Defender for Cloud vs. Defender for Endpoint: What's the Difference?

Microsoft Defender for Endpoint is an endpoint security platform for prevention, endpoint detection and response (EDR), investigation, and containment. It protects Windows, macOS, Linux, Android, iOS, and supported Windows/Linux server workloads from malware, ransomware, credential theft, suspicious processes, exploit activity, and lateral movement. Security teams use it to answer: Which device ran the payload? What spawned PowerShell? Was there credential dumping? Which machines are exposed to this CVE?

Microsoft Defender for Cloud is a cloud-native application protection platform (CNAPP). It combines cloud security posture management (CSPM) and cloud workload protection (CWP) across Azure, AWS, GCP, and hybrid resources connected through Azure Arc. It identifies exposed assets, misconfigurations, vulnerable workloads, excessive permissions, insecure identities, missing controls, regulatory gaps, and attack paths. Cloud and security teams use it to answer: Which public VM has a critical vulnerability and an over-permissive managed identity? Which storage accounts allow risky access? Which subscriptions are drifting from policy? Which Kubernetes cluster is internet-reachable and running privileged containers?

The practical difference is scope. Defender for Endpoint is the right tool when you need device- or server-level telemetry and response. Defender for Cloud is the right tool when you need to find and prioritize cloud risk across subscriptions, accounts, projects, identities, networks, and workload types.

The overlap is real for servers. A Windows Server or Linux VM in Azure, AWS, GCP, or on-premises is both an endpoint and a cloud workload. Defender for Endpoint can inspect its processes, scripts, logons, network activity, files, and suspicious behavior. Defender for Cloud can assess whether the VM is internet-facing, missing endpoint protection, vulnerable, governed by weak network rules, tied to excessive permissions, or part of a broader attack path.

A common licensing mistake is assuming Microsoft 365 E5 covers every security need. Microsoft 365 E5 includes Defender for Endpoint capabilities for users and their devices, but it does not automatically provide full cloud posture management across Azure subscriptions, AWS accounts, GCP projects, Kubernetes clusters, SQL resources, storage accounts, and container registries. Server coverage also needs to be planned separately, commonly through Microsoft Defender for Servers in Defender for Cloud or eligible server licensing.

The reverse mistake is enabling Defender for Cloud and assuming all endpoints are protected. Defender for Cloud can protect cloud workloads through its plans and can help onboard servers to Defender for Endpoint, but unmanaged laptops, BYOD devices, and remote workstations still require endpoint onboarding, policy, and EDR operations.

Use this rule: Defender for Endpoint is asset-level runtime defense. Defender for Cloud is environment-level cloud risk management. For servers, they complement each other; they do not replace each other.

Microsoft renamed its cloud security products at Ignite in November 2021, so older documentation, scripts and audit reports use names that no longer exist. Azure Security Center and Azure Defender became Microsoft Defender for Cloud. Azure Sentinel became Microsoft Sentinel. Microsoft Cloud App Security became Microsoft Defender for Cloud Apps. The paid Azure Defender plans became the Microsoft Defender plans inside Defender for Cloud: Defender for Servers, Defender for Storage, Defender for SQL and the rest.

The Defender name now covers six products that do different jobs, and licensing conversations go wrong when two of them are confused:

• Microsoft Defender Antivirus: the antimalware engine built into Windows. No license needed.
• Microsoft Defender for Endpoint: the endpoint security, EDR and vulnerability management platform, sold as Plan 1 or Plan 2.
• Microsoft Defender for Business: the small-business edition of Defender for Endpoint, included in Microsoft 365 Business Premium and sold standalone.
• Microsoft Defender XDR: the incident and investigation layer in the Defender portal that correlates endpoint, identity, email and SaaS signals.
• Microsoft Sentinel: the SIEM and SOAR platform, billed on data ingested through Azure.
• Microsoft Defender for Cloud: posture management and workload protection for Azure, AWS, GCP and Azure Arc-connected servers, billed through Azure.

Our Defender XDR and Sentinel vs third-party tools article covers the layers above the two products compared here.

Consider a common Azure audit finding: a temporary test VM still has RDP open to the internet. It runs outdated software, uses a local administrator account, and has a managed identity with more permissions than required. The subscription has no clear owner, and the network security group rule was added during a release deadline.

Defender for Cloud should flag the risk before compromise: public exposure, high-severity vulnerability, missing or unhealthy endpoint protection, excessive permissions, and the VM’s role in an attack path. With Microsoft Defender CSPM enabled, the value is correlation: the VM is not just one misconfigured asset; it is a reachable workload with exploitable weaknesses and access that could affect other resources.

Defender for Endpoint becomes critical when an attacker interacts with the VM. It can detect suspicious sign-ins or logon patterns, malware execution, credential access, unusual child processes, living-off-the-land commands, and lateral movement attempts. Analysts can isolate the machine, review the device timeline, collect evidence, and understand what ran on the server.

With only Defender for Endpoint, you may detect activity after execution but miss the cloud exposure and identity chain that made the VM valuable. With only Defender for Cloud, you may know the VM is risky but lack deep process-level telemetry when tools actually run on the server.

Licensing is where teams often overspend or leave gaps. Defender for Endpoint for user devices is licensed per user, and the numbers are public. Microsoft list price, October 2026 price list, annual term: Defender for Endpoint Plan 1 is $36.00 per user per year ($3.00 per month), Plan 2 is $62.40 ($5.20 per month), and Defender for Business is $36.00 ($3.00 per month) or included in Microsoft 365 Business Premium at $264.00 per user per year ($22.00 per month). Microsoft 365 E5 at $720.00 per user per year ($60.00 per month) includes Plan 2; a Microsoft 365 E3 tenant at $468.00 ($39.00 per month) can add the Defender for Endpoint P2 add-on for $36.00 per user per year ($3.00 per month). Our Defender for Business vs Plan 1 vs Plan 2 guide picks between them by company size.

Server protection is different from user endpoint licensing. An on-premises server that will never be connected to Azure can carry a per-server license: Defender for Endpoint Server at $62.40 per server per year ($5.20 per month) or, in a Business Premium tenant, Defender for Business servers at $36.00 per server per year ($3.00 per month), Microsoft list price, October 2026 price list. Servers in Azure, AWS, GCP or connected through Azure Arc are usually covered instead by Defender for Servers Plan 1 or Plan 2, which are Microsoft Defender for Cloud plans billed per server through your Azure subscription; Microsoft describes Defender for Endpoint as licensed as part of Defender for Servers. Plan capabilities differ, including depth of threat protection, vulnerability management, agentless scanning, file integrity monitoring and adaptive application controls. Do not license the same server both ways.

Defender for Cloud is priced by protected workload, resource or transaction volume rather than per user: Defender for Servers, Defender for Storage, Defender for SQL, Defender for Containers and Microsoft Defender CSPM, which is priced per billable resource on top of Microsoft's free foundational CSPM tier. None of these are on the October 2026 commercial price sheet because they are Azure meters, so we size them from your resource inventory before work begins, and the charge is always yours.

A useful licensing review starts with four inventories: user endpoints, servers across Azure/AWS/GCP/on-premises, cloud scopes such as subscriptions/accounts/projects, and high-risk services such as Kubernetes, SQL, storage, container registries, and key vaults. Then map coverage. If 1,200 laptops are protected but 80 Azure VMs and 14 AWS EC2 instances are not onboarded, that is a server EDR gap. If every server has EDR but no one reviews public exposure, identity paths, insecure configurations, or regulatory drift, that is a posture gap.

Do not enable broad plans without owners for recommendations, alert triage, exceptions, and remediation SLAs. Defender tools surface risk; they do not fix ownership, change control, or infrastructure-as-code defects by themselves.

Defender for Endpoint is usually owned by the SOC, endpoint engineering, or IT operations team. Their work includes device onboarding, security baselines, attack surface reduction rules, antivirus and EDR policy tuning, alert response, device isolation, live response, investigation, and integration with Microsoft Defender XDR or Microsoft Sentinel.

Defender for Cloud needs shared ownership across cloud platform, security architecture, compliance, DevOps, and application teams. Many findings require infrastructure changes: tightening network security groups, removing public storage access, reducing Entra ID and managed identity permissions, enforcing private endpoints, patching images, hardening Kubernetes admission controls, updating Terraform/Bicep templates, or changing deployment pipelines.

This ownership difference changes the operating model. Endpoint alerts usually require rapid response: isolate, investigate, remediate. Cloud posture findings require governance: assign service owners, prioritize by exposure and business impact, fix in code, prevent recurrence with Azure Policy or equivalent controls, and track exceptions. If two analysts are expected to manually chase every Defender for Cloud recommendation across dozens of subscriptions, the program will stall.

A deployment that works is more than a license assignment. The order we use:

1. Inventory operating systems, server workloads, mobile devices, management tools and the licenses already in the tenant.
2. Choose the plan per asset class: Defender for Business, Plan 1 or Plan 2 for user devices; Defender for Endpoint Server or Defender for Business servers for on-premises servers; Defender for Servers through Defender for Cloud for cloud and Arc-connected servers.
3. Prepare the Defender portal: roles, device groups, alert notifications and the Microsoft Sentinel or ticketing integration.
4. Onboard devices through Intune where possible, through Group Policy, Configuration Manager or a local script where not, and servers through Defender for Cloud.
5. Set protection policies: tamper protection, cloud-delivered protection, attack surface reduction rules in audit mode first, network protection, web filtering, firewall rules and the security baselines.
6. Tie device compliance to Conditional Access so a noncompliant device cannot reach Exchange Online, SharePoint or Teams.
7. Pilot, tune false positives, and write down when to isolate a device, collect an investigation package or use live response.
8. Enable Defender for Cloud on the subscriptions that hold servers, assign an owner for recommendations, then turn on the paid plans one workload type at a time.

Our Microsoft Defender for Endpoint Deployment for Intune-Managed Devices service is $3,500 per project and covers steps 3 to 7; Defender for Servers Deployment for On-Premises and Hybrid is $20 per server plus a $2,450 tenant fee. Both are quoted in writing before work begins.

If the question is “What is happening on this machine right now?” use Defender for Endpoint. If the question is “Where are our cloud environments exposed, misconfigured, or vulnerable, and what should we fix first?” use Defender for Cloud.

A company with mostly SaaS usage, few servers, and a large remote workforce should usually prioritize Defender for Endpoint maturity: onboarding, policy, attack surface reduction, EDR response, and vulnerability management. A company running production workloads in Azure or multiple clouds should not rely on endpoint tooling alone; it needs Defender for Cloud for CSPM, workload protection, regulatory posture, attack path analysis, and cloud-native prioritization.

The deployments that work connect both. Defender for Cloud can surface servers missing endpoint protection and help onboard supported servers to Defender for Endpoint through Defender for Servers. Defender for Endpoint supplies runtime evidence that shows whether a risky server is only exposed or actively abused. Together they connect exposure, exploitability, behavior, containment, and remediation.

Does Microsoft 365 E5 include Defender for Cloud?

No. Microsoft 365 E5 includes Defender for Endpoint Plan 2 for licensed users and their devices. Defender for Cloud plans are Azure meters enabled per subscription and billed on your Azure invoice, whatever Microsoft 365 suite the users hold.

Do I need Defender for Servers if my servers already run Defender for Endpoint?

Not for the same server. An on-premises server can carry a Defender for Endpoint Server or Defender for Business servers license; a server in Azure, AWS, GCP or connected through Azure Arc is covered by Defender for Servers, which includes Defender for Endpoint. Pick one path per server and keep the inventory current.

Is Azure Security Center the same thing as Microsoft Defender for Cloud?

Yes. Microsoft renamed Azure Security Center and Azure Defender to Microsoft Defender for Cloud at Ignite in November 2021. Documentation, scripts and audit findings that still use the old name describe the same service.

Is any part of Defender for Cloud free?

Microsoft's foundational CSPM tier, the secure score and recommendations across connected subscriptions, carries no charge. Microsoft Defender CSPM, Defender for Servers and the other workload plans are paid Azure meters.

Which one does a 50-person company with no servers in Azure need?

Defender for Business, included in Microsoft 365 Business Premium at $264.00 per user per year (Microsoft list price, October 2026 price list), onboarded through Intune. Defender for Cloud becomes relevant when the first Azure, AWS or GCP workload or Arc-connected server appears.

• Making sense of Microsoft's security products after the Ignite 2021 renames — Microsoft UK industry blog, published 14 December 2021, checked 2026-10-11 (Azure Security Center and Azure Defender became Microsoft Defender for Cloud; Defender for Endpoint licensed as part of Defender for Servers)
• Microsoft, US commercial price list, October 2026 (all Microsoft list prices above)