Microsoft Defender
The Defender family is made of separate products that protect different areas. First see which plan includes which product, then compare the plans for each area.
Which Defender is in which plan?
Organizations using Business Premium can move to E5-level security with the Defender Suite for Business Premium add-on.
| Feature | Business Premium | Office 365 E3 | Microsoft 365 E3 | Office 365 E5 | Microsoft 365 E5 | Microsoft 365 E7 |
|---|---|---|---|---|---|---|
| Endpoint | ||||||
| Defender for Business[2] | – | – | – | – | – | |
| Defender for Endpoint P1[1] | – | – | Included in P2 | Included in P2 | ||
| Defender for Endpoint P2[1] | – | – | – | |||
| Email and collaboration | ||||||
| Defender for Office 365 P1[8]Included in E3 plans from July 1, 2026. | Included in P2 | Included in P2 | Included in P2 | |||
| Defender for Office 365 P2[1] | – | – | ||||
| Identity and cloud apps | ||||||
| Defender for Identity[1] | – | – | – | |||
| Defender for Cloud Apps[11]Microsoft 365 E3 only includes Cloud App Discovery. | – | Discovery only | ||||
Endpoint security
| Feature | Defender for BusinessUp to 300 users | Defender for Endpoint P15 devices per user | Defender for Endpoint P25 devices per user |
|---|---|---|---|
| Protection | |||
| Next-generation antivirus[2]Next-generation protection | |||
| Attack surface reduction[2]Attack surface reduction | |||
| Device control[3]USB and peripheral control | |||
| Simplified firewall and antivirus configuration for Windows[2] | – | – | |
| Detection and response | |||
| Endpoint detection and response (EDR)[2] | Simplified | – | |
| Automated investigation and remediation (AIR)[2] | – | ||
| Automatic attack disruption[2]Automatic attack disruption | – | ||
| Threat Analytics[2] | Simplified | – | |
| Advanced hunting[2]6 months of data retention | – | – | |
| Monthly security summary report[2] | – | ||
| Vulnerability management (core)[2] | – | ||
| Vulnerability management (premium)[10]Security baselines, blocking vulnerable applications | – | – | |
| Coverage and services | |||
| Server protection[4]An additional license is required for Windows and Linux servers. | Up to 60 servers | ||
| Microsoft Defender Experts[12]Managed detection and response service | – | ||
Email and collaboration security
| Feature | Exchange Online ProtectionIn every cloud mailbox | Defender for Office 365 P1 | Defender for Office 365 P2 |
|---|---|---|---|
| Protection | |||
| Malware and spam protection[7]Anti-malware, anti-spam, spoof intelligence, quarantine | |||
| Zero-hour auto purge (ZAP)[7]For email; for Teams in P1 and above | Email | Email and Teams | Email and Teams |
| Impersonation protection[6]Phishing protection against user and domain impersonation | – | ||
| Safe Links[6]Time-of-click link checking in email, Office and Teams | – | ||
| Safe Attachments[6]Email attachments and SharePoint, OneDrive, Teams files | – | ||
| Investigation and response | |||
| Threat investigation tool[6] | Message trace, reports | Real-time detections | Threat Explorer |
| Priority account protection[7]Extra protection for critical accounts such as administrators | – | – | |
| Campaign views and Threat Trackers[6] | – | – | |
| Automated investigation and response (AIR)[6] | – | – | |
| Attack simulation training[6]Phishing simulations and user training | – | – | |
Server security (Defender for Cloud)
| Feature | Defender for Servers P1Azure consumption model | Defender for Servers P2Azure consumption model |
|---|---|---|
| Features | ||
| Defender for Endpoint (including EDR)[9] | ||
| Multicloud and on-premises[9]Azure, AWS, GCP, on-premises | ||
| Agent-based vulnerability scanning[9] | ||
| Agentless vulnerability and malware scanning[9] | – | |
| File integrity monitoring[9]File integrity monitoring | – | |
| Just-in-time VM access[9]Azure and AWS | – | |
| Free data ingestion[9]500 MB per day | – | |
- Included
- Available as add-on
- Not confirmed in official sources
- Not included
- Microsoft 365 E5 Security has been renamed Microsoft Defender Suite.
- Microsoft 365 E7 has the same Defender coverage as E5.
- Defender for Business includes all Defender for Endpoint P1 capabilities, some P2 capabilities and some capabilities designed for small businesses. It is included in Business Premium; organizations with up to 300 users on Business Basic, Business Standard or Office 365 E1 can also buy it standalone.
- Defender for Business does not support mixed licensing. If Business Premium and Defender Suite are used together, the default experience is Defender for Business; to switch to the Defender for Endpoint P2 experience, all users must be licensed for P2 and a switch must be requested from Microsoft Support.
- The information that Defender for Office 365 P1 is included in Office 365 E3 is based on the 2026 packaging announcement; some service description pages may not yet be updated.
- Defender for Servers is not included in any Microsoft 365 plan; it is billed by usage through Azure.
- Defender Experts services are purchased separately with every plan; Microsoft 365 E5 only meets the prerequisite.
Sources
- Microsoft Defender service description
- What is Microsoft Defender for Business?
- Device control overview
- Defender for Business FAQ
- Defender Suite for Business Premium
- Microsoft Defender for Office 365 service description
- Why you need Microsoft Defender for Office 365
- 2026 Microsoft 365 packaging and pricing updates
- Defender for Servers overview
- Compare Defender Vulnerability Management plans
- Defender for Cloud Apps and Cloud App Discovery
- Defender Experts overview
Last updated: 16 October 2026