Defender — Microsoft Defender for Business / Endpoint

Microsoft Defender for Endpoint and Defender for Business represent Microsoft’s unified security platform for device protection. It combines traditional signature-based antivirus with next-generation protection, endpoint detection and response (EDR), and automated remediation. While the core security engine is shared across versions, the licensing dictates the depth of forensic tools, the number of supported seats, and the level of automation available to security administrators.

Product Tiers and Feature Sets

• Microsoft Defender for Business: Designed specifically for Small and Medium Businesses (SMBs) with up to 300 users. It provides enterprise-grade EDR capabilities but simplifies the configuration process. It is included in Microsoft 365 Business Premium or available as a standalone per-user add-on for other Business-class subscriptions.
• Defender for Endpoint Plan 1 (P1): A foundational version focused on "Next-generation protection" (antimalware) and attack surface reduction. It lacks the advanced EDR, sandboxing, and automated investigation tools found in higher tiers. It is included in Microsoft 365 E3/A3.
• Defender for Endpoint Plan 2 (P2): The full enterprise EDR suite, adding deep-dive forensic tools, advanced threat hunting via Kusto Query Language (KQL), and automated investigation and remediation (AIR). It is included in Microsoft 365 E5/A5/G5 or the E5 Security add-on.
• Defender for Servers: Unlike the user-based plans above, this is licensed via Microsoft Defender for Cloud (Azure) on a per-server, per-hour, or monthly basis to protect infrastructure-as-a-service (IaaS) and on-premises servers.

Key Licensing Facts and Comparisons

Common Misunderstandings

A frequent point of confusion is the difference between the "Microsoft Defender Antivirus" included for free with Windows and these paid subscriptions. The free version provides basic protection, whereas the licensed versions (Business/P1/P2) provide centralized management through the Microsoft Defender portal (security.microsoft.com), reporting, and the ability to roll back malicious changes. Additionally, note that Microsoft Defender for Business includes server protection for up to 60 servers as an optional "add-on" for existing user licensees, a unique bridge between SMB and Enterprise licensing models.

Related Terms

• Microsoft Defender XDR: The overarching portal and security suite that correlates alerts from Endpoint, Identity, Office 365, and Cloud Apps.
• Intune: Often used alongside Defender to deploy the sensor and enforce security policies (like BitLocker or Firewall rules).
• Microsoft 365 E5 Security: The specific "step-up" SKU that adds Defender for Endpoint P2 to an E3 base.

What this means when buying

When reviewing a quote or Enterprise Agreement (EA), look for these terms under the "Security" or "Microsoft 365" sections. If you are under 300 users, Microsoft 365 Business Premium is almost always the most cost-effective way to acquire Defender for Business. For larger organizations, if you require proactive "Threat Hunting" or advanced automation to reduce the workload on your IT staff, you must budget for Plan 2. Organizations migrating from third-party EDR tools should verify if their existing Microsoft 365 E3/E5 licenses already grant these rights before purchasing redundant third-party renewals. Note that these are per-user licenses; each user can typically onboard up to five concurrent devices.

Need this in a quote?

Our team translates glossary concepts into concrete licenses, part numbers and price lists.