When you enable Defender for Servers on a subscription, you're charged for all machines based on their power states.
Azure VMs:
StateDetailsBilling StartingVM starting up.Not billed RunningNormal working state.Billed StoppingTransitional. Moves to Stopped state when finished.Billed StoppedVM shut down from within guest OS or by using PowerOff APIs. Hardware is still allocated, and the machine remains on the host.Billed DeallocatingTransitional. Moves to Deallocated state when finished.Not billed DeallocatedVM stopped and removed from the host.Not billed
Azure Arc machines:
StateDetailsBilling ConnectingServers connected, but heartbeat not yet received.Not billed ConnectedReceiving regular heartbeat from Connected Machine agent.Billed Offline/DisconnectedNo heartbeat received in 15-30 minutes.Not billed ExpiredIf disconnected for 45 days, status might change to Expired.Not billed