# Defender for Business servers add-on vs Defender for Servers Plan 1 and Plan 2: licensing for the servers you still run > Server protection is licensed separately from user licenses. The Defender for Business servers add-on (per server, up to sixty) against Defender for Servers Plan 1 and Plan 2 (Azure, per hour): what each covers and which fits your estate. Canonical: https://o365hq.com/blog/defender-for-business-servers-add-on-vs-defender-for-servers-plan-1-and-plan-2 Provider: IT Partner LLC — US Microsoft partner since 2006. Book: https://o365hq.com/book Published: 2026-11-09 · IT Partner Most 20 to 500 person organizations protect their laptops with Defender for Business or Defender for Endpoint and then discover that the file server, the domain controllers and the line-of-business host are not covered by any of those user licenses. Servers are licensed separately, through one of two routes, and the right route depends on how many servers you have, where they run and whether you already use Azure. ## Why user licenses do not cover servers Defender for Business, Defender for Endpoint Plan 1 and Plan 2, and the Microsoft 365 suites that include them are per-user licenses. Each licensed user may onboard up to five devices they use, and Microsoft's terms define those devices as client operating systems: Windows 10 and 11, macOS, iOS and Android. A Windows Server or Linux server is not a user's device, so onboarding it under a user license is a licensing gap even though the sensor installs and reports happily. Microsoft closes the gap with two products. The Defender for Business servers add-on is a per-server license sold alongside Defender for Business or Microsoft 365 Business Premium. Defender for Servers is a plan inside Microsoft Defender for Cloud, billed per server per hour through an Azure subscription. Both deliver the Defender for Endpoint sensor, antivirus, attack surface reduction, endpoint detection and response and the vulnerability management view; they differ in ceiling, extras and how the charge arrives. ## The Defender for Business servers add-on The add-on is the simple route for the smaller estate. It is a subscription license per server, bought through the same channel as the rest of the Microsoft 365 licensing, and it requires at least one Defender for Business or Business Premium license in the tenant. Microsoft limits a tenant to sixty server add-ons, matching the three-hundred-user ceiling of the Business plans. What you get is the Defender for Business feature set applied to Windows Server 2012 R2 and later and to supported Linux distributions: next-generation antivirus, attack surface reduction rules, endpoint detection and response with automated investigation, the Defender Vulnerability Management core capabilities, and the same portal and alert queue as the workstations. Onboarding is through the portal's onboarding package or through Intune for servers enrolled there; Azure Arc is not required. The add-on is the fit when you have fewer than sixty servers, no Azure footprint to speak of, and you want one invoice line per server at a fixed monthly price rather than an hourly meter. Its price is on the plan page, quoted as Microsoft list price from the November 2026 price list. ## Defender for Servers Plan 1 and Plan 2 Defender for Servers is enabled per Azure subscription in Microsoft Defender for Cloud and charged per protected server per hour, prorated, on the Azure invoice. Azure virtual machines are covered automatically when the plan is on. On-premises and other-cloud servers are covered once they are connected through Azure Arc, which makes them appear as Azure resources; Arc itself has no charge for the connection. Plan 1 is Defender for Endpoint Plan 2 for servers: the full sensor, endpoint detection and response, automated investigation, threat analytics and the vulnerability management core, integrated into Defender for Cloud's recommendations. Plan 2 adds the Defender for Cloud layer: agentless scanning for vulnerabilities and malware on virtual machine disks, file integrity monitoring, just-in-time virtual machine access, adaptive application controls, regulatory compliance dashboards, premium Defender Vulnerability Management features such as certificate and browser extension assessment, and a daily data allowance for security logs ingested into a Log Analytics workspace. Because the meter is hourly, a server that runs eight hours a day or is deallocated at night costs a fraction of one that runs around the clock, and there is no tenant ceiling. The charge is a Microsoft consumption charge on your Azure subscription and, like all Azure consumption, is yours whether you buy Azure direct or through a partner's Azure plan. ## Which servers each route supports Both routes support Windows Server 2012 R2 (with the modern unified sensor), 2016, 2019, 2022 and 2025, and the mainstream Linux distributions Microsoft lists for the Defender for Endpoint sensor. Windows Server 2008 R2 and 2012 are out of support for the sensor and should be isolated rather than licensed. Windows Server 2016 reaches the end of extended support on 12 January 2027. A 2016 server that stays in production on Extended Security Updates still needs endpoint protection, and both routes cover it; the ESU enrollment through Azure Arc and the Defender for Servers plan can share the same Arc connection. The same applies to the Windows Server 2012 R2 machines whose ESU ended in October 2026 and that are now in isolation plans. ## Decision rules by estate Fewer than fifteen servers, mostly on-premises, Business Premium in the tenant, no Azure subscription: the Defender for Business servers add-on. One license per server, no Arc, no hourly meter. Fifteen to sixty servers with some already in Azure: usually Defender for Servers Plan 1 on the Azure subscription, with the on-premises machines connected through Arc so that one plan and one portal cover everything. The hourly meter rewards servers that are not always on. More than sixty servers, or any estate with an Enterprise plan (Microsoft 365 E3 or E5) rather than Business Premium: Defender for Servers, because the add-on is not available and its ceiling would be exceeded anyway. Choose Plan 2 where you need file integrity monitoring for a compliance framework, agentless scanning of virtual machine disks, or the log ingestion allowance to feed Microsoft Sentinel. Mixed estates can run both: the add-on on the on-premises servers and Defender for Servers on the Azure virtual machines. Both report into the same Defender portal. ## What is Microsoft's charge and what is the partner's The add-on is a subscription license: a fixed monthly amount per server, bought through IT Partner at Microsoft's list price and invoiced with the rest of your Microsoft 365 licensing. Defender for Servers is Azure consumption: per server per hour, metered by Microsoft and invoiced through whichever Azure billing route you use. Azure Arc onboarding for the servers you keep on-premises, the sensor deployment, the policy baseline and the alert routing are the implementation work, which is what IT Partner's deployment services cover at a fixed price. Microsoft's licensing and consumption charges are always yours. ## Frequently asked questions ### Can I onboard a server under a user's Defender for Business license? No. User licenses cover client operating systems. Servers need the servers add-on or Defender for Servers. ### Do I need Azure to use the Defender for Business servers add-on? No. The add-on is a Microsoft 365 license and onboards through the portal package or Intune. Azure Arc is only needed for Defender for Servers on non-Azure machines. ### How many servers can the add-on cover? Up to sixty per tenant, and the tenant must hold Defender for Business or Microsoft 365 Business Premium. ### What does Defender for Servers Plan 2 add over Plan 1? Agentless disk scanning, file integrity monitoring, just-in-time access, adaptive application controls, regulatory compliance views, premium vulnerability management features and a daily log ingestion allowance. ### Does Defender for Servers cover a server that is turned off? The meter is hourly and prorated, so a deallocated or powered-off server is not charged for the hours it is off. ### Which route for Windows Server 2016 on ESU after January 2027? Either. If you enroll ESU through Azure Arc, Defender for Servers can use the same Arc connection. ## Sources - Microsoft Learn, "Microsoft Defender for Business servers" (licensing, the sixty-server limit and supported operating systems), consulted November 2026. - Microsoft Learn, "Overview of Microsoft Defender for Servers" and "Select a Defender for Servers plan" (Plan 1 and Plan 2 features, hourly billing), consulted November 2026. - Microsoft Learn, "Minimum requirements for Microsoft Defender for Endpoint" (supported server versions), consulted November 2026. - Microsoft Lifecycle, Windows Server 2016 end of extended support 12 January 2027, consulted November 2026. - Microsoft Product Terms, Microsoft Defender for Endpoint device rights (five devices per licensed user, client operating systems), consulted November 2026. ## Key takeaways - User licenses for Defender for Business and Defender for Endpoint cover client devices only; every server needs the servers add-on or Defender for Servers. - The Defender for Business servers add-on is a fixed per-server subscription, capped at sixty per tenant, and needs no Azure. - Defender for Servers is Azure consumption billed per server per hour through Defender for Cloud; Plan 2 adds agentless scanning, file integrity monitoring and a log allowance. - Under fifteen on-premises servers with Business Premium: the add-on. Azure present or more than sixty servers: Defender for Servers, with Arc for the on-premises machines. --- Send us the server count, the operating systems and whether you have an Azure subscription, and we will say which route fits and price the onboarding.