Microsoft Kills Default CSPM for New Azure Subscriptions in October 2026

Microsoft's free CSPM tier becomes opt-in, creating a provisioning gap

Microsoft will stop enabling Foundational CSPM by default on new Azure subscriptions starting October 27, 2026. The free tier remains available at no cost, but security teams must explicitly turn it on for each new subscription. Existing subscriptions keep their current configuration; the change applies only to new accounts.

The shift is part of Microsoft's consolidation of cloud security posture management into the Defender portal. For enterprises that create new Azure subscriptions frequently—think M&A integrations, new business units, or dev/test environments—this introduces a day-zero configuration risk. A subscription created without Foundational CSPM will lack baseline posture checks until someone remembers to enable them. In practice, that means misconfigurations, exposed storage, or overprivileged identities may go undetected in early workload deployment.

The change targets the free Foundational CSPM plan. Microsoft's paid Defender CSPM—which includes AI security posture, attack path analysis, and multi-cloud support for Azure, AWS, and GCP—remains available for organizations that need centralized posture management across environments. Defender CSPM also covers Azure Government and Azure Government Secret, making it relevant for public sector and defense buyers who previously patched together niche tooling for classified workloads.

Buyer impact: automation becomes mandatory, not optional

Organizations with strong Azure growth must now treat CSPM enablement as a required step in cloud landing zones and subscription-creation workflows. That means updating Infrastructure-as-Code templates, Azure Policy assignments, or account provisioning runbooks to explicitly enable Foundational CSPM. Teams that skip this step face a choice: accept the risk of unmonitored subscriptions or allocate budget to either formalize Azure CSPM governance or expand paid Defender CSPM to enforce posture across all subscriptions.

The shift will surface in vendor evaluations where buyers compare native Azure CSPM with minimal third-party tooling against neutral multi-cloud platforms like Wiz, Palo Alto Networks' Prisma Cloud, or CrowdStrike. Wiz—now part of Google following a $32 billion all-cash acquisition finalized in March 2026—positions itself as a multi-cloud CSPM/CNAPP platform, and Google is tightening integration with Google Cloud security services. That changes the calculus for buyers who run significant workloads outside Azure: a multi-cloud CSPM may deliver more consistent posture visibility than stitching together native tooling from each cloud provider.

For government and defense buyers, Defender CSPM's general availability in Azure Government and Government Secret is significant. Agencies that previously needed homegrown or niche vendor solutions to cover those environments now have a native option with built-in posture baselines and compliance mapping. The question for those buyers is whether Microsoft's controls meet their specific Authority to Operate requirements or whether they still need a third-party overlay.

Telos expands Xacta.io with ONI, targeting aggregated posture visibility

On September 3, 2026, Telos Corporation announced an expanded contract with the U.S. Office of Naval Intelligence to provide Xacta.io subscription licenses and related services. Xacta.io aggregates security findings from multiple products into a single view and automatically maps them to compliance controls for continuous posture assessment. The announcement does not disclose contract value, seat counts, or term length.

While Xacta.io is categorized as governance, risk, and compliance software, ONI's deployment is explicitly tied to continuous posture monitoring and enterprise cyber risk visibility. That puts Xacta.io in architectural competition with CSPM platforms and security data lakes that promise unified visibility across multi-cloud and hybrid environments. For buyers evaluating posture aggregation, the Telos deal signals continued demand for control planes that sit above individual security tools and normalize findings into a risk-prioritized view.

The challenge for buyers is distinguishing between GRC platforms that offer lightweight dashboards and true CSPM platforms that include remediation workflows, attack path modeling, and runtime protection. Xacta.io's strength is compliance mapping and audit readiness; its weakness relative to platforms like Wiz or Defender CSPM is real-time risk prioritization and automated remediation. Buyers in regulated industries or government agencies may need both: a GRC layer for Authority to Operate documentation and a CSPM layer for operational security.

What to watch: day-zero automation and multi-cloud vendor consolidation

Buyers should audit their Azure subscription provisioning workflows before October 27, 2026 to ensure Foundational CSPM enablement is automated. Organizations that fail to do this will create a growing inventory of unmonitored subscriptions, increasing the likelihood of a breach stemming from a misconfigured resource.

The Microsoft change also accelerates vendor consolidation pressure. As cloud providers add native CSPM features and as platforms like Wiz integrate deeper into Google Cloud, buyers face a choice: invest in automation to stitch together native tooling from each cloud, or standardize on a single multi-cloud CSPM that abstracts away per-cloud differences. The answer depends on workload distribution and risk tolerance, but the direction is clear—manual posture management at scale is no longer viable.