Microsoft Defender for Business is Microsoft's endpoint security for companies with up to 300 users: it is built on Defender for Endpoint, includes endpoint detection and response (EDR) with automated investigation, and comes with Microsoft 365 Business Premium or costs $3.00 per user per month on its own, paid yearly, as of October 2026. Defender for Endpoint is the enterprise line, sold as Plan 1, which is prevention without EDR, and Plan 2, which adds EDR, threat hunting and six months of data, with no user cap. Under 300 users, Defender for Business is the usual choice; Plan 2 earns its price when someone will use the hunting tools or the company outgrows the cap.
The features are only half the decision. Licensing rules decide the rest: the 300-user line, how servers are licensed, and what happens when one tenant holds both products. If you are also weighing other vendors, read Defender for Business vs CrowdStrike vs SentinelOne; for the add-on that brings Defender for Endpoint Plan 2 into Business Premium, see our review of the Defender Suite for Business Premium.
What is the difference between Defender for Business and Defender for Endpoint?
Microsoft says Defender for Business includes the features of Defender for Endpoint Plan 1, some features of Plan 2 and a few of its own for smaller companies, such as wizard-driven setup and simplified firewall and antivirus settings for Windows. The comparison on Microsoft Learn is the reference; this is the decision version:
| Defender for Business | Defender for Endpoint Plan 1 | Defender for Endpoint Plan 2 | |
|---|---|---|---|
| What it is | Endpoint security for small and medium businesses, built on Defender for Endpoint | Enterprise prevention: next-generation antivirus and attack surface reduction | Enterprise prevention plus detection, investigation and hunting |
| What it covers | Next-generation protection, attack surface reduction, EDR, automated investigation and remediation, automatic attack disruption and core vulnerability management, on Windows, Mac, iOS and Android | Next-generation protection, attack surface reduction rules, device control, endpoint firewall, network protection and application control; no EDR | Everything in Plan 1, plus EDR, automated investigation, threat analytics, vulnerability management, sandbox analysis, advanced hunting and six months of data retention |
| Size limit | Up to 300 users, five client devices per user license | None | None |
| Who runs it | An IT generalist or a provider, using default policies and setup wizards | An IT team, with detection handled by another product | A security analyst or managed service that will use hunting and the longer history |
| Who it fits | Companies under 300 users, especially those already on Business Premium | Larger companies that want Microsoft's prevention layer, for example through Microsoft 365 E3 | Companies over 300 users, or smaller ones with a security function |
| Cost drivers | Included in Business Premium; $3.00 per user per month on its own; servers extra | Included in Microsoft 365 E3; no standalone price on Microsoft's product page | Included in Microsoft 365 E5 and the Defender Suite add-ons; no standalone price on Microsoft's product page |
| Effort | Low to set up; someone still has to read the alerts | Low, because detection work happens elsewhere | Highest: the extra tools pay off only if someone uses them |
What does Defender for Business leave out?
Compared with Plan 2, three things. Plan 2 keeps six months of device data and offers 30 days of advanced hunting, a query tool over raw device telemetry; Defender for Business does neither. Microsoft lists its Microsoft Threat Experts service under Plan 2 only. And Defender for Business keeps configuration simple on purpose: Microsoft's Defender for Business FAQ says it supports one web content filtering policy per organization, and that attack surface reduction rules and controlled folder access are configured in the Intune admin center rather than in Defender for Business itself.
For a 40-person firm those gaps rarely matter day to day, because advanced hunting pays off for an analyst who writes queries, not for an office manager. What a small company does need is EDR, and Defender for Business has it. Defender for Endpoint Plan 1 does not, which surprises companies on Microsoft 365 E3 that assume they own detection and response.
Can one tenant mix Defender for Business and Defender for Endpoint?
No, and growing companies run into this. Microsoft's FAQ says Defender for Business does not support mixed licensing: a tenant with Defender for Business through Business Premium and Defender for Endpoint Plan 2 for some users defaults to the Defender for Business experience for everyone. Its example is 80 Business Premium users with Microsoft 365 E5 Security added for 30 of them; all of them stay on Defender for Business. To get the Plan 2 experience, every user needs a Plan 2 license, and then you ask Microsoft Support to switch the organization.
The $10 Defender Suite for Business Premium also includes Defender for Endpoint Plan 2, so ask how this rule applies before buying it for only part of the staff.
What happens when a company passes 300 users?
Defender for Business and Business Premium are both designed for up to 300 users. Past that, Microsoft recommends moving everyone to a subscription that includes Defender for Endpoint, typically at renewal: Microsoft 365 E5, which includes Plan 2 and Defender for Office 365 Plan 2; Microsoft 365 E3, which includes Plan 1; or Defender for Endpoint Plan 1 or 2 on its own. Choosing E3 means choosing Plan 1, so a company that renews into E3 without a plan for EDR gives up the detection and response it had under Business Premium.
How do servers change the choice?
Neither product covers servers by default. Defender for Business has a servers add-on: one license for each Windows Server or Linux instance, priced at $3 per server instance in Microsoft's FAQ as of October 2026, available to tenants with at least one paid Business Premium or Defender for Business license, and capped at 60 per subscription. Past 60, Microsoft points to Defender for Endpoint for Servers or Defender for Servers Plan 1 or Plan 2, part of Defender for Cloud, which also work alongside Defender for Business. Enterprise tenants license servers through those same products, one license per server or virtual machine.
Which fits a small team?
These situations are illustrative, not client stories:
- A 25-person office on Business Premium with no IT staff. Use the Defender for Business you already own, turn every protection on, and spend the money on someone to watch it rather than on a second product.
- A 60-person firm on Business Standard. Defender for Business on its own adds EDR at $3.00 per user per month. Business Premium also brings Defender for Office 365 Plan 1 and data loss prevention for email and files, so price both before choosing.
- A 280-person company opening another location. Plan the license move before you cross 300 users. Renewing into Microsoft 365 E3 without an EDR plan would drop you from Defender for Business to Plan 1.
- A company with a security analyst on staff. Plan 2, through Microsoft 365 E5 or a Defender Suite, gives that person advanced hunting and six months of history. License every user, or the tenant stays on the Defender for Business experience.
- A small office with a few Linux servers. Add a Defender for Business servers license for each server instance; more than 60 servers needs the enterprise server products.
What does each cost?
Microsoft's list prices, as of October 2026, all paid yearly:
- Defender for Business: $3.00 per user per month on its own, per the Defender for Business product page, which lists Microsoft 365 Business Premium, with Defender for Business included, at $22.00.
- Defender for Business servers: $3 per server instance, up to 60.
- Defender for Endpoint Plan 1 and Plan 2: no standalone price on Microsoft's Defender for Endpoint page. Plan 1 comes with Microsoft 365 E3 and Plan 2 with Microsoft 365 E5, and that page lists the Microsoft Defender Suite, which includes Plan 2, at $12.00 per user per month for Microsoft 365 E3 customers.
- Defender Suite for Business Premium: $10.00 per user per month on top of Business Premium, up to 300 users, with Defender for Endpoint Plan 2, Defender for Office 365 Plan 2, Entra ID P2 and more, per Microsoft's suite page.
The license is only part of the cost. Rolling Defender out through Intune, keeping every device onboarded, tuning attack surface reduction rules so line-of-business software keeps working, and reading the alerts are the other lines, whichever product you choose.
How does NetSys run Defender for its clients?
When a client runs Defender, our managed detection and response service covers what the license does not. We check which licenses the tenant already holds before anything is bought, roll Defender out through Intune, enable and verify attack surface reduction rules, tamper protection and cloud-delivered protection, and report unenrolled machines and stale sensors every month. NetSys engineers triage every alert, weekends and holidays included, isolate a compromised device while keeping our management channel open, and write up the root cause. Each client has a documented escalation path, and the agreement runs month to month.
Book a call with a NetSys engineer to find out which Defender licenses your tenant already holds and what they cover.
Frequently asked questions
Is Defender for Business the same as Defender for Endpoint?
No, but it is built on it. Microsoft describes Defender for Business as endpoint security based on Defender for Endpoint, with Plan 1's features, some of Plan 2's and simpler setup, for companies with up to 300 users. Defender for Endpoint is the enterprise line, sold as Plan 1 and Plan 2 with no user cap.
Does Defender for Endpoint Plan 1 include EDR?
No. Plan 1 covers prevention: next-generation antivirus, attack surface reduction rules, device control, firewall and network protection. Endpoint detection and response, automated investigation and threat hunting are in Plan 2. Defender for Business includes EDR, so a small company on Business Premium can have more detection than a larger one on Plan 1.
What is the difference between Defender for Business and Defender for Endpoint Plan 2?
Both include EDR, automated investigation and remediation, automatic attack disruption and core vulnerability management. Plan 2 adds advanced hunting over 30 days of data, six months of retention and Microsoft Threat Experts, and it has no 300-user cap.
What affects cost, implementation and support?
Cost depends on the Microsoft plan you already own, the number of users and servers, and whether everyone needs Plan 2. Implementation depends on how devices are managed: if they are already in Intune, onboarding and the attack surface reduction settings run from there. Support depends on who reads the alerts, which no Defender license includes: a staff member, a Microsoft managed service on enterprise plans, or a provider such as NetSys.
Can a company with more than 300 users use Defender for Business?
It is not designed for it. Microsoft built Defender for Business for up to 300 users and recommends a subscription that includes Defender for Endpoint for everyone once a company passes that size, usually at renewal.
Discuss managed detection & response (mdr) for your business.
Tell us about your current systems, the result you need and your timeline. We will discuss the work, responsibilities and pricing before you decide on an engagement.