Microsoft Defender for Business Review: Enough to Drop Third-Party AV?

Fix it now

Defender for Business is Microsoft’s endpoint security product for organisations of up to 300 users, and it is included with Microsoft 365 Business Premium. It is not a cut-down antivirus: it carries endpoint detection and response, automated investigation and remediation, automatic attack disruption, threat analytics and core vulnerability management. What it leaves out is the analyst tooling.

1. Buy it if you are under 300 users, already on Business Premium, and still paying separately for a third-party endpoint suite. Check the licence you hold before buying anything at all.
2. Buy it if you want one console covering Windows, Mac, iOS and Android with no extra agent to deploy on Windows.
3. Buy it if attack surface reduction rules and device control matter more to you than writing hunting queries.
4. Skip it if you will pass 300 users soon. The move to Defender for Endpoint is not an upgrade in place, and Microsoft does not support running the two side by side.
5. Skip it if your provider needs multi-tenant tooling and custom detection logic, which is Defender for Endpoint Plan 2 territory.
6. Count your servers separately. Server protection needs the Defender for Business servers add-on, and above 60 servers Microsoft directs you to a different licence entirely.

Microsoft states that Defender for Business does not support mixed licensing. A tenant holding both Defender for Business and Defender for Endpoint Plan 2 defaults to the Defender for Business experience, and switching requires every user to be licensed for Plan 2 and a request to Microsoft Support.

If that settles it you can stop here. If you want the capability comparison and the honest case for dropping a third-party suite, read on.

Why it happens

On Windows the agent is already in the operating system, so onboarding is a matter of enrolling the device so its telemetry reports to the Defender portal. You do that through Intune, a Group Policy or a local script depending on how the estate is managed. Mac, iOS, Android and Linux need a package installed. Servers are not covered by the base licence at all; they need the separate per-server add-on, and that is worth knowing before you count seats rather than after.

What arrives when you switch it on is more than the reputation suggests. Next-generation protection with cloud-delivered lookups and tamper protection. Attack surface reduction. Endpoint detection and response with behavioural alerts grouped into incidents. Automated investigation and remediation. Automatic attack disruption, which contains an attack in progress rather than waiting for a human. Threat analytics. Core vulnerability management showing outdated software and misconfigurations per device. Centralised management with a simplified configuration path that applies sensible defaults, so a small firm is protected on day one without writing policy.

Attack surface reduction is the part worth the most and the part most often left switched off. These are rules that block behaviour rather than files: Office applications spawning child processes, script interpreters launching downloaded content, credential theft from the LSASS process, executables running from mail and webmail clients. They stop whole classes of attack that no signature catches. Turn them on in audit mode first, read what would have been blocked for a fortnight, then enforce. That fortnight is the difference between a clean rollout and a helpdesk queue.

Where it stops is consistent. There is no advanced hunting, so you cannot query raw endpoint telemetry and therefore cannot answer a question the product did not anticipate. There are no custom detection rules, so you cannot turn something you found into a standing alert. Device grouping is simpler and reporting is shallower. If your response process is reimage and move on, none of that matters. If somebody has to explain to a client exactly what happened, it matters a great deal.

The ceiling deserves more attention than it usually gets, because the transition is not smooth. Microsoft designs Defender for Business for up to 300 users and, above that, points at Defender for Endpoint, Microsoft Defender XDR or a Microsoft 365 enterprise subscription. It also states that mixed licensing is not supported: a tenant that holds both Defender for Business and Defender for Endpoint Plan 2 defaults to the Defender for Business experience, and getting the Plan 2 experience requires licensing every user for Plan 2 and contacting Microsoft Support to request the switch. Plan that before a hiring push, not during one.

On whether it is enough to drop a specialist suite, the answer for most small organisations is yes, and the reasoning is not about the scanner. What decides it is that Defender sits inside the operating system rather than bolted to it, so attack surface rules, tamper protection and device control reach places a third-party agent has to negotiate for; and that alerts land in the same portal as your identity and mail signals rather than in a separate console nobody opens. There are honest reasons to stay with a specialist, including a console that also covers network appliances, a provider whose practice is built on another vendor’s tooling, or legacy operating systems Microsoft no longer onboards. None of those is the same as doubting detection quality.

Full reference

What sits in which plan

Servers, and where the add-on stops

• Windows and Linux servers are not covered by the base licence and need the Microsoft Defender for Business servers add-on.
• That add-on requires Defender for Business or Microsoft 365 Business Premium in the tenant. It is not sold on its own.
• Above 60 servers, Microsoft directs you to a different licence: Defender for Endpoint Server, or Defender for Servers Plan 1 or Plan 2 through Defender for Cloud.
• Count servers before you count seats. This is the line item most commonly missing from a first quote.

The 300-user ceiling, and how to cross it

1. Establish where you actually are. The ceiling applies to the organisation, not to the number of devices onboarded.
2. If you expect to cross it inside the licence term, plan the move now rather than at the point of breach.
3. Understand that mixed licensing is not supported here: a tenant with Defender for Business and Defender for Endpoint Plan 2 defaults to the Defender for Business experience.
4. To get the Plan 2 experience, licence all users for Plan 2, through the standalone subscription or a suite that includes it, then contact Microsoft Support to request the switch.
5. Rebuild policy and device group structure deliberately during that move. The two products organise devices differently and a straight lift produces gaps.

The first month, in order

1. Onboard a pilot group and confirm telemetry is arriving in the Defender portal before touching policy.
2. Turn on tamper protection everywhere. It costs nothing and it is what stops an attacker disabling the rest.
3. Enable attack surface reduction rules in audit mode and read the results for two weeks.
4. Enforce the rules that produced no legitimate blocks, and investigate the ones that did rather than excluding them permanently.
5. Configure device control for removable storage, which is the cheapest real risk reduction in the product.
6. Assign the console to a named person with a defined rhythm. The failure mode here is not weak protection, it is nobody looking.

Do not run two real-time scanners on the same machine. If you deploy alongside another suite, remove the other one properly with its vendor removal tool. Half-removed security products cause boot failures and file-system stalls that look like hardware faults and get diagnosed as such for weeks.

Questions people ask about this