Microsoft adds critical cloud logs at no extra charge

This is the rare Secure by Design story where the slogan produced a product change. CISA said Microsoft will make additional cloud logging capabilities available at no extra cost to federal government and commercial customers beginning in September 2023, after CISA operational teams spent several years identifying logs that were critical for detecting and preventing threat activity but cost extra for customers on Microsoft’s basic enterprise license.

That matters because logging is not a premium cybersecurity ornament. In CISA’s telling, an affected government agency recently used available logging data to move quickly on remediation and limit damage. The obvious implication is that customers without those logs were being asked to defend a tenant with less telemetry because the purchasing tier said so.

For federal agencies and Microsoft-heavy contractors, the September date is not the finish line. Security teams still need to identify the specific log types landing in their tenants, confirm whether they are enabled by default, and make the plumbing work in their SIEM and incident-response process. Free logs that nobody ingests are still invisible. But the larger signal is real: CISA’s incident-response findings moved a major vendor from guidance-compliance language into a concrete design and licensing shift.