Defender for Business vs Defender for Endpoint Plan 1 vs Plan 2: Which One Fits 25, 100 and 500 Users, and What Business Premium Already Includes
Three Microsoft products protect endpoints with the same engine, and buyers regularly pay for the wrong one. Defender for Business is the small-business edition, capped at 300 users. Defender for Endpoint Plan 1 is prevention only. Plan 2 adds the hunting and retention a security operations team lives in. Most 20 to 500-seat organizations already own one of them inside Microsoft 365 Business Premium, E3 or E5 and do not know which.
The three products, and the one thing they share
They share one client. The license decides what the Microsoft Defender portal may show and do for a device.
Microsoft Defender for Business is built for organizations with up to 300 users. Its product page (opened 27 September 2026) lists next-generation antivirus, endpoint detection and response with automatic attack disruption, automated investigation and remediation, and vulnerability management, with up to five devices per user and no minimum device count. It is sold standalone and included in Microsoft 365 Business Premium. Our refreshed introduction to Defender for Business covers the product tour, so this article does not repeat it.
Microsoft Defender for Endpoint Plan 1 is the prevention layer for organizations of any size: next-generation protection, attack surface reduction, device control and web protection. Microsoft includes it in Microsoft 365 E3.
Microsoft Defender for Endpoint Plan 2 is the full product: Plan 1 plus endpoint detection and response, automated investigation and remediation, threat hunting, live response, core vulnerability management and six months of data retention. Microsoft includes it in Microsoft 365 E5 and in the Microsoft Defender Suite, the add-on called Microsoft 365 E5 Security until late 2025.
The feature ladder, from prevention to hunting
Read the three plans as rungs on one ladder. Each rung keeps everything below it.
- Prevention (all three). Antivirus with cloud-delivered protection, attack surface reduction rules, device control for USB storage and web filtering.
- Detection and response (Defender for Business and Plan 2). The device timeline, alerts grouped into incidents, isolating a device from the network, and automated investigation and remediation that closes most alerts without a person. Defender for Business also has automatic attack disruption, which contains a compromised device or account while an incident is unfolding.
- Hunting and retention (Plan 2 only). Advanced hunting with KQL across device telemetry, live response for a remote shell during an investigation, six months of retained device data, and the full Defender XDR experience across endpoints, identities, email and cloud apps. Microsoft's own description of the Business Premium add-on says Plan 2 adds "threat hunting, live response, six months of data retention on the device, and endpoint security for IoT devices" on top of Defender for Business.
Every plan with EDR includes the core vulnerability management view (inventory, weaknesses, exposure score, recommendations). The premium add-on is a separate SKU at $24.00 per user per year (Microsoft list price, September 2026 price list); buy it when an auditor asks for baseline evidence.
The difference between rungs two and three is who is looking. Defender for Business gives a small IT team the incident queue and the automated remediation. Plan 2 gives an analyst the telemetry to ask "which other devices ran this file in the last 90 days." If nobody in your organization or your provider will write that query, the third rung goes unused, the argument our MDR article makes about Sentinel.
The 300-user cap and what Business Premium, E3 and E5 already include
Defender for Business is licensed per user for organizations with up to 300 users, the ceiling the Microsoft 365 Business plans share; the 300-license limit article explains how it is counted.
What the bundles carry, from Microsoft Learn (24 September 2025) and Microsoft's enterprise suites page (opened 27 September 2026):
- Microsoft 365 Business Premium includes Defender for Business, Defender for Office 365 Plan 1, Intune Plan 1, Entra ID P1, and Purview Information Protection with DLP for email and files. Its users need no endpoint SKU.
- Microsoft 365 E3 includes Plan 1, not Plan 2. The price list carries a "Defender for Endpoint P2 Add On for Microsoft 365 E3" at $36.00 per user per year (Microsoft list price, September 2026 price list), the least expensive route to hunting and retention for an E3 tenant that wants nothing else from E5.
- Microsoft 365 E5 includes Plan 2 through the Microsoft Defender Suite, with Defender for Office 365 Plan 2, Defender for Identity, Defender for Cloud Apps and Entra ID P2.
- Business Premium tenants can add the Microsoft Defender Suite for Business Premium (Plan 2 plus the same identity, email and cloud-app products). Its price is not on our September 2026 price sheet, so we quote it on request.
Standalone list prices, annual commitment, per user per year (Microsoft list price, September 2026 price list): Defender for Business $36.00; Plan 1 $36.00; Plan 2 $62.40, or $3.00, $3.00 and $5.20 a month. See also Intune licensing and E3 vs E5.
Servers are licensed separately
No user plan covers a server. Three routes exist, with list prices from the September 2026 price list. Microsoft Defender for Business servers is a per-server add-on for tenants holding Defender for Business or Business Premium, at $36.00 per server per year. Microsoft Defender for Endpoint Server is the per-server SKU aligned with Plan 2, at $62.40 per server per year, for Plan 2 and E5 tenants. Microsoft Defender for Servers through Defender for Cloud is billed hourly on your Azure subscription, a metered charge that stays with you, and reaches on-premises servers through Azure Arc.
Our rule: under ten servers on a Business Premium tenant, use the add-on; on a Plan 2 tenant, use the Server SKU, or Defender for Servers if the servers already sit in Azure or Arc. The Defender for Servers deployment ($20 per server plus a $2,450 tenant fee) handles either.
25, 100 and 500 users: the math and the recommendation
Prices are annual commitment, per user per year, Microsoft list price, September 2026 price list. Defender for Business is per user with up to five devices.
A 25-user firm. On Business Premium ($264.00 per user per year, $6,600 for the firm) endpoint protection is already paid for. On Business Standard, adding Defender for Business costs 25 × $36.00 = $900 per year; Plan 2 would be $1,560 for features nobody in a 25-person firm will use. Buy Business Premium if you also need Intune and Conditional Access; otherwise Business Standard plus Defender for Business.
A 100-user firm. Business Premium at 100 users is $26,400 per year and includes Defender for Business. Standalone, Defender for Business is $3,600 and Plan 2 is $6,240, a gap of $2,640 per year that buys advanced hunting, live response and six months of retention. Pay it when an outside MDR or SOC provider will hunt in your tenant, a customer contract or cyber insurer asks for EDR telemetry retained longer than Defender for Business keeps it, you run more than ten servers, or you are at 250 users and growing. Otherwise stay on Defender for Business and spend the difference on the Defender for Endpoint deployment.
A 500-user organization. Defender for Business is unavailable at this size. Microsoft 365 E3 at $468.00 per user per year ($234,000 for 500) includes Plan 1; the E3 Plan 2 add-on ($36.00) makes it $252,000. Microsoft 365 E5 at $720.00 ($360,000) includes Plan 2 and the rest of the Defender Suite. Standalone Plan 1 for 500 users is $18,000 per year and Plan 2 is $31,200. At this size the real question is whether the identity and email pieces of the Defender Suite are needed too.
Frequently asked questions
Is Defender for Business the same as Defender for Endpoint?
Same engine and portal, different license. Microsoft describes Defender for Business as the features of Plan 1, some of Plan 2 (EDR, automated investigation, vulnerability management) and small-business simplifications, with a 300-user limit. Plan 2 adds advanced hunting, live response, six months of data retention and IoT device security.
Does Microsoft 365 Business Premium include Defender for Endpoint?
It includes Defender for Business, not Plan 1 or Plan 2. If you need Plan 2, the Microsoft Defender Suite for Business Premium add-on brings it with Defender for Identity, Defender for Office 365 Plan 2, Defender for Cloud Apps and Entra ID P2.
What is the difference between Defender for Endpoint P1 and P2?
Plan 1 is prevention: next-generation antivirus, attack surface reduction, device control and web protection. Plan 2 adds endpoint detection and response, automated investigation and remediation, threat hunting, live response, core vulnerability management and six months of data retention. Plan 1 comes with Microsoft 365 E3; Plan 2 with Microsoft 365 E5 and the Microsoft Defender Suite.
What happens when we pass 300 users?
Defender for Business is for organizations with up to 300 users. Past it, the path is Plan 1 or Plan 2, standalone or through Microsoft 365 E3 or E5. The move is a license change, not a re-deployment: onboarded devices stay onboarded and the portal exposes the new features once the licenses land. Verify the current transition guidance on Microsoft Learn before the renewal.
Sources
- Microsoft Learn, "Add Microsoft Defender Suite for Business Premium to your subscription" (ms.date 24 September 2025; opened via the MicrosoftDocs GitHub source): Business Premium contents, the 300-user limit, what Plan 2 adds over Defender for Business
- Microsoft Learn, "What's new in security in Microsoft Defender for Business" (ms.date 24 September 2025; opened via the MicrosoftDocs GitHub source): the September 2025 add-on, servers add-on eligibility
- Microsoft, Microsoft Defender for Business product page (opened 27 September 2026)
- Microsoft, Enterprise security suites pricing page (opened 27 September 2026): Defender Suite contents, "previously Microsoft 365 E5 Security", Microsoft 365 E3 prerequisite
- Microsoft Learn, "Compare Microsoft Defender for Endpoint Plan 1 and Plan 2" and the Defender for Business FAQ (not opened; the Plan 1 and Plan 2 split as summarized in search results on 27 September 2026; verify on Microsoft Learn)
- Microsoft, Commercial price list, September 2026 (our CSP price sheet)
- IT Partner blog: introducing-microsoft-defender-for-business; intune-licensing-plan-1-vs-plan-2-vs-intune-suite-remote-help-epm; microsoft-365-e3-vs-e5-upgrade-cost-2026
- IT Partner engineering notes from Defender deployments, September 2026
| Question | Defender for Business | Defender for Endpoint Plan 1 | Defender for Endpoint Plan 2 |
|---|---|---|---|
| User limit | Up to 300 users, five devices each | None | None |
| Prevention (antivirus, attack surface reduction, device and web control) | Yes | Yes | Yes |
| EDR, incidents, device isolation | Yes | No | Yes |
| Automated investigation and remediation | Yes | No | Yes |
| Advanced hunting and live response | No | No | Yes |
| Device data retention | Shorter than Plan 2 | Not applicable | Six months |
| Core vulnerability management | Yes | No | Yes |
| Included in | Microsoft 365 Business Premium | Microsoft 365 E3 | Microsoft 365 E5, Microsoft Defender Suite |
| Standalone list price (annual, per user per year, September 2026 price list) | $36.00 | $36.00 | $62.40 |
Key takeaways
- Defender for Business is Defender for Endpoint Plan 1 plus EDR, automated investigation and vulnerability management, packaged for up to 300 users and included in Microsoft 365 Business Premium.
- Plan 2 adds what Defender for Business lacks: advanced hunting, live response, six months of device data retention and the full Defender XDR experience.
- Microsoft 365 E3 includes Plan 1 and can add Plan 2 for $36.00 per user per year; Microsoft 365 E5 includes Plan 2 through the Microsoft Defender Suite (Microsoft list price, September 2026 price list).
- Servers are never covered by a user license: use the Defender for Business servers add-on, the Defender for Endpoint Server SKU, or Defender for Servers in Azure.
- At 100 users the gap between Defender for Business and Plan 2 is $2,640 per year; at 500 users Defender for Business is unavailable and the question becomes E3 plus the Plan 2 add-on versus E5.
Whichever plan you own, it protects nothing until the policies are set and the devices are onboarded. The Microsoft Defender for Endpoint Deployment for Intune-Managed Devices ($3,500 per project, 15 days) onboards Windows and macOS devices, configures antivirus, attack surface reduction and EDR policies, and hands you the alert-handling runbook for Defender for Business, Plan 1 or Plan 2. Once the vulnerability view fills up, Fixing vulnerabilities on devices based on Defender for Endpoint data ($175 per hour) works the recommendations down. Subscriptions are at Microsoft's list price on our Defender for Business, Defender for Endpoint P1, Defender for Endpoint P2, Defender for Business servers and Microsoft 365 Business Premium pages, or book a call.
Questions this article didn’t answer?
Thirty minutes with Mike — our CEO, not a sales rep. Bring the hard version of the question.