Microsoft Defender Vulnerability Management: Core vs the Add-on, and What Each Costs
Defender Vulnerability Management comes in two layers. The core layer is already inside Defender for Endpoint Plan 2, Microsoft 365 E5 and Defender for Business, so most tenants own it without knowing. The premium layer is a $2.00 per user per month add-on, or a $3.00 standalone license for tenants without Plan 2 (Microsoft list price, October 2026 price list). This article lists what sits in each layer, which license your tenant already holds, how servers are covered, and what a 100-user organization pays.
What the core includes, and what the add-on adds
Microsoft's comparison page splits Defender Vulnerability Management into core and premium capabilities. The core set ships with Defender for Endpoint Plan 2 and the plans that contain it, and Microsoft states that Microsoft 365 Business Premium and the standalone Defender for Business include the same core set. The premium set needs the Defender Vulnerability Management add-on on client devices, or the standalone license.
| Capability | Core (Plan 2, E5, Defender for Business) | Add-on or standalone |
|---|---|---|
| Device discovery and device inventory | Included | Included |
| Vulnerability assessment (software CVEs, exposure score) | Included | Included |
| Configuration assessment | Included | Included |
| Risk-based prioritization and remediation tracking | Included | Included |
| Security baselines assessment (CIS and STIG benchmarks) | Not included | Included |
| Block vulnerable applications | Not included | Included |
| Browser extensions assessment | Not included | Included |
| Digital certificate assessment | Not included | Included |
| Network share analysis | Not included | Included |
| Hardware and firmware assessment | Not included | Included |
| Authenticated scan for Windows devices without a sensor | Not included | Included |
The first four rows are the weaknesses list, exposure score, recommendations and remediation requests a Plan 2 or Business Premium tenant already sees. The remaining rows answer auditor questions: which benchmark the devices follow, which certificates expire in 30 days, which shares are open to Everyone.
Three ways to buy it, and the list prices
| License | Who it is for | Annual commitment | Monthly, no commitment |
|---|---|---|---|
| Core inside Defender for Endpoint P2 | Plan 2 standalone, Microsoft 365 E5, or the P2 add-on for E3 | $5.20 per user per month ($62.40 per year) for Plan 2 | $6.24 |
| Defender Vulnerability Management add-on | Tenants with Plan 2 that want the premium set | $2.00 per user per month ($24.00 per year) | $2.40 |
| Defender Vulnerability Management standalone | Tenants without Plan 2: Defender for Endpoint P1, Microsoft 365 E3 without the P2 add-on, or another vendor's endpoint agent | $3.00 per user per month ($36.00 per year) | $3.60 |
| Defender Vulnerability Management Add-On Server | Per-server premium coverage where the server plan does not include it | $2.00 per server per month ($24.00 per year) | $2.40 |
All prices are Microsoft list price, October 2026 price list, US commercial; a frontline-worker variant of the premium set is listed at $2.00. The standalone carries both layers, which is why it costs $1.00 more than the add-on. The add-on is the cheaper path only when Plan 2 is in place: every Microsoft 365 E5 tenant, and every E3 tenant that bought the Defender for Endpoint P2 add-on for Microsoft 365 E3 ($3.00 per user per month).
Microsoft's sign-up page says the add-on trial is not offered to Defender for Business customers, and the comparison page describes Defender for Business as carrying the core set. If you are on Business Premium and want the premium features, ask us to confirm the purchase path before you order.
Which layer your tenant already holds: a decision table
Start from the license on the user, not from the feature you want.
| Tenant | Core included? | Path to the premium set | Cost per user per month |
|---|---|---|---|
| Microsoft 365 Business Premium ($22.00) or Defender for Business ($3.00) | Yes | Confirm eligibility with us; the standalone at $3.00 is the fallback | $3.00 |
| Microsoft 365 E3 ($39.00) with no Defender for Endpoint P2 | No (E3 carries Plan 1) | Standalone, or the P2 add-on ($3.00) plus the add-on ($2.00) | $3.00, or $5.00 for both |
| Microsoft 365 E3 with the Defender for Endpoint P2 add-on | Yes | Add-on | $2.00 |
| Microsoft 365 E5 ($60.00) or Microsoft Defender Suite ($12.00 on E3) | Yes | Add-on | $2.00 |
| Defender for Endpoint P1 only ($3.00) | No | Standalone | $3.00 |
| No Microsoft endpoint license (third-party EDR) | No | Standalone, with the Defender sensor onboarded for assessment | $3.00 |
The add-on never stands on its own: it attaches to Plan 2. An E3 tenant that wants detection and response as well should price the P2 add-on plus the vulnerability add-on ($5.00 together) against the Defender Suite, using the E5 add-ons math; which Defender plan fits which size is in Defender for Business vs Plan 1 vs Plan 2.
Servers: Defender for Servers Plan 2 already carries the premium set
Servers are licensed per server, and Microsoft's comparison page is explicit: the premium capabilities are available to server devices through Microsoft Defender for Servers Plan 2, while client devices need the add-on. Defender for Servers Plan 1 carries the core set.
- Servers on Defender for Servers Plan 2 through Defender for Cloud (an Azure meter billed per server hour, with on-premises servers connected through Azure Arc): premium included. Azure Arc for the servers you are keeping covers the connection.
- Servers on Defender for Servers Plan 1: core only. Move to Plan 2 or add the per-server add-on.
- Servers on Defender for Business servers ($3.00 per server per month) or Defender for Endpoint Server ($5.20): core, with the Defender Vulnerability Management Add-On Server line at $2.00 per server per month for the premium set.
The two routes are compared in Defender for Cloud vs Defender for Endpoint; under about 20 servers the per-server license is simpler to administer.
What the premium features change in a 100-device tenant
The core set tells you what is vulnerable. The premium set tells you whether a device is configured the way you promised an auditor or an insurer, and lets you block a known-bad application.
- Security baselines assessment: pick a CIS or STIG profile for Windows 10, Windows 11 or Windows Server, assign device groups, and get a per-setting compliance view. This is the evidence a cyber insurance questionnaire asks for under "hardened to an industry benchmark".
- Block vulnerable applications: a remediation request can block a specific vulnerable version across a device group. Pilot first, warn, then block.
- Digital certificate assessment: certificates on managed devices with expiry dates, weak algorithms and short keys.
- Browser extensions assessment: which extensions are installed, on how many devices, with what permissions.
- Network share analysis: shares writable by Everyone or Authenticated Users, and shares with no access control.
- Hardware and firmware assessment: manufacturer, processor and BIOS inventory with known firmware weaknesses.
- Authenticated scan for Windows: scans devices that cannot run the sensor, using a scanner device and stored credentials.
In a 100-device tenant the first three are used weekly and the rest at audit time. If none of the seven answers a question you are asked each quarter, stay on the core set and spend the money on remediation.
A worked example: 100 users and 8 servers at list prices
Three common tenants, each with 100 users and 8 Windows servers, on the annual-commitment column of the October 2026 price list.
Tenant A: Business Premium. Core is inside the $22.00 seat through Defender for Business. Premium for clients on the standalone path: 100 × $36.00 = $3,600 per year. The 8 servers on Defender for Business servers cost 8 × $36.00 = $288 per year for the core set; the per-server add-on at 8 × $24.00 = $192 per year brings them to premium. Premium layer total: $3,792 per year.
Tenant B: Microsoft 365 E3 with the Defender for Endpoint P2 add-on. The P2 add-on costs 100 × $36.00 = $3,600 per year and brings the core set. The vulnerability add-on is 100 × $24.00 = $2,400 per year. Servers on Defender for Servers Plan 2 carry premium through the Azure meter, which is metered on your subscription. Premium layer on clients: $2,400 per year.
Tenant C: Microsoft 365 E5. Core is inside the $60.00 seat. Add-on: 100 × $24.00 = $2,400 per year. Servers as in Tenant B.
The spread is small because the premium layer is priced the same everywhere; what differs is whether you also pay for Plan 2. The larger number in every tenant is the time to act on the findings. Our vulnerability remediation service is $175 per hour, the ASR-based fixing module is $900 per project, and Managed Vulnerability Remediation is $8 per device per month; each is quoted in writing before work begins.
The 90-day trial and the order of work
Microsoft's sign-up page offers a 90-day trial of the add-on to tenants that hold Defender for Endpoint Plan 2, and a trial of the standalone to new customers and to Defender for Endpoint P1 or Microsoft 365 E3 tenants. It is not available to Defender for Business, GCC High or DoD tenants, and the features can take up to six hours to appear after activation.
- Onboard every device to Defender for Endpoint; the assessment needs the sensor. Our Defender for Endpoint deployment for Intune-managed devices is $3,500 per project.
- Read the core findings for two weeks and fix the recommendations with the largest exposure reduction.
- Start the trial. Assign the CIS baseline to a pilot group, run the certificate and share reports once, and decide whether they answer questions you are asked.
- Buy the add-on or standalone for the users who need it; the license is per user, so a subset aligned with device groups is fine.
- Hand remediation to a named person or a service. An untracked request is the usual reason an exposure score stops moving.
Frequently asked questions
Is there a free tier of Defender Vulnerability Management, and what does it cover?
There is no free tier of Defender Vulnerability Management; the core layer rides along with a license you already pay for. Defender for Endpoint Plan 2, Microsoft 365 E5, Defender for Business and Business Premium carry device discovery, inventory, vulnerability assessment, configuration assessment, prioritization and remediation tracking without any extra purchase.
Is Defender Vulnerability Management included in Microsoft 365 E5?
The core capabilities are, because E5 carries Defender for Endpoint Plan 2. The premium capabilities, such as security baselines assessment and blocking vulnerable applications, need the add-on at $2.00 per user per month (Microsoft list price, October 2026 price list).
Does Defender for Business include vulnerability management?
Yes, the core set. Microsoft's comparison page states that Microsoft 365 Business Premium and the standalone Defender for Business include the capabilities listed under Defender for Endpoint Plan 2. The add-on trial is not offered to Defender for Business tenants, so ask before assuming the premium set can be added.
What is the difference between the add-on and the standalone license?
The add-on ($2.00) assumes you hold Defender for Endpoint Plan 2 and adds the premium set. The standalone ($3.00) carries both sets and is meant for Defender for Endpoint P1, Microsoft 365 E3 without the P2 add-on, or a third-party endpoint product.
Do servers need the Defender Vulnerability Management add-on?
Not on Defender for Servers Plan 2 through Defender for Cloud; Microsoft states the premium set is included there. Plan 1 carries the core set only. Servers licensed per server can take the per-server add-on at $2.00 per server per month.
How much does Defender Vulnerability Management cost per user?
$2.00 per user per month as an add-on to Plan 2, $3.00 standalone, both on an annual commitment; $2.40 and $3.60 with no commitment. A 100-user tenant pays $2,400 or $3,600 per year.
Sources
- Compare Microsoft Defender Vulnerability Management plans and capabilities — Microsoft Learn, read through search excerpts on 2026-10-11 (core and premium split, servers, Defender for Business)
- Sign up for Microsoft Defender Vulnerability Management — Microsoft Learn, read through search excerpts on 2026-10-11 (trial terms)
- Microsoft Defender Vulnerability Management adds new premium capabilities — Petri IT Knowledgebase, checked 2026-10-11 (premium feature list)
- Microsoft Defender Vulnerability Management pricing — Redmond Magazine, 10 August 2023, checked 2026-10-11
- Microsoft list price, October 2026 price list, US commercial, for every price quoted above
Key takeaways
- The core layer (discovery, inventory, vulnerability and configuration assessment, prioritization, remediation tracking) is inside Defender for Endpoint Plan 2, Microsoft 365 E5, Defender for Business and Business Premium.
- The premium layer (security baselines, blocking vulnerable apps, certificates, browser extensions, network shares, firmware, authenticated scan) is a $2.00 add-on on Plan 2 or a $3.00 standalone (Microsoft list price, October 2026 price list).
- Servers get the premium set through Defender for Servers Plan 2; Plan 1 and the per-server licenses carry the core set, with a $2.00 per-server add-on on the price list.
- A 100-user tenant pays $2,400 per year on E5 or E3 with the P2 add-on, and $3,600 per year on the standalone path.
- Microsoft's 90-day trial covers the add-on for Plan 2 tenants and the standalone for P1, E3 and new tenants, but not Defender for Business.
- Buy the premium set only when a feature answers a question you are asked each quarter; otherwise spend the money on remediation.
If the devices are not yet onboarded, start there: the Defender for Endpoint deployment for Intune-managed devices ($3,500 per project, quoted in writing before work begins) onboards the fleet, turns on the vulnerability assessment and leaves you with a remediation list you can act on. If you would rather have us check which layer your tenant already holds first, book a 30-minute call.
Questions this article didn’t answer?
Thirty minutes with Mike — our CEO, not a sales rep. Bring the hard version of the question.