensure that the account you are using to run the PowerShell command has the necessary permissions to view and modify security settings in Azure.
5. Azure Support: If the issue persists, consider reaching out to Azure support for further assistance. They can provide insights specific to your subscription and the policies applied.

These steps should help you diagnose the issue further. If you find any specific error messages or behaviors during your troubleshooting, those details could also be useful for further investigation.

References:

• Remediate non-compliant resources with Azure Policy

Hello Guo, Jianning, MdeDesignatedSubscription is an extension of the VirtualMachines Defender plan. It enables the “Direct onboarding” integration between Microsoft Defender for Endpoint (MDE) and Defender for Cloud, onboarded resources are presented under a designated subscription. This extension is explicitly listed in the Microsoft.Security/pricings resource schema.

Changing plan extensions (including MdeDesignatedSubscription) is governed by directory‑level permissions. If the caller lacks the required Microsoft Entra admin role like Security Administrator, the PUT succeeds but the extension’s operationStatus.code = Failed and the value doesn’t change.

Reference: https://learn.microsoft.com/en-us/azure/templates/microsoft.security/pricings?pivots=deployment-language-bicep

For plan operations and agent/extension configuration, Defender for Cloud requires appropriate roles.

Reference: https://learn.microsoft.com/en-us/azure/defender-for-cloud/permissions#roles-and-allowed-actions

Have a tenant admin assign you Microsoft Entra Security Administrator or equivalent before changing extensions for the VirtualMachines plan.

Re‑register the provider and make sure latest schema availability for Microsoft.Security/pricings:

Register-AzResourceProvider -ProviderNamespace 'Microsoft.Security'

Enable the extension using Azure CLI:

az security pricing create \
  -n VirtualMachines \
  --tier standard \
  --subplan P2 \

The CLI supports --extensions for pricing updates (example in official reference). Use P1 or P2 as applicable

PowerShell can update pricing and pass an -Extension JSON, but the CLI exposes the extensions parameter more directly.

Reference: https://learn.microsoft.com/en-us/powershell/module/az.security/set-azsecuritypricing?view=azps-14.6.0

Re‑run policy remediation if you used Policy The built‑in policy for Defender for Servers uses DeployIfNotExists against Microsoft.Security/pricings. If the remediation identity didn’t have the required Entra role, it will appear “successful” but won’t change the extension. Assign the role and re‑run remediation.

Kindly let us know if the solution provided worked for you.

If you need any further assistance, please feel free to reach out.

Thanks,

Suchitra.