Hoping someone who knows the Defender for Cloud granular-pricing internals can sanity-check me, because I've been going insane.
I have 50 Azure Arc-enabled servers in one subscription. I want the critical ones on P2 and the rest on P1 to cut cost so I did this:

• P2 enabled at the subscription as the baseline.
• Tag each machine Defender = P1 or Defender = P2 (pushed during Arc onboarding).
• Assign the built-in policy "Configure Azure Defender for Servers to be enabled (with 'P1' subplan) for all resources (resource level) with the selected tag", targeting the P1 tag, so the non-critical boxes get pulled down to P1.

I tried it out on a pilot group of 10 servers for now and it looked like it worked but it didn't since:

• Policy compliance: 100% compliant, 10/10. Green check.

https://preview.redd.it/m61kt04xrp8h1.png?width=546&format=png&auto=webp&s=aee64430637f746abb40b5bfa1cc7f159eadfe3e

• Remediation: two tasks, both Complete, both "0 out of 0" remediated.

https://preview.redd.it/dhb96d0yrp8h1.png?width=1417&format=png&auto=webp&s=859c3ff043c6b118b3f824caa18d08882e2fbc8e

• When I read the actual pricing config on each machine (REST GET on Microsoft.Security/pricings/virtualMachines at the resource scope), every single one is still on the inherited P2

So no machine is actually on P1.

Stuff I've already ruled out

• The policy's managed identity has Security Admin on the subscription (verified in the assignment's Managed Identity tab), so it's not a permissions thing I chased that for a while.
• Tag parameters on the assignment are correct (inclusionTagName = Defender, value P1), and the tags really are on the resources.
• Compliance was freshly evaluated (today's timestamps), so it's not stale data.

I gave up on the policy for now and just wrote the subplan explicitly on each resource via the pricing API. I wrote in Microsoft.Security/pricingst through Cloud Shell as it grabs Arc machines tagged Defender=P1, PUTs Standard/P1, then reads back to confirm.

This flips everything to SubPlan = P1 / Source = Explicit and billing drops to P1. So the API path works fine but it's a one-shot I have to look out for, and it does nothing for machines onboarded later, which is the whole reason I wanted a policy in the first place.

So my actual question:
Why does the policy report compliant + "0 out of 0" and never write P1? (I'm going to attach the parameters of the policy)

https://preview.redd.it/9d1g852wrp8h1.png?width=1548&format=png&auto=webp&s=183ffd76ce6ad90d9d29c6e45ad44a2ffeb19e81

Is there any working way to actually do this? Has anyone done this for their own environment?

Thanks