Foundational CSPM Stops Being Default: What to Add to Your Subscription Vending Before 27 October 2026

This is a change nobody will announce to you, because it shows up on no invoice and triggers no alert. One day a subscription is created and there is simply no Secure Score in it.

Microsoft announced it on 30 July 2026: from 27 October 2026, Foundational CSPM no longer switches on automatically for new Azure subscriptions. It stays free, it can be enabled at any time, and existing subscriptions keep their configuration. AWS and GCP connectors are unaffected.

That sounds harmless. And for the security team it is — because this is not their problem. It is a problem for your landing zone factory.

Why this is a vending problem, not a security problem

Every subscription vending pipeline I have seen rests on one unspoken assumption: baseline posture appears on its own. The vending module creates the subscription, places it in a management group, deploys networking, assigns policy — and Defender for Cloud just turns on, because it always has.

From 27 October 2026 that assumption is false. And because Foundational CSPM is free, its absence is invisible everywhere it would normally show up:

• nothing on the invoice (it is free)
• nothing in Cost Management
• no alert — Defender does not alert you about not being enabled
• Secure Score for the subscription simply does not exist, so it cannot drop either

The only thing you will eventually notice is that the subscription count in your posture report no longer matches the subscription count in your tenant. And you usually notice that during an audit, not before.

Fix it in two places

You want both. They are not alternatives.

1. The vending module — so subscriptions are born correct

This is the primary path. Add an explicit enablement to whichever module configures a new subscription:

targetScope = 'subscription'
 
// From 27 Oct 2026 Foundational CSPM no longer enables itself on
// new subscriptions. Free tier, but it has to be declared.
resource foundationalCspm 'Microsoft.Security/pricings@2024-01-01' = {
  name: 'CloudPosture'
  properties: {
    pricingTier: 'Free'
  }
}
 
// The security contact belongs in the same step — otherwise you
// have posture with no recipient.
resource securityContact 'Microsoft.Security/securityContacts@2023-12-01-preview' = {
  name: 'default'
  properties: {
    emails: securityContactEmail
    notificationsByRole: {
      state: 'On'
      roles: ['Owner']
    }
    isEnabled: true
  }
}
 
@description('Security team distribution list, not a personal address.')
param securityContactEmail string

The Terraform equivalent is azurerm_security_center_subscription_pricing with tier = "Free" and resource_type = "CloudPosture".

If you want paid Defender CSPM as well (attack path analysis, agentless scanning, posture context), set pricingTier to Standard — but that is a decision with a price tag and belongs in a separate approval. I went through the difference between the tiers in the piece on Defender CSPM.

2. A DeployIfNotExists policy — the safety net

The vending module covers subscriptions that go through your factory. It does not cover the ones somebody created in the portal because "it was quicker". In any organisation past a certain size, that happens.

Assign a built-in definition that adds Microsoft.Security/pricings at the root or platform management group. The critical part is configuring it so remediation runs retroactively — otherwise it only covers what is created after the assignment:

# Assign at management group scope with an identity for remediation
az policy assignment create \
  --name 'enforce-foundational-cspm' \
  --scope '/providers/Microsoft.Management/managementGroups/mg-platform' \
  --policy '<definition-id>' \
  --mi-system-assigned \
  --location westeurope \
  --enforcement-mode Default
 
# Remediate the existing estate — without this step the policy
# only guards the future
az policy remediation create \
  --name 'remediate-cspm-backfill' \
  --policy-assignment 'enforce-foundational-cspm' \
  --management-group 'mg-platform' \
  --resource-discovery-mode ReEvaluateCompliance

People skip that second command and are then surprised that the compliance report is green while the subscriptions are still empty.

Audit: find out where it is missing

This Resource Graph query returns subscriptions that have no CSPM plan record. Run it today so you have a baseline, then run it again in November:

// Subscriptions without Foundational CSPM
resourcecontainers
| where type == 'microsoft.resources/subscriptions'
| where properties.state == 'Enabled'
| project subscriptionId, subName = name
| join kind=leftouter (
    securityresources
    | where type == 'microsoft.security/pricings'
    | where name == 'CloudPosture'
    | project subscriptionId, tier = tostring(properties.pricingTier)
) on subscriptionId
| where isempty(tier)
| project subName, subscriptionId
| order by subName asc

You can run it straight from the CLI:

az graph query -q "$(cat cspm-audit.kql)" --first 1000 -o table

The output you want is empty. Anything else is a list of subscriptions with no posture baseline — and after 27 October that list starts growing on its own.

Context worth knowing

Microsoft frames this change as part of moving posture management into the Microsoft Defender portal — the Defender for Cloud integration into the Defender portal went GA on 5 May 2026. The practical impact on you is mostly that links and runbooks pointing at the Defender for Cloud blade in the Azure portal are gradually going stale. If your operational documentation contains click-through procedures, expect to rewrite them.

It has no effect on enabling CSPM itself — the API and the Bicep resource stay exactly where they were.

What to do this week

1. Run the ARG query above and save the result as a baseline. You want to know the state before the change.
2. Add Microsoft.Security/pricings to the vending module and deploy it to a test subscription.
3. Assign the DeployIfNotExists policy with remediation across the existing estate.
4. Put a task in your calendar for the first week of November 2026 to run that query again.

The whole thing is half a day of work. The cost of forgetting it is several months of subscriptions with no posture baseline, discovered during an audit.

If you are building a landing zone from scratch and want the vending pipeline right the first time, I laid out the structure in the Azure Landing Zone in Bicep article. Happy to help design or review a specific environment — see cloud architecture services.

Sources

• Defender for Cloud release notes — 30 July 2026 entry