defender for business plan 1 vs plan 2

Defender for Endpoint P1 & P2 Pricing, Features, and Comparison

Why are they splitting, defender for endpoint plan 1 and plan 2 pricing comparison, defender for endpoint plan 1 and plan 2 feature comparison, included in plan 1, attack surface reduction rules, ransomware mitigation, device control, web protection, network protection, network firewall, application control, included in plan 2, endpoint detection and response, automated investigation and remediation, threat and vulnerability management, threat analytics, microsoft threat experts, integrations, learn more about defender for endpoint.

Microsoft is taking steps to bring the best cybersecurity features to more businesses. One of their flagship products for enterprise cybersecurity, Defender for Endpoint, is being split into two separate options. This will allow the software to have a broader appeal, and further its reach. In order to decide which is best for your business, you’ll need to understand the reason for the split and how the two options compare.

In its original form, Defender for Endpoint was a complete solution for the most demanding cybersecurity needs at large enterprises. This made the project a less attractive option for smaller companies who didn’t need all the features and couldn’t justify the price. Indeed, by splitting the product into a smaller subset of features, now known as Plan 1, Microsoft brings it to more organizations. Going forward, the full-featured version of Defender for Endpoint will be referred to as Plan 2.

Both plans of Defender for Endpoint are available as either a standalone offering or as a built-in feature of Microsoft 365. Before the split, businesses needed to purchase the more expensive E5 plan of Microsoft 365 to receive Defender for Endpoint as a built-in feature. Plan 2 of the product will remain a free offering for those who have purchased E5. However, the reduced cost of Plan 1 allows that option to be included as part of EC3.

Companies who don’t want or need all that Microsoft 365 has to offer can opt to purchase Defender for Endpoint as a standalone product. Purchased that way, the product costs $3 per user for Plan 1 and $5.20 per user for Plan 2.

The lower price afforded by the reduced feature set of Plan 1 means that Defender for Endpoint will now be an option for more businesses. But what exactly has been removed, and what remains? Let’s take a look at the features that remain in Plan 1 and those that remain unique to Plan 2.

Defender for Endpoint plan 1 contains the following subset of Defender for Endpoint’s full feature set:

Certain software behaviors are used most often in risky code. While there are usually legitimate uses as well, these behaviors show up most commonly in malware. By preventing these behaviors from running, Defender for Endpoint reduces the number of surfaces your systems can be attacked by.

Malicious code often takes over important files and refuses to grant you access to them unless you pay a ransom. Defender for Endpoint can control which processes can access important folders, so ransomware never gets the access needed to hold your data hostage.

If you’ve watched any spy movies, you’ve likely seen a character insert a USB drive into a computer to insert malicious code. This is a real threat. Indeed, Defender for Endpoint helps you prevent it by limiting the access that unauthorized peripherals have.

There are two threats that unlimited access to the internet allows for. First, and most importantly, there are a number of phishing sites, exploit sites, and other malicious websites in the wild. Defender for Endpoint automatically blocks access to known security threats. Secondly, you can block access to other risky sites by category, such as adult content, sites that may open your organization to legal liability, or leisure sites that may reduce workforce productivity.

Web protection provides extensive support to protect your organization’s internet-enabled applications from accessing malicious web content. However, it only works on certain web-enabled applications, such as Microsoft Edge. Network protection extends the capability of web protection to the operating system level, preventing applications that secretly access the internet from harming your machine.

The network firewall allows you to take more custom control over what traffic is allowed to and from your network. With a set of rules that you create, you can, then, reduce the risk of network security threats and safeguard sensitive data.

Malicious applications are a major threat vector for cyberattacks. With application control, Defender for Endpoint can limit the applications that are allowed to run on your system. It can also work on a variety of rules, including the presence of codesigning certificates, application reputation, launching process, and more.

Defender for Endpoint Plan 2 includes everything in Plan 1, as well as the following features:

Defender for Endpoint brings in advanced threat protection by detecting, investigating, and responding to endpoint threats that have made it past the first level of security checks. With a query-based tool, you can, indeed, proactively find breaches and create custom automatic detections.

Alerting a human to potential threats so they can respond is a good first step, but still allows threats to persist until manual intervention can occur. Defender for Endpoint’s automated investigation and remediation shut down threats within minutes.

In a large organization, the responsibilities of threat detection and remediation can be spread across several teams. With threat and vulnerability management, coordination between the various teams enhances in much the same way that project management tools enhance productivity in other areas. This then reduces the time needed to respond to threats.

Big data has enabled advanced algorithms to make our lives easier in many ways, but detecting patterns that humans can’t and automatically responding to them. The advanced threat analytics Defender for Endpoint captures provides the data Defender needs to identify threats and generate alerts faster.

Microsoft’s team of threat experts is at your disposal with Defender for Endpoint Plan 2. You can engage with a security expert from within the Defender Security Center to get timely and accurate answers. In addition, you receive managed threat monitoring and analysis for quicker alerts to security threats that make it past the other defenses.

Defender for Endpoint Plan 2 integrates with the applications your organization uses on a daily basis, including:

• Azure Defender
• Azure Sentinel
• Microsoft Cloud App Security
• Microsoft Defender for Identity
• Microsoft Defender for Office
• Lastly, Skype for Business

Agile IT is a Microsoft Gold Partner with 16 Gold competencies including Security and Windows management, and seventeen years of experience in licensing, migrating, and managing Microsoft Cloud Environments. Thus, to find out more about how you can reduce license costs while expanding and simplifying security, schedule a consultation with a cloud advisor today  to schedule a consultation with a cloud advisor today.

Published on: Dec 21, 2021 .

How can we help?

Let's start a conversation

Don’t want to wait for us to get back to you?

Microsoft Defender for Business vs. Microsoft Defender for Endpoint

With the increasing prevalence of cyberattacks targeting businesses of all sizes, it’s crucial for organizations to arm themselves with robust cybersecurity solutions. Microsoft, a leader in the tech industry, offers two key endpoint security solutions tailored to meet the diverse needs of businesses: Microsoft Defender for Business and Microsoft Defender for Endpoint. This blog post delves into the specifics of each solution, highlighting their capabilities and differences to help you make an informed decision on which is best suited for your organization.

Endpoint Security Essentials

Microsoft defender for business: tailored for small and medium-sized businesses.

Designed specifically for small and medium-sized businesses (up to 300 employees), Microsoft Defender for Business is a comprehensive endpoint security solution aimed at protecting organizations from a variety of threats including ransomware, malware, phishing, and more. It boasts an array of powerful security features:

• Threat and Vulnerability Management: Provides real-time insights and management of software vulnerabilities.
• Attack Surface Reduction: Secures vulnerable points in your organization against cyberthreats.
• Next Generation Protection: Strengthens the security perimeter of your network.
• Endpoint Detection & Response: Enables the detection, investigation, and response to advanced threats.
• Automated Investigation & Remediation: Streamlines alert management through automation.

Comparing Capabilities: Standalone vs. Business Premium Subscription

While the standalone version of Defender for Business offers robust endpoint security, organizations seeking to maximize their security capabilities should consider the Microsoft 365 Business Premium subscription. This package enhances Defender for Business with additional features like Microsoft Intune, Azure Active Directory P1, and more, providing a more comprehensive security solution.

Microsoft Defender for Endpoint: For Enterprises

In contrast, Microsoft Defender for Endpoint caters to larger enterprises with more than 300 employees and is included in Microsoft 365 enterprise plans. It offers two plans, P1 and P2, with the latter encompassing all the capabilities of Defender for Business plus additional features such as:

• Threat Hunting & Data Retention: Enables proactive threat hunting with advanced tools and extended data retention.
• Microsoft Threat Experts: Offers expert-level monitoring and analysis to detect and respond to critical threats effectively.

Key Differences Between Defender for Business and Defender for Endpoint P2

While both solutions share many features, several key differences set them apart:

• Advanced Hunting: Unlike Defender for Business, Defender for Endpoint P2 includes advanced hunting capabilities and a six-month data retention policy for deeper threat investigation.
• Incident Actions: Defender for Endpoint P2 offers more extensive investigation features, such as the ability to download files, submit them for deep analysis, and consult with Defender Experts.
• Microsoft Threat Experts: This managed threat hunting service is exclusive to Defender for Endpoint P2, providing SOCs with critical insights and expert consultation to tackle sophisticated threats.

Conclusion: Choosing the Right Endpoint Security Solution

Choosing between Microsoft Defender for Business and Microsoft Defender for Endpoint depends on the specific needs and scale of your organization. For small and medium-sized businesses seeking to bolster their security infrastructure, Defender for Business offers a solid foundation with essential security features. However, larger enterprises requiring advanced security capabilities and support should consider Defender for Endpoint P2 for its comprehensive coverage, including threat hunting, extended data retention, and access to Microsoft Threat Experts. By evaluating your organization’s needs, you can select the endpoint security solution that best aligns with your goals and ensures the protection of your digital assets.

Ready to elevate your business’s cybersecurity but not sure which Microsoft Defender plan suits you best? Don’t navigate these crucial decisions alone! IP Consulting Inc is here to guide you through the maze of options to ensure your business is protected with the best possible endpoint security solution. Our team of experts specializes in understanding your unique needs and matching them with the right security measures. Contact us today to learn more about how we can help secure your digital environment with Microsoft Defender for Business or Microsoft Defender for Endpoint. Let’s work together to tailor a security plan that not only meets your current needs but also scales with your business’s growth.

• Unified Communication
• Disaster Recovery
• Cloud Services
• Project-Based Initiatives
• Hardware and Software
• State and Local Governments
• Case Studies

Latest Posts

• Why Small Businesses Should Consider Managed Service Providers
• The Ultimate Guide to Upgrading to Windows 11: Features, Performance, and Security Insights
• Enhancing Domain Name Security: Top 10 Effective Tips
• How Attackers Weaponize Generative AI: The Dual Threats of Data Poisoning and Manipulation
• The Essential Guide to Backup and Disaster Recovery in the Digital Age

• Need help? Real people, not bots. 24/7/365.
• 1-866-716-2040

MICROSOFT DEFENDER FOR ENDPOINT PLANS AND PRICING

Microsoft Defender for Endpoint is a comprehensive enterprise endpoint security platform for preventative protection, post-breach detection, automated investigation, and response. Microsoft Defender for Endpoint is available in two plans, Endpoint Plan 1 and Endpoint Plan 2, which are available either as standalone services or a part of Microsoft 365.

As a standalone SKU, Microsoft Defender for Endpoint Plan 1 users can enable the service on up to five concurrent devices. Customers with Microsoft 365 E3/A3 have Microsoft Defender for Endpoint P1 capabilities with the same per-user model and device entitlements as the standalone SKU.

Microsoft Defender for Endpoint Plan 2 is also available as a standalone license. Additionally, it is a part of Windows 10/11 Enterprise E5 and Windows 10/11 Enterprise A5, apart from Microsoft 365 E5/A5/G5 plans.

• ✓ Free consultation call
• ✓ 24/7 expert support
• ✓ Talk to Microsoft-certified experts

ALL OUR MICROSOFT DEFENDER FOR ENDPOINT PLANS INCLUDE

Free end-user support, 24/7 support via phone, chat, email, savings on it costs, annual commitment, fully automatic updates, regular data backups, security and reliability, tier-1 partner expertise, faq - your questions we got answers, how can apps4rent help with microsoft defender for endpoint.

As a Microsoft Gold Partner for Cloud Platform and Cloud Productivity, Apps4Rent can help with Microsoft Defender for Endpoint licensing, deployment, and customization. Our experts provide end-to-end assistance in deploying, starting with the preparation of the environment through the setup and onboarding process.

How is Microsoft Defender for Endpoint different from Windows Defender?

Windows Defender is built into Windows 10/11 and is primarily used as a firewall and anti-virus solution. Microsoft Defender for Endpoint is a cloud-based security platform that connects Windows Defender with Microsoft’s advanced threat intelligence system to provide comprehensive security to all enterprise endpoints.

Can Microsoft Defender for Endpoint (MSDE) protect servers?

Yes, Microsoft Defender for Endpoint (MSDE) can protect servers and provide advanced attack detection and investigation capabilities seamlessly through the Microsoft 365 Defender console. Admins have deep insights into server activities, coverage for kernel and memory attack detection, and respond to actions quickly.

How to onboard endpoints to Microsoft Defender for Endpoint?

The process involved in onboarding endpoints to Microsoft Defender for Endpoint depends on the type of platform. While Microsoft Endpoint Manager can be used to onboard Windows, iOS, Android, and macOS devices, it does not support Linux endpoints. Contact our experts for Defender for Endpoint deployment assistance.

Need help in implementing MS Defender for Endpoint?

Our experts can help you!

Schedule a meeting?

Submit Your Requirements

Understanding the Differences: Defender for Office 365 Plan 1 vs Plan 2 in Cybersecurity

Microsoft Defender for Office 365, formerly known as Office 365 Advanced Threat Protection (ATP), is a cloud-based suite of tools designed to protect mailboxes, files, online storage, and applications against threats. This blog post aims to explain the differences between Defender for Office 365 Plan 1 (P1) and Plan 2 (P2), in response to the key phrase 'defender for office 365 p1 vs p2'.

In today's digital age, ensuring the security of your organizational data is not only essential, but it's also a significant challenge. New threats are emerging every day, and sophisticated techniques are used to compromise systems and steal information. To counteract these threats, Microsoft provides powerful solutions, such as Defender for Office 365. Our blog aims to detail the various features offered in the two different plans, highlighting their contrasts and similarities, and helping organizations decide on the best plan for their needs.

Defender for Office 365 Plan 1

Defender for Office 365 P1 provides robust protection and enables organizations to defend their data against threats in real-time. It offers features like Safe Attachments, Safe Links, and anti-phishing capabilities. Safe Attachments protect against unknown and sophisticated attacks by isolating potentially harmful attachments in a sandbox environment before they reach the user's inbox. While Safe Links protect against malicious URLs by providing time-of-click verification of web addresses.

With P1, in-built anti-phishing capabilities provide an extra security layer to recognize and prevent phishing attacks. P1 also includes automated investigation and response capabilities which save time by automating the investigation of threats and suggesting appropriate response actions. Moreover, with P1, organizations can assess the configuration of Office 365 for settings that might make the organization more vulnerable to attacks.

Defender for Office 365 Plan 2

Moving on to Defender for Office 365 Plan 2, P2 includes all the features of P1 and several additional tools that help organizations achieve even greater granular control of their security and more advanced threat protection. One of the significant additions in Plan 2 is Threat Tracker guidance, which provides insights into the current threat landscape. It also includes threat exploration and threat investigation tools to provide a more in-depth look into threats.

P2 also includes an enhanced version of automated investigation and response capabilities seen in P1. This feature provides an in-depth evaluation of an event, augmenting security teams with insights to help them decide on the next course of action. There is also advanced Threat Protection reports, and sophisticated policies and insights to provide a robust, unified, and comprehensive security solution.

Comparing the Two

The key differences between 'defender for office 365 p1 vs p2' lie in the addition of advanced security features in Plan 2, specifically around threat investigation and remediation. P2 provides more granular control to identify suspicious activities, investigate threats effectively, and respond quickly and accurately. These added features translate to a more robust security posture for organizations that have sensitive data or face advanced persistent threats.

While P1 provides essential protection, P2 takes it a step further by facilitating proactive threat hunting, with more detailed reports and enhanced automated investigation and response capabilities. So, organizations need to evaluate their security requirements carefully and choose the plan that best meets their needs.

In conclusion, while both Defender for Office 365 P1 and P2 offer robust and powerful tools to guard your organization against threats, the choice between the two will depend on your organization's specific needs and the level of sophistication of the looming threats. P1 provides an optimal and economical solution for smaller organizations or those with less sensitive data. Meanwhile, P2 offers advanced features suitable for organizations with extensive security requirements or those dealing with sensitive data. Remember, security is not a one-size-fits-all approach. Your choice should be influenced by your unique circumstances and the specific needs of your organization.

Related services

Get in touch.

This browser is no longer supported.

Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.

Select a Defender for Servers plan

• 9 contributors

This article helps you select the Microsoft Defender for Servers plan that's right for your organization.

Defender for Servers is one of the paid plans provided by Microsoft Defender for Cloud .

Before you begin

This article is the fourth article in the Defender for Servers planning guide. Before you begin, review the earlier articles:

• Start planning your deployment
• Understand where your data is stored and Log Analytics workspace requirements
• Review access and role requirements

Review plans

You can choose from two paid plans:

Defender for Servers Plan 1 is entry-level and must be enabled at the subscription level. Features include:

Foundational cloud security posture management (CSPM) , which is provided free by Defender for Cloud.

• For Azure virtual machines and Amazon Web Services (AWS) and Google Cloud Platform (GCP) machines, you don't need a Defender for Cloud plan enabled to use foundational CSPM features.
• For on-premises server, to receive configuration recommendations machines must be onboarded to Azure with Azure Arc, and Defender for Servers must be enabled.

Endpoint detection and response (EDR) features that are provided by Microsoft Defender for Endpoint Plan 2 .

Defender for Servers Plan 2 provides all features. The plan must be enabled at the subscription level and at the workspace level to get full feature coverage. Features include:

• All the functionality that's provided by Defender for Servers Plan 1.
• More extended detection and response (XDR) capabilities.

Plan 1 and Plan 2 for Defender for Servers aren't the same as Plan 1 and Plan 2 for Defender for Endpoint.

Plan features

Once a plan is enabled, a 30-day trial period begins. There is no way to stop, pause, or extend this trial period. To enjoy the full 30-day trial, make sure to plan ahead to meet your evaluation purposes.

Select a vulnerability assessment solution

A couple of vulnerability assessment options are available in Defender for Servers:

Microsoft Defender Vulnerability Management : Integrated with Defender for Endpoint.

Available in Defender for Servers Plan 1 and Defender for Servers Plan 2.

Defender Vulnerability Management is enabled by default on machines that are onboarded to Defender for Endpoint.

Has the same Windows , Linux , and network prerequisites as Defender for Endpoint.

No extra software is required.

Microsoft Defender Vulnerability Management Add-on capabilities are included in Defender for Servers Plan 2. This provides consolidated inventories, new assessments, and mitigation tools to further enhance your vulnerability management program. To learn more, see Vulnerability Management capabilities for servers .

Defender Vulnerability Management add-on capabilities are only available through the Microsoft Defender 365 portal .

Qualys vulnerability scanner : Provided by Defender for Cloud Qualys integration.

• Available only in Defender for Servers Plan 2.
• A great fit if you're using a third-party EDR solution or a Fanotify-based solution. In these scenarios, you might not be able to deploy the Defender for Endpoint for vulnerability assessment.
• The integrated Defender for Cloud Qualys solution doesn't support a proxy configuration, and it can't connect to an existing Qualys deployment. Vulnerability findings are available only in Defender for Cloud.

After you work through these planning steps, review Azure Arc and agent and extension requirements .

Coming soon: Throughout 2024 we will be phasing out GitHub Issues as the feedback mechanism for content and replacing it with a new feedback system. For more information see: https://aka.ms/ContentUserFeedback .

Submit and view feedback for

Additional resources

Microsoft Defender for Endpoint: Choosing Between Plan 1 and Plan 2

Microsoft Defender for Endpoint—previously Microsoft Defender Advanced Threat Protection—is a cloud-powered security platform that promises top-of-the-line security against advanced and sophisticated threats. Made for enterprise, it accommodates a variety of operating systems.

There are currently two plans available for Microsoft Defender for Endpoint: Plan 1 and Plan 2. Both plans support Windows and non-Windows platforms, as well as integrate with various Microsoft solutions.

P1 offers core features, like next-generation protection, attack surface reduction, and centralized management. According to Microsoft, this plan provides foundational security against threats, like ransomware and malware. It also helps organizations to establish their Zero Trust Security.

P2 offers advanced features on top of the core P1 features. They include device discovery, automated investigation, advanced hunting, threat analytics, and sandboxing. P2 provides enterprises a more complete endpoint security with more complete capabilities. Compare plans further .

Available for P2 customers is “Microsoft Defender Vulnerability Management.” It is available as an add-on or standalone option. Key features include inventory of devices, browser plug-ins assessment, security baseline assessment, and more. The standalone option comes with the full set of features that allow it to further assess vulnerabilities, prioritize according to risk, and provide recommendations to mitigate risk.

Microsoft offers free trial options for both plans to try out before purchase. Settling on purchase, you will find the pricing is per user per month, which covers up to five devices at the same time for each user.

Microsoft Defender for Endpoint P1 is already available to clients subscribed to a Microsoft 365 E3 enterprise plan. Similarly, Microsoft Defender for Endpoint P2 is available to those with a Microsoft 365 E5 plan. Otherwise, Microsoft recommends that organizations turn to their Microsoft account team or cloud service provider to help purchase a license, and provides a deployment manual .

As a service provider, Cloud Ascent can help you plan the successful deployment of Microsoft Defender for Endpoint and take full advantage of its capabilities. Contact us today and let’s get started!

Share This Article

Related posts.

How to Prevent and Reduce the Risk of Cybercrimes Using Microsoft Security Solutions

Get protected with the new Microsoft Defender for Cloud Apps

Microsoft Defender for Endpoint

Help secure endpoints with industry-leading, multiplatform detection and response.

Disrupt ransomware on any platform

Apply AI-powered endpoint security across Windows, macOS, Linux, Android, iOS, and IoT devices.

Outmaneuver sophisticated adversaries with AI

Stop cyberattacks such as ransomware and move at machine speed with industry-transforming AI that amplifies your security team’s strengths.

Boost prevention with global threat intelligence

Minimize vulnerabilities with a clear view of your cyberattack surface and adversaries, along with best practices for cyberthreat prevention.

Secure devices end to end

Help protect your multiplatform and IoT devices with a comprehensive, industry-leading next-generation antivirus, detection, and response solution at the core of Microsoft Defender XDR.

Watch the video

Learn how to secure your devices and disrupt ransomware across all platforms with Defender for Endpoint.

Defender for Endpoint key capabilities

Disrupt ransomware early in the cyberattack chain

Automatically disrupt ransomware cyberattacks by blocking lateral movement and remote encryption in a decentralized way across all your devices.

Move at machine speed with Copilot for Security

Use built-in, security-specific generative AI to rapidly investigate and respond to incidents, prioritize alerts, and learn new skills. Copilot is now embedded in Microsoft Defender XDR for Copilot customers.

Trick cyberattackers with auto-deployed deception

Automatically generate and disperse deception techniques at scale to expose cyberattackers with early-stage, high-fidelity signals.

Gain an unimpeded view of adversaries

Know your adversaries with more than 65 trillion daily signals from multiple sources, including the largest clouds, security organizations, 1.5 billion devices, internet graphs, and more than 10 thousand experts in 72 countries.

Elevate your security posture

Improve your security configuration with prioritized recommendations from Microsoft Secure Score.

Configure flexible controls for your enterprise

Balance protection and productivity with granular controls including settings, policies, web and network access, cyberthreat detection, and automated workflows.

Leave no device undetected

See and manage your cyberattack surface from a single view across all managed and unmanaged Windows, macOS, Linux, iOS, Android™, IoT, and network devices.

Operate security and IT teams in tandem

Simplify security and IT collaboration using unified endpoint management to prevent confusion, misconfigurations, and potential security gaps.

Microsoft Copilot for Security is now generally available

Use natural language queries to investigate incidents with Copilot, now with integrations across the Microsoft Security suite of products.

Unified security operations platform

Secure your digital estate with the only security operations (SecOps) platform that unifies the full capabilities of extended detection and response (XDR) and security information and event management (SIEM).

Unified portal

Detect and disrupt cyberthreats in near real time and streamline investigation and response.

Microsoft Defender XDR

Achieve unified security and visibility across your clouds, platforms, and endpoints.

Microsoft Sentinel

Aggregate security data and correlate alerts from virtually any source with cloud-native SIEM.

Industry recognition

Microsoft Security is a recognized industry leader.

Microsoft is named a Leader in the 2023 Gartner® Magic Quadrant™ for Endpoint Protection Platforms. 1

Microsoft Defender for Endpoint is named a leader in The Forrester Wave™: Endpoint Security, Q4 2023. 2 ,  3

Microsoft is named a Leader in the IDC MarketScape reports for Worldwide Modern Endpoint Security across Enterprise, Midsize, and Small Businesses, 2024. 4

Microsoft Defender for Endpoint is named a leader in The Forrester Wave™: Endpoint Detection And Response Providers, Q2 2022. 2 , 5

Microsoft is ranked #1 for 2022 market share in corporate endpoint security in the IDC Worldwide Corporate Endpoint Security Market Shares 2022 report. 6

Microsoft leads in real-world detection in MITRE ATT&CK evaluation.

See what our customers are saying

Microsoft Defender for Endpoint is named a 2023 Tech Leader for Endpoint Detection and Response.

Microsoft Defender for Endpoint is named a 2023 Tech Leader for Endpoint Protection for Business.​

Microsoft Defender for Endpoint is ranked number one in the Endpoint Detection & Response Software category.​

Microsoft Defender for Endpoint is ranked number one in the Endpoint Protection Platforms category.​

G&J Pepsi-Cola

HCA Healthcare

Compare flexible purchase options.

Explore the comprehensive security capabilities in Microsoft Defender for Endpoint P1, included with Microsoft 365 E3, and Microsoft Defender for Endpoint P2, included with Microsoft 365 E5, including versions of these suites that do not include Microsoft Teams.

Microsoft Defender for Endpoint P1

Microsoft Defender for Endpoint P1 offers a foundational set of capabilities, including industry-leading antimalware, cyberattack surface reduction, and device-based conditional access.

Unified security tools and centralized management

Next-generation antimalware

Cyberattack surface reduction rules

Device control (such as USB)

• Endpoint firewall

Network protection

Web control/category-based URL blocking

Device-based conditional access

• Controlled folder access

APIs, SIEM connector, custom threat intelligence

Application control

Microsoft Defender for Endpoint P2

Microsoft Defender for Endpoint P2 offers all the capabilities in P1, plus endpoint detection and response, automated investigation and incident response, and cyberthreat and vulnerability management.

Includes everything in Endpoint P1, plus:

Endpoint detection and response

Deception techniques

Automated investigation and remediation

Cyberthreat and vulnerability management

Threat intelligence (cyberthreat analytics)

Sandbox (deep analysis)

Endpoint attack notifications 7

Related Microsoft Defender products

Protect against cyberthreats with best-in-class security from Microsoft.

Get integrated threat protection across devices, identities, apps, email, data, and cloud workloads.

Microsoft Defender Vulnerability Management

Reduce risk with continuous vulnerability assessment, risk-based prioritization, and remediation.

Microsoft Defender for Business

Discover enterprise-grade endpoint protection for small and medium businesses that's cost effective and easy to use.

Microsoft Defender for individuals

Get online security protection for individuals and families with one easy-to-use app. 8

Additional resources

Become a microsoft defender for endpoint expert.

Get training for security operations and security admins, whether you’re a beginner or have experience.

Watch episode one of The Defender’s Watch

Learn how to strengthen your security with evidence-based insights from experts protecting against modern threats.

Stay up to date

Get product news, configuration guidance, product tutorials, and tips.

Dive deeper into the product

Get technical details on capabilities, minimum requirements, and deployment guidance.

Frequently asked questions

What is microsoft defender for endpoint.

Defender for Endpoint is a comprehensive, cloud-native endpoint security solution that delivers visibility and AI-powered cyberthreat protection to help stop cyberattacks across Windows, macOS, Linux, Android, iOS, and IoT devices. Built on the industry’s broadest cyberthreat and human intelligence insights, it can seamlessly evolve your security with XDR-level alert correlation to automatically disrupt sophisticated cyberthreats such as ransomware. Defender for Endpoint provides visibility into devices in your environment, offers vulnerability management to help you better understand your cyberattack surface, and delivers endpoint protection, endpoint detection and response (EDR), mobile cyberthreat protection, and managed hunting in a single platform. With Defender for Endpoint, customers can discover and secure endpoint devices across a multiplatform enterprise.

Explore Defender for Endpoint documentation

How does the Defender for Endpoint antivirus capability work?

As a comprehensive endpoint protection solution, Defender for Endpoint includes Microsoft Defender Antivirus—next-generation protection that reinforces the security perimeter of your network. It detects and blocks known and evolving cyberthreats in real time across Linux, macOS, Windows, and Android devices. Microsoft Defender Antivirus includes:

• Real-time antivirus protection with always-on scanning that uses file and process-behavior monitoring and other heuristics. It also detects and blocks apps that are deemed unsafe but might not be detected as malware. 
• Cloud-delivered protection with near-instant detection and blocking of new and emerging cyberthreats.  

Microsoft Defender Antivirus provides full coverage for all MITRE ATT&CK tactics and techniques. It was awarded Best Advanced Protection 2022 by AV-TEST and achieved the highest rating in all major industry antivirus tests across enterprise and consumer evaluations, including AV Comparatives, SE Labs, and MRG Effitas.

• Get an overview of next-generation protection
• Learn more about Microsoft Defender Antivirus
• Learn how to enable and configure Microsoft Defender Antivirus features
• Learn more about cloud protection and Microsoft Defender Antivirus
• Explore the AV-TEST results

Does Defender for Endpoint only support the latest versions of Windows, iOS, and Linux?

Defender for Endpoint provides cross-platform coverage across Windows, iOS, and Linux. New features or capabilities are typically provided on operating systems that haven't yet reached the end of their support lifecycle. In line with industry best practices, Microsoft recommends the installation of the latest available security patches for any operating system. 

Explore supported Defender for Endpoint capabilities by platform

Do I need to use multiple consoles and agents to manage Microsoft Defender for Endpoint?

No. Security analysts manage Defender for Endpoint from the Microsoft Defender XDR portal—a single console for comprehensive endpoint protection, including vulnerability management, cyberthreat protection, and detection and response capabilities. 

For customers wanting to operate their security and IT teams in tandem, Defender for Endpoint provides a consistent, single source of truth—mirrored in Intune—for managing endpoint security settings across Windows, macOS, and Linux.

Customers who want to extend endpoint protection to multiple domains can avoid the extra integration steps often required by other endpoint protection vendors.

• Learn more about managing endpoint security policies
• Learn how to manage security settings for Windows, macOS, and Linux natively in Defender for Endpoint
• Learn more about XDR solutions from Microsoft

What is the difference between Microsoft Defender for Endpoint and Microsoft Defender for Office 365?

Microsoft Defender for Endpoint is a cloud-native endpoint security platform that provides visibility, cyberthreat protection, and EDR capabilities to stop cyberattacks across Windows, macOS, Linux, Android, iOS, and IoT devices. Microsoft Defender for Office 365 is a collaborative security solution that helps secure your email and Microsoft Teams environments with advanced protection against phishing, business email compromise, ransomware, and other cyberthreats. 

Learn more about Microsoft Defender for Office 365

Protect everything

Make your future more secure. Explore your security options today.

• [1] Gartner Magic Quadrant for Endpoint Protection Platforms, Peter Firstbrook, Chris Silva Evgeny Mirolyubov, Max Taggett, Franz Hinner, Nikul Patel, 31 December 2023. Gartner is a registered trademark and service mark and Magic Quadrant is a registered trademark of Gartner, Inc. and/or its affiliates in the U.S. and internationally and are used herein with permission. All rights reserved. Gartner does not endorse any vendor, product or service depicted in its research publications, and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner research publications consist of the opinions of Gartner’s research organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose.
• [2] Forrester, Forrester New Wave, and Forrester Wave are trademarks of Forrester Research, Inc.
• [3] The Forrester Wave™: Endpoint Security, Q4 2023. Paddy Harrington with Merritt Maxim, Angela Lozada, Christine Turley, October 2023.
• [4] IDC MarketScape: Worldwide Modern Endpoint Security for Small Businesses Vendor Assessment, 2024, Michael Suby, March 2024. IDC MarketScape: Worldwide Modern Endpoint Security for Midsize Businesses Vendor Assessment, 2024, Michael Suby, February 2024. IDC MarketScape: Worldwide Modern Endpoint Security for Enterprises Vendor Assessment, 2024, Michael Suby, January 2024.
• [5] The Forrester Wave™: Endpoint Detection And Response Providers, Q2 2022, Allie Mellen with Stephanie Balaouras, Joseph Blankenship, Sarah Morana, Peggy Dostie, April 2022.
• [6] IDC Market Shares: Worldwide Corporate Endpoint Security Market Shares, 2022. Michael Suby, June 2023.
• [7] Endpoint attack notifications are available to Microsoft Defender for Endpoint P2 customers as a free, opt-in feature.
• [8] App is available on Windows, macOS, Android™, and iOS in  select Microsoft 365 Family or Personal billing regions .

Follow Microsoft

• Chat with sales

Available M-F 6 AM to 6 PM PT.

Contribute to the Microsoft 365 and Office forum! Click  here  to learn more  💡

April 9, 2024

Contribute to the Microsoft 365 and Office forum!

Click  here  to learn more  💡

• Search the community and support articles
• Microsoft 365 and Office
• Search Community member

Ask a new question

Which plan includes Defender for Cloud?

Hello. Microsoft has many plans regarding Defender, such as Defender for Server, Defender for O365 and many more. My Questions are,

1. How many Defender for ___ (in ___ can be Server, Cloud, O365) are there? Please provide a list or link to find all of them.

2. What is the difference between Microsoft Defender for Cloud and Microsoft Defender for Cloud Apps?

3. As example, there is Microsoft Defender for Endpoint Plan 1 and Plan 2. For Question 1, please state plan 1 or plan 2 if there is any as well.

Thank you for your continuous assistance and support.

• Subscribe to RSS feed

Report abuse

Reported content has been submitted​

• Microsoft Agent |

Hi! Israt24,  

Welcome to the Microsoft Community!  

I realize that you   want to learn about subscription with Microsoft Defender products and I understand how you feel.  

Below are links to the various versions of Microsoft Defender and their official instructions:

Microsoft Defender for Endpoint: Microsoft Defender for Endpoint | Microsoft Security

Microsoft Defender for Server: Select a Defender for Servers plan - Microsoft Defender for Cloud | Microsoft Learn

Microsoft Defender for Office 365: Microsoft Defender for Office 365 | Microsoft Security

Microsoft Defender for Identity: Microsoft Defender for Identity | Microsoft Security

Microsoft Defender for Cloud Apps: Microsoft Defender for Cloud Apps | Microsoft Security

Microsoft Defender for IoT: Microsoft Defender for IoT | Microsoft Security

2.The difference between Microsoft Defender for Cloud and Microsoft Defender for Cloud Apps is as follows:

Microsoft Defender for Cloud focuses on protecting cloud resources and workloads across various cloud services such as Azure, AWS, and Google Cloud Platform.

Microsoft Defender for Cloud Apps, formerly known as Microsoft Cloud App Security, is focused on protecting cloud applications and data within those applications, providing visibility and control over how data is accessed and shared within cloud applications like Office 365, G Suite, and others.

3.For the difference between Microsoft Defender for Endpoint Plan 1 and Plan 2, please refer to the following figure:

Due to the large number of versions of Microsoft Defender and the many differences in functionality between versions, it is difficult to explain them all in a forum reply, they are explained in detail in the corresponding official links. I recommend that you click on the link above to access the detailed official documentation to understand the differences between the different versions.

Thank you for your understanding and patience.  

Best Regards   

Eddy | Microsoft Community Support Specialist   

1 person found this reply helpful

Was this reply helpful? Yes No

Sorry this didn't help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

Thanks for your feedback.

Replies (1) 

Question info.

• Norsk Bokmål
• Ελληνικά
• Русский
• עברית
• العربية
• ไทย
• 한국어
• 中文(简体)
• 中文(繁體)
• 日本語

• Skip to Navigation
• Skip to Main Content
• Skip to Related Content
• Today's news
• Reviews and deals
• Climate change
• 2024 election
• Fall allergies
• Health news
• Mental health
• Sexual health
• Family health
• So mini ways
• Unapologetically
• Buying guides

Entertainment

• How to Watch
• My watchlist
• Stock market
• Biden economy
• Personal finance
• Stocks: most active
• Stocks: gainers
• Stocks: losers
• Trending tickers
• World indices
• US Treasury bonds
• Top mutual funds
• Highest open interest
• Highest implied volatility
• Currency converter
• Basic materials
• Communication services
• Consumer cyclical
• Consumer defensive
• Financial services
• Industrials
• Real estate
• Mutual funds
• Credit cards
• Credit card rates
• Balance transfer credit cards
• Business credit cards
• Cash back credit cards
• Rewards credit cards
• Travel credit cards
• Checking accounts
• Online checking accounts
• High-yield savings accounts
• Money market accounts
• Personal loans
• Student loans
• Car insurance
• Home buying
• Options pit
• Investment ideas
• Research reports
• Fantasy football
• Pro Pick 'Em
• College Pick 'Em
• Fantasy baseball
• Fantasy hockey
• Fantasy basketball
• Download the app
• Daily fantasy
• Scores and schedules
• GameChannel
• World Baseball Classic
• Premier League
• CONCACAF League
• Champions League
• Motorsports
• Horse racing
• Newsletters

New on Yahoo

• Privacy Dashboard

• Yahoo Sports AM
• College Sports
• Fantasy Sports
• Horse Racing
• Scores/Schedules
• Wemby Watch
• Fantasy Basketball
• In-Season Tournament
• All-Star Game
• Denver's championship DNA is MIA
• Jamal Murray in hot water
• Please save 'Inside the NBA'
• Best situations for rookie QBs
• Rust, but promise, in Buehler's return

2024 NBA Playoffs preview, prediction: Cleveland Cavaliers vs. Boston Celtics

With the Cavaliers backs against the wall, down double-digits entering the second half of Game 7 against the Magic, Donovan Mitchell and his teammates found another gear. Mitchell scored 17 in the third quarter, his teammates rallied behind him, and the Cavaliers won comfortably and advanced.

Mitchell and the Cavaliers are going to have to find a few more gears if they are going to advance again.

A rested Boston Celtics team — with the deepest roster and best record in the East — is waiting for the Cavaliers. Cleveland is expected to start this series without Jarrett Allen , who has missed the last three games due to a rib injury.

Boston presents a lot more challenges for the Cavaliers, let’s dive in and break it down.

When does the Cavaliers vs. Celtics series begin?

Game One between the Pacers and Knicks will be played on Tuesday, May 6, at 8 ET in Madison Square Garden in Manhattan, and it will be broadcast on TNT.

Minnesota Denver Playoffs Schedule 2024

All times are Eastern (* = if necessary).

Game 1: Cavaliers at Celtics, May 7 (7 ET, TNT) Game 2: Cavaliers at Celtics, May 9 (7 ET, ESPN) Game 3: Celtics at Cavaliers, May 11 (8:30 ET, ABC) Game 4: Celtics at Cavaliers, May 13 (7 ET, TNT) Game 5: Cavaliers at Celtics, May 1 (TBD, TNT)* Game 6: Celtics at Cavaliers, May 3 (TBD, ESPN)* Game 7: Cavaliers at Celtics, May 5 (TBD, TBD)*

Three things to watch for in Indiana vs. New York

1) how will cleveland score in this series.

For the second series in a row, the Cavaliers face a top-three defense in the league, but Boston’s will be a tougher matchup for Cleveland because the Celtics go deeper with quality defenders.

While Orlando had Jalen Suggs to try and slow Mitchell down, Boston brings much more depth to the party — they likely start Jaylen Brown on Mitchell but they can also use Jrue Holiday or Derrick White , keeping a fresh defender on him at all times. Moreover, there is no obvious switch to target for Cleveland in this series — everyone the Celtics roll out can defend. With Kristaps Porzingis likely out for the series with a calf strain Al Horford will start and get heavy minutes at center, and while he may be the weakest link he is still a solid defender.

Expect Boston to pressure Mitchell and throw some doubles at him, forcing him to give up the ball because they don’t fear anyone else on the Cleveland roster to beat them.

The Cavaliers will need a lot more out of Darius Garland , who simply was not good enough against the Magic, including a 3-of-13 shooting outing in Game 7. Evan Mobley will also be asked to do a lot more on offense. It will take a team effort from the Cavaliers to beat Boston, which brings us to key No. 2 in this series.

2) Cleveland’s role players will have to step up, hit 3s

Boston’s elite defense is going to take away a lot of primary scoring actions for Cleveland, which is going to have to move the ball and count on role players such as Isaac Okoro , Caris LeVert , Max Strus , Georges Niang and others to drain 3s when the ball finds them (Okoro in particular will be critical, J.B. Bickerstaff will need his defense on the floor, but he can’t be an offensive zero the Celtics help off of). If the Cavaliers plan to win games in this series, they will have to rain 3s on Boston and the role players will have to play a big part in that.

The Cavaliers are also going to have to defend much better than they did last series—Boston has a much deeper attack than Orlando.

Cleveland has a very good defense (seventh in the league in the regular season, although they miss Jarrett Allen), but everyone in Boston’s starting five is capable of a big game. It’s not just Jayson Tatum and Brown, although Cleveland will have its hands full trying to slow that forward duo. Garland and Mitchell are a bit undersized against Boston as defenders. Look for Holiday and White to have some monster games in this series.

3) Stat to watch: Celtics transition points

Orlando got stops against Cleveland last series, but they didn’t run off those stops much, just 14.1% of the Magic offense started in transition.

Boston will run off the stops and turnovers and get some easy buckets going the other way. (The Celtics didn’t run much against Miami, but they also didn’t have to, and the Heat were disciplined in getting back.) If the Celtics rack up a lot of transition buckets against the Cavaliers, it will create too big a hole for Cleveland to climb out of.

Prediction: Celtics in five

Congratulations to the Cavaliers for advancing to the second round, but they will be outclassed. I expect Cleveland to get one win because they get hot from 3 — plus the Celtics never seem to sweep a team in the playoffs — but this series is going to put all the hard questions about the Cavaliers roster (will Donovan Mitchell sign an extension and stay? Can Mobley and Allen play together long-term?) back on the front burner.

Recommended Stories

Nba playoffs 1st round concludes, knicks/pacers preview & lakers coaching search | good word with goodwill.

Vincent Goodwill and The Athletic’s Fred Katz talk through the Cavaliers game 7 win on Sunday, the offseason ahead of the Magic (and Lakers) and preview the Knicks / Pacers 2nd round series.

NBA Playoffs: Magic vs. Cavaliers Game 7 updates, score, highlights, analysis

The Magic and Cavs are giving us the only Game 7 of the playoffs so far.

NBA Playoffs: Evan Mobley comes up big with game-saving block to give Cavaliers 3-2 lead

The Cavaliers have the lead in NBA TV's favorite series.

Cavaliers C Jarrett Allen out for Game 5 vs. Magic with bruised rib

Allen was a late scratch ahead of tip-off.

Timberwolves, once 66-to-1 to win NBA Finals, now are 2nd in odds behind Celtics

Minnesota keeps climbing up the NBA Finals odds.

Astros vs. Yankees: Who's hot, who's not and what to watch in this matchup of AL heavyweights

The Astros have a chance over the next three days to salvage their season, while the Yankees can bury their rivals once and for all.

Ex-Ole Miss QB and Denver Broncos draft pick Chad Kelly suspended at least nine games by CFL

Kelly allegedly harassed a female strength and conditioning coach who sued him and the Toronto Argonauts in February.

Thunder-Mavs preview: Which All-NBA point guard can lead his team to the West finals?

We break down the second-round matchup between the Oklahoma City Thunder and Dallas Mavericks and make our prediction.

Tony Allen, member of Grizzlies' 'core 4,' says he'll get his No. 9 retired next season

Allen was a six-time All-NBA defender during his time with the Grizzlies.

Formula 1: Miami Grand Prix won by Lando Norris sets United States viewership record

Over 3 million people watched Norris get the first F1 win of his career.

Heat's Pat Riley unhappy with Jimmy Butler's remarks on Celtics and Knicks, implies he needs to play more

Miami Heat president Pat Riley rebuked comments Jimmy Butler made about the Boston Celtics and New York Knicks, while also implying that his star needs to play more.

Sky rookie, No. 3 WNBA pick Kamilla Cardoso out at least 4-6 weeks with shoulder injury

Cardoso led South Carolina to a national championship, then became the third pick in last month's WNBA Draft by Chicago.

New Orleans Pelicans 2024 NBA offseason preview: Can they ever get healthy?

Zion Williamson's health will determine any success the Pels have.

The NBA Loser Lineup: Paolo Banchero, Magic on the rise in fantasy and reality despite playoff exit

Basketball analyst Dan Titus breaks down what the teams and stars who were booted from the NBA Playoffs must do to remain in good fantasy standing next season.

Victor Wembanyama is on the path to GOAT. So, why don’t we talk about it that way?

Looking back at Wembanyama's rookie season, the numbers suggest the Spurs sensation is on track to be the greatest ever.

Mavericks extend head coach Jason Kidd after defeating Clippers in Round 1

Jason Kidd will remain the head coach in Dallas.

Fantasy Baseball: Two-start pitcher rankings for Week 6

Fred Zinkie examines the pitching landscape for those looking to stream in fantasy baseball leagues this week.

Who will the Chiefs face in the NFL season opener? Let's look at the candidates

The Chiefs have some good home opponents this season.

5 things to know from the weekend in MLB: Dodgers trounce Braves, Phillies' Trea Turner injured and more

Here's what you might've missed from this weekend's action across the league.

Twins' 12-game win streak ends with 9–2 loss to Red Sox

The Minnesota Twins' 12-game winning streak ended on Sunday with a 9–2 loss to the Boston Red Sox at Target Field.