Defender for Endpoint P1 vs P2 vs Defender for Business: The Small-Business Security License
Three Microsoft products protect endpoints with the same engine, and buyers regularly pay for the wrong one. Defender for Business is the small-business edition, capped at 300 users. Defender for Endpoint Plan 1 is prevention only. Plan 2 adds the hunting and retention a security operations team lives in. Most 20 to 500-seat organizations already own one of them inside Microsoft 365 Business Premium, E3 or E5 and do not know which. This guide leads with the October 2026 prices and then says what each plan does, who may buy it, and how servers are licensed.
Defender for Endpoint pricing on one table
Prices are per user per month on an annual term, Commercial segment (Microsoft list price, October 2026 price list). The list carries annual figures: Microsoft Defender for Endpoint P2 is $62.40 per user per year, and $62.40 ÷ 12 = $5.20 per user per month. Every figure below is the same division.
| Product | Per user per month (annual term) | Who may buy it | Included in |
|---|---|---|---|
| Microsoft Defender for Business | $3.00 | Organizations with up to 300 users | Microsoft 365 Business Premium |
| Microsoft Defender for Endpoint P1 | $3.00 | Any size | Microsoft 365 E3, A3 |
| Microsoft Defender for Endpoint P2 | $5.20 | Any size | Microsoft 365 E5, A5, Microsoft Defender Suite |
| Defender for Endpoint P2 add-on for Microsoft 365 E3 | $3.00 | E3 tenants | On our Microsoft 365 E3 page |
| Microsoft Defender for Business servers | $3.00 per server | Defender for Business and Business Premium tenants | n/a |
| Microsoft Defender for Endpoint Server | $5.20 per server | Plan 2 and E5 tenants | n/a |
| Microsoft Defender Vulnerability Management add-on | $2.00 | Plan 2, Defender for Business and E5 tenants | n/a |
| Microsoft Defender Suite for Business Premium | Quoted on request | Business Premium tenants | n/a |
| Microsoft Defender Suite | $12.00 | Requires Microsoft 365 E3 | Microsoft 365 E5, E7 |
Frontline variants exist: Defender for Endpoint F1 is $2.00 and F2 is $3.50 for users on F plans. The inclusion column follows Microsoft's service plan reference (Microsoft Learn, Product names and service plan identifiers for licensing, August 2026), which lists Defender for Endpoint Plan 1 in the Microsoft 365 E3 and A3 rows, Defender for Endpoint in the E5 and A5 rows, and Defender for Business in the Business Premium row.
What Plan 2 adds over Plan 1
They share one client and one portal; the license decides what the Microsoft Defender portal may show and do for a device. Microsoft's documentation describes Plan 1 as the core endpoint protection set: next-generation antivirus with cloud-delivered protection, attack surface reduction rules, device control for USB storage, web and network protection, the endpoint firewall and application control. Plan 1 is prevention; it does not open an investigation.
Plan 2 is Plan 1 plus the investigation and response layer: endpoint detection and response with a device timeline and alerts grouped into incidents, automated investigation and remediation that closes most alerts without a person, threat analytics, the core capabilities of Microsoft Defender Vulnerability Management (inventory, weaknesses, exposure score and recommendations), advanced hunting with KQL, live response, six months of data retention, sandbox analysis and Microsoft Threat Experts. The premium vulnerability management features are the separate $2.00 add-on.
The $2.20 between the plans is the difference between knowing a file was blocked and being able to ask which other devices ran it in the last 90 days. If nobody in your organization or your provider will write that query, half of Plan 2 goes unused; the Defender XDR Incident Readiness and Automated Response service is how a Plan 2 tenant without a security team gets the automated half working.
Defender for Business: the 300-user cap and what it keeps from Plan 2
Microsoft Defender for Business is built for organizations with up to 300 users and up to five devices per user, with no minimum device requirement, and Microsoft's product page adds that Defender for Endpoint is the recommended solution for more than 300 users (Microsoft, Microsoft Defender for Business product page, opened October 5, 2026). The cap is the one the Microsoft 365 Business plans share; the 300-license limit article explains how it is counted.
Microsoft's documentation describes Defender for Business as the features of Plan 1, some of the features of Plan 2 and simplifications for small businesses. What it keeps from Plan 2 is the part a small IT team uses: endpoint detection and response with automatic attack disruption, automated investigation and remediation, and vulnerability management, behind a wizard-based onboarding. What it leaves to Plan 2 is the analyst layer: advanced hunting, live response, six months of device data retention, threat analytics and the APIs.
At $3.00 it is the same price as Plan 1 and carries most of Plan 2, which makes it the right standalone purchase for a 20 to 300-user organization that is not on Business Premium and will not hunt. Business Premium users need no endpoint SKU at all: the Defender for Business service plan is in the Business Premium row of the service plan reference (August 2026).
Which bundles include which plan
From Microsoft's service plan reference (August 2026), Microsoft's Entra licensing page (June 2026) and the October 2026 price list:
- Microsoft 365 Business Premium ($22.00) includes Defender for Business, Defender for Office 365 Plan 1, Intune Plan 1 and Entra ID P1.
- Microsoft 365 E3 ($39.00) includes Defender for Endpoint Plan 1, not Plan 2. The P2 add-on for Microsoft 365 E3 at $3.00 is the least expensive route to hunting and retention for an E3 tenant that wants nothing else from E5. Since 1 July 2026 E3 also includes Defender for Office 365 Plan 1 (Microsoft, Microsoft 365 pricing and packaging updates, February 2026).
- Microsoft 365 E5 ($60.00) includes Plan 2 through the Microsoft Defender Suite, with Defender for Office 365 Plan 2, Defender for Identity, Defender for Cloud Apps and Entra ID P2.
- Microsoft 365 A3 includes Plan 1 and A5 includes Plan 2, on the Education segment.
- Business Premium tenants add the Microsoft Defender Suite for Business Premium at $10.00 per user per month on an annual commitment (Microsoft list price, October 2026 price list): Plan 2 plus Defender for Identity, Defender for Office 365 Plan 2, Defender for Cloud Apps and Entra ID P2. The standalone Microsoft Defender Suite at $12.00 requires Microsoft 365 E3.
The E3 vs E5 article weighs the rest of the E5 bundle.
Servers are licensed separately
No user plan covers a server, and there are three routes. Microsoft Defender for Business servers is a per-server add-on for tenants holding Defender for Business or Business Premium, which Microsoft's documentation describes as an add-on for organizations with up to 300 users; it is $36.00 per server per year, or $3.00 per month. Microsoft Defender for Endpoint Server is the per-server SKU aligned with Plan 2, at $5.20 per server per month, for Plan 2 and E5 tenants. Microsoft Defender for Servers through Defender for Cloud is billed hourly on your Azure subscription, a metered charge that stays with you and is not on our price list, and reaches on-premises servers through Azure Arc.
Our rule: under ten servers on a Business Premium tenant, use the Defender for Business servers add-on; on a Plan 2 tenant, use the Server SKU, or Defender for Servers if the servers already sit in Azure or Arc. The Defender for Servers Deployment for On-Premises and Hybrid service ($20 per server plus a $2,450 tenant fee) handles either route.
Deploying it, and what you can do when an alert fires
The license is the smaller half of the work. Deployment runs in this order: inventory the Windows, macOS, Linux, iOS, Android and server assets; confirm the license and tenant prerequisites; pick a pilot ring of IT devices, then one cooperative business group, then everyone. Windows clients are onboarded by one of Microsoft's supported methods: Intune or another MDM, Configuration Manager, Group Policy, a local script Microsoft limits to ten devices, or the VDI scripts for Windows 365 and virtual desktops. After onboarding, confirm that Defender Antivirus is in active mode, the EDR sensor reports healthy, tamper protection and cloud-delivered protection are on, and the device reaches Microsoft's Defender services. Attack surface reduction rules go in audit mode first and block mode once the exceptions are known; the deployment service above runs exactly this sequence on Intune-managed devices.
What the Defender portal lets you do to a device depends on the plan. Plan 1 includes run antivirus scan, isolate device, stop and quarantine a file, and add an indicator to block or allow a file. Plan 2 adds collect investigation package, restrict app execution, initiate automated investigation, contain device, and live response for running scripts and collecting forensics on the endpoint. Defender for Business keeps automated investigation and remediation from Plan 2, so a small firm's response runs: triage the incident, isolate the device (it stays connected to Defender), let automated investigation close the known-bad artifacts, run a scan, confirm sensor health and the exposure recommendations, check whether identity or email was involved, and write down what happened for the insurer and the next hardening round.
25, 100 and 500 users: the math
Totals are per year at October 2026 list prices on an annual term, as the price list states them: Defender for Business $36.00, Plan 1 $36.00, Plan 2 $62.40, Business Premium $264.00, Business Standard $168.00, Microsoft 365 E3 $468.00 and E5 $720.00 per user per year.
A 25-user firm. On Business Premium ($6,600 for the firm) endpoint protection is already paid for. On Business Standard, adding Defender for Business costs 25 × $36.00 = $900 per year; Plan 2 would be $1,560 for features nobody in a 25-person firm will use. Buy Business Premium if you also need Intune and Conditional Access; otherwise Business Standard plus Defender for Business.
A 100-user firm. Business Premium at 100 users is $26,400 per year and includes Defender for Business. Standalone, Defender for Business is $3,600 and Plan 2 is $6,240, a gap of $2,640 per year that buys advanced hunting, live response and six months of retention. Pay it when an MDR provider will hunt in your tenant, an insurer asks for longer EDR retention, or you are at 250 users and growing.
A 500-user organization. Defender for Business is unavailable at this size. Microsoft 365 E3 at $468.00 ($234,000 for 500) includes Plan 1; the E3 Plan 2 add-on at $36.00 per user makes it $252,000. Microsoft 365 E5 at $720.00 ($360,000) includes Plan 2 and the rest of the Defender Suite. Standalone Plan 1 for 500 users is $18,000 per year and Plan 2 is $31,200.
Frequently asked questions
Is Defender for Business the same as Defender for Endpoint?
Same engine and portal, different license. Microsoft describes Defender for Business as the features of Plan 1, some of Plan 2 (EDR, automated investigation, vulnerability management) and small-business simplifications, with a 300-user limit. Plan 2 adds advanced hunting, live response, six months of data retention and threat analytics.
Does Microsoft 365 Business Premium include Defender for Endpoint?
It includes Defender for Business, not Plan 1 or Plan 2. If you need Plan 2, the Microsoft Defender Suite for Business Premium add-on ($10.00 per user per month on an annual commitment) brings it with Defender for Identity, Defender for Office 365 Plan 2, Defender for Cloud Apps and Entra ID P2.
What is the difference between Defender for Endpoint P1 and P2?
Plan 1 is prevention: next-generation antivirus, attack surface reduction, device control and web protection. Plan 2 adds endpoint detection and response, automated investigation and remediation, threat analytics, core vulnerability management, advanced hunting, live response and six months of data retention. Plan 1 comes with Microsoft 365 E3; Plan 2 with E5 and the Microsoft Defender Suite.
Which response actions does Plan 1 include?
Run antivirus scan, isolate device, stop and quarantine a file, and add a file indicator. Collecting an investigation package, restricting app execution, automated investigation, containing a device and live response need Plan 2.
How much does Defender for Endpoint cost?
On the October 2026 price list, Plan 1 is $3.00 and Plan 2 is $5.20 per user per month on an annual term; the Plan 2 add-on for Microsoft 365 E3 is $3.00; Defender for Business is $3.00. Server licenses are $3.00 and $5.20 per server per month.
Sources
- Commercial price list, October 2026: Defender for Business, Defender for Endpoint P1, F1, P2, F2 and Server, the P2 add-on for Microsoft 365 E3, Defender for Business servers, Defender Vulnerability Management add-on, Microsoft Defender Suite, and the Business Premium, Business Standard, E3 and E5 suites
- Microsoft, Microsoft Defender for Business product page (opened October 5, 2026): the 300-user limit, five devices per user, no minimum, Defender for Endpoint recommended above 300 users
- Microsoft Learn, Product names and service plan identifiers for licensing (August 2026); Microsoft Entra licensing (June 2026); Microsoft, Microsoft 365 pricing and packaging updates (February 2026)
- Microsoft Learn: Compare Microsoft Defender for Endpoint Plan 1 and Plan 2; the Microsoft Defender service description; the Defender for Business FAQ
- Onboard Windows client devices to Microsoft Defender for Endpoint — Microsoft Learn, checked 2026-10-11
- Take response actions on a device in Microsoft Defender for Endpoint — Microsoft Learn, checked 2026-10-11
| Your situation | Buy | Per user per month (annual term) |
|---|---|---|
| On Business Premium, up to 300 users | Nothing; Defender for Business is included | $0.00 |
| On Business Basic or Standard, up to 300 users, no analyst | Defender for Business | $3.00 |
| Up to 300 users, an MDR provider or insurer wants hunting and six months of retention | Defender for Endpoint P2, or the Defender Suite for Business Premium | $5.20, or $10.00 |
| On Microsoft 365 E3, more than 300 users | Nothing for Plan 1; the P2 add-on for E3 if you need hunting | $0.00, or $3.00 |
| More than 300 users, not on E3 or E5 | Defender for Endpoint P1 or P2 | $3.00 or $5.20 |
| Servers on a Business Premium tenant | Defender for Business servers | $3.00 per server |
| Servers on a Plan 2 or E5 tenant | Defender for Endpoint Server, or Defender for Servers through Azure | $5.20 per server, or Azure metered |
Key takeaways
- On the October 2026 price list Defender for Business and Plan 1 are each $3.00 and Plan 2 is $5.20 per user per month on an annual term; the Plan 2 add-on for Microsoft 365 E3 is $3.00.
- Plan 2 adds EDR, automated investigation and remediation, threat analytics, core vulnerability management, advanced hunting, live response and six months of retention over Plan 1.
- Defender for Business is limited to organizations with up to 300 users, keeps EDR, automated investigation and vulnerability management from Plan 2, and is included in Microsoft 365 Business Premium.
- Microsoft 365 E3 includes Plan 1 and E5 includes Plan 2 through the Defender Suite; Business Premium tenants reach Plan 2 with the Defender Suite for Business Premium add-on at $10.00 per user per month on an annual commitment.
- Servers are never covered by a user license: use the $3.00 Defender for Business servers add-on, the $5.20 Defender for Endpoint Server SKU, or Defender for Servers metered on your Azure bill.
- Onboard by Intune, Configuration Manager, Group Policy or the ten-device local script, pilot in rings, and know that Plan 1 stops at scan, isolate and quarantine while Plan 2 adds investigation packages, app restriction, automated investigation and live response.
Whichever plan you own, it protects nothing until the policies are set and the devices are onboarded. Subscriptions are at Microsoft's list price on our Defender for Endpoint P1, Defender for Endpoint P2, Defender for Business and Defender for Business servers pages, each with a quote button. The Microsoft Defender for Endpoint Deployment for Intune-Managed Devices service ($3,500 per project) onboards Windows and macOS devices, configures antivirus, attack surface reduction and EDR policies, and hands you the alert-handling runbook for any of the three plans; once the vulnerability view fills up, Fixing vulnerabilities on devices based on Defender for Endpoint data works the recommendations down. Not sure which plan your size needs? Book 30 minutes with Mike.
Questions this article didn’t answer?
Thirty minutes with Mike — our CEO, not a sales rep. Bring the hard version of the question.