Review

Defender for Business vs Defender for Endpoint P1 and P2: Pick One

11 min read Updated October 4, 2026 Microsoft Licensing Guides

Fix it now

Defender for Business is for organisations of up to 300 users and already carries endpoint detection and response, automated investigation, threat analytics and advanced hunting with 30 days of data. Plan 1 is prevention with no investigation capability at all. Plan 2 adds six months of hunting retention and Microsoft Threat Experts. The 300-user ceiling decides this more often than the feature list.

Under 300 users: Defender for Business, and check first whether Microsoft 365 Business Premium already includes it.
Over 300 users with someone who investigates alerts: Plan 2, which is what a managed provider or in-house analyst needs.
Over 300 users with nobody to investigate: Plan 1 covers prevention, but be honest with your auditors that you keep no investigation history.
Already buying Microsoft 365 E5 or the Microsoft Defender Suite: Plan 2 is included. Check before purchasing separately.
Do not plan a mixed tenant. Microsoft states Defender for Business does not support mixed licensing, and a tenant holding both defaults to the Defender for Business experience for all users.
Cover the servers deliberately: the Defender for Business servers add-on is capped at 60 server licences per customer.

Microsoft Defender Antivirus ships with Windows at no cost and is real protection. All three licences buy the management, reporting and response layer above it rather than replacing it.

If you are under 300 users, stop here: Defender for Business is the answer and Business Premium may already include it. Below is the accurate feature split and the two ceilings that catch growing companies.

Why it happens

These three licences cover the same Microsoft endpoint security technology at different depths, and the choice is decided by headcount first and by security operations capability second.

Every supported Windows installation already carries Microsoft Defender Antivirus with real-time protection, cloud-delivered detection and tamper protection, and that baseline costs nothing. What the paid licences buy is the layer above it: central policy, a portal showing the whole estate, enforceable attack surface reduction rules, device and web content control, vulnerability reporting and one place to respond from.

You have under 300 users and are being quoted Plan 2

You have this one if Somebody has argued that the analyst tooling in Plan 2 is missing from Defender for Business, so a small business needs the enterprise tier.

Check that claim against Microsoft’s own comparison, because it is usually wrong. Defender for Business includes endpoint detection and response, automated investigation and remediation, automatic attack disruption, core vulnerability management, threat analytics and advanced hunting with 30 days of data.
Threat analytics in particular is present in Defender for Business and absent from Plan 1. It is not a Plan 2 differentiator.
The genuine Plan 2 differentiators against Defender for Business are six months of advanced hunting data retention rather than 30 days, and Microsoft Threat Experts.
If you hold Microsoft 365 Business Premium you already have Defender for Business. That is the single most common duplicate purchase in this family.

Plan 1 is on the quote and nobody has said what it lacks

You have this one if An organisation over 300 users is buying Plan 1 to satisfy a control requirement, on the basis that it is Defender for Endpoint.

Plan 1 gives centralised management, next-generation antivirus under policy, attack surface reduction, device control, web content filtering and manual response actions such as isolating a device.
It does not give endpoint detection and response, automated investigation and remediation, automatic attack disruption, vulnerability management, threat analytics or advanced hunting.
In practice that means during an incident you can isolate the machine and run a scan, and you cannot reconstruct what it did. Decide whether that satisfies the obligation before signing.

The estate has grown past a ceiling

You have this one if Headcount is approaching 300, or the server estate has grown past what the small-business add-on covers.

Defender for Business is designed for organisations of up to 300 users. Above that, Microsoft points you at Defender for Endpoint, Microsoft Defender XDR or the Microsoft 365 enterprise plans.
The servers add-on has its own, much lower cap: up to 60 servers may use the Microsoft Defender for Business servers add-on. Above 60 you need Microsoft Defender for Endpoint Server, or Microsoft Defender for Servers Plan 1 or Plan 2.
Those two ceilings are reached independently. A company with 200 users and 80 servers has already outgrown the servers add-on without going near the user limit.
The endpoint agent is the same either way, so devices do not need reinstalling, but the simplified Defender for Business configuration does not map one-to-one onto the full policy surface. Review onboarding, exclusions and attack surface reduction rules rather than copying them.

Full reference

What each licence actually includes

Capability	Defender for Business	Endpoint Plan 1	Endpoint Plan 2
User ceiling	Up to 300 users	None	None
Centralised management	Yes	Yes	Yes
Simplified firewall and antivirus configuration	Yes	No	No
Next-generation protection	Yes	Yes	Yes
Attack surface reduction	Yes	Yes	Yes
Manual response actions such as device isolation	Yes	Yes	Yes
Endpoint detection and response	Yes, optimised	No	Yes
Automated investigation and remediation	Yes	No	Yes
Automatic attack disruption	Yes	No	Yes
Vulnerability management	Yes, core	No	Yes
Threat analytics	Yes, optimised	No	Yes
Advanced hunting	Yes, 30 days of data	No	Yes, six months of data
Microsoft Threat Experts	No	No	Yes
macOS, iOS and Android support	Yes	Yes	Yes
Server coverage	Servers add-on, capped at 60 server licences per customer	Separate server licensing	Separate server licensing

Feature placement between these tiers has moved before and Microsoft continues to adjust it. Check the current table on Microsoft’s Defender for Business overview before signing, and be sceptical of any comparison that puts threat analytics or advanced hunting exclusively in Plan 2.

The 300-user ceiling, and what happens when you cross it

Defender for Business is designed for small and medium-sized businesses with up to 300 users. It is not a soft limit you negotiate past by buying more seats: above 300, Microsoft directs you to Defender for Endpoint, Microsoft Defender XDR or the Microsoft 365 enterprise plans. It is the same 300-user shape that applies across the Microsoft 365 Business family, so a company usually crosses both at once.

Microsoft states that Defender for Business does not support mixed licensing within a single organisation. If a tenant holds both Defender for Business and Defender for Endpoint subscriptions, the organisation defaults to the Defender for Business experience for all users. To use Defender for Endpoint Plan 2 instead you must license all users for Plan 2 and contact Microsoft Support to request the switch. Plan that as a single move rather than drifting into a mixed state.

Servers are licensed separately, always, and the cap is low

None of the three licences covers a server operating system. Defender for Business customers – standalone or through Microsoft 365 Business Premium – can add the Defender for Business servers add-on, which extends the same simplified protection to Windows Server and Linux hosts and is managed in the Microsoft Defender portal. Microsoft caps it at 60 servers per customer. If you have more than 60 servers you need a different licence: Microsoft Defender for Endpoint Server, or Microsoft Defender for Servers Plan 1 or Plan 2, the latter managed from the Azure portal and adding posture management alongside endpoint protection, with six months of hunting retention and Microsoft Threat Experts.

The servers add-on requires an existing Defender for Business subscription or Microsoft 365 Business Premium underneath it. It is not sold on its own.

This is a common gap in small estates: every laptop reports into the portal while the file server and the domain controller run on the built-in antivirus with no central visibility. Those are exactly the machines where an intrusion becomes serious, so count them at the same time as the users and check both against their separate ceilings.

What you may already own

Microsoft 365 Business Premium includes Defender for Business. Turn it on and onboard the devices rather than buying it again.
Defender for Business is also available standalone to organisations of up to 300 users on Microsoft 365 Business Basic, Microsoft 365 Business Standard and Office 365 E1.
Microsoft 365 E5 includes Defender for Endpoint Plan 2, as does the Microsoft Defender Suite add-on – the product Microsoft renamed from Microsoft 365 E5 Security on 1 October 2025.
Microsoft 365 E3 includes Defender for Endpoint Plan 1, which is the tier without detection and response.
A very small business with no IT staff has a genuine free baseline in Microsoft Defender Antivirus with tamper protection enabled.

Which licence to buy, by situation

Under 300 users already on Business Premium: you have Defender for Business. Onboard the devices and add the servers add-on for the servers, up to 60 of them.
Under 300 users on Business Basic or Standard: add Defender for Business standalone, or compare against upgrading to Business Premium, which bundles it with Intune and Entra ID P1.
Over 300 users with a compliance requirement to show endpoint protection and no analyst capability: Plan 1 covers prevention, and you should say plainly that no investigation history is kept.
Over 300 users where somebody triages alerts, in house or through a managed provider: Plan 2, because the six months of hunting data is what that provider needs.
Anyone buying Microsoft 365 E5 or the Microsoft Defender Suite: Plan 2 is already included.
More than 60 servers: Microsoft Defender for Endpoint Server or Defender for Servers Plan 1 or Plan 2, whatever the user count says.

When a licence is the actual fix

For an organisation under the 300-user ceiling, Microsoft Defender for Business is the correct licence: it carries endpoint detection and response, automated investigation, threat analytics and 30 days of advanced hunting data, which is more than Defender for Endpoint Plan 1 provides at any size. Arco supplies it standalone and inside Microsoft 365 Business Premium, along with the servers add-on for the machines people forget. Tell us your user count and your server count separately, because they hit different ceilings – 300 users for Defender for Business and 60 servers for the add-on – and we will check what you are already entitled to before quoting anything, including whether Plan 2 is already inside a subscription you own.

Questions people ask about this

Do I need this if Windows already has Defender built in?

Microsoft Defender Antivirus is real protection and costs nothing, and for a household or a couple of machines it is a legitimate stopping point. What it does not give you is one console showing every device, enforced policy, vulnerability reporting, or any record of what a compromised machine did. If you have more than a handful of devices and any obligation to demonstrate control over them, the management layer is what you are buying.

Is Defender for Business included in Microsoft 365 Business Premium?

Yes. If you hold Business Premium you already have it and should not buy it again. It is also available standalone to organisations of up to 300 users on Microsoft 365 Business Basic, Business Standard and Office 365 E1. This is the most common duplicate purchase in this product family, so check your existing subscriptions first.

What does Plan 2 actually add over Defender for Business?

Two things: advanced hunting with six months of data retention instead of 30 days, and Microsoft Threat Experts. Defender for Business already has endpoint detection and response, automated investigation and remediation, automatic attack disruption, core vulnerability management, threat analytics and advanced hunting. If a comparison tells you threat analytics is a Plan 2 exclusive, it is wrong.

How many servers can the Defender for Business add-on cover?

Up to 60 server licences per customer. Above that, Microsoft states you need a different kind of licence: Microsoft Defender for Endpoint Server, or Microsoft Defender for Servers Plan 1 or Plan 2. The add-on also requires an existing Defender for Business subscription or Microsoft 365 Business Premium underneath it, and is not sold on its own.

Can I mix Defender for Business and Defender for Endpoint in one tenant?

No. Microsoft states that Defender for Business does not support mixed licensing within a single organisation, and that if both subscriptions are present the organisation defaults to the Defender for Business experience for all users. To move to Defender for Endpoint Plan 2 you must license all users for Plan 2 and contact Microsoft Support to request the switch, so treat it as one decision for the whole estate.

Was this article helpful?

Your feedback helps us improve our documentation.

Review Office LTSC 2024 vs Microsoft 365 Apps: The Locked-Down Desktop Choice Review Windows Server 2022 vs 2025: Is There Any Reason to Buy the Older One? Review Windows 11 Pro vs Enterprise: What the Enterprise Licence Really Adds Review SQL Server Standard vs Enterprise: The Features That Force the Upgrade

← Back to Knowledge Base