Microsoft Defender for Business: Features, Cost, and Setup

Microsoft Defender for Business is Microsoft’s endpoint security product for organizations with up to 300 users. It adds endpoint detection and response (EDR), vulnerability reporting, and central management on top of the antivirus built into Windows, and it also covers Mac, iOS, and Android devices. You can buy it on its own for $3.00 per user per month, paid yearly, or get it as part of Microsoft 365 Business Premium at $22.00 per user per month, paid yearly (Microsoft list prices as of September 2026). It is not included in Business Basic or Business Standard.

This guide covers the product itself. For the broader question of antivirus versus EDR versus a managed service, see our endpoint protection guide.

What is included in Defender for Business?

Microsoft’s product overview lists these capabilities:

• Next-generation protection. Antivirus and anti-malware using Microsoft Defender Antivirus, managed centrally.
• Attack surface reduction. Rules that block behavior commonly tied to attacks, such as Office apps launching scripts, plus controlled folder access (a ransomware mitigation), network protection, and firewall management.
• Endpoint detection and response. A recorded view of suspicious activity on each device, with alerts and the option to isolate a device.
• Automated investigation and remediation. The service examines alerts and can resolve many of them without waiting for a person.
• Automatic attack disruption. Containment actions that trigger when an attack in progress is detected.
• Vulnerability management (core capabilities). A running list of missing updates and risky settings on enrolled devices, ranked by priority.
• Web content filtering. Category-based website blocking on managed devices. Microsoft notes that only one web filtering policy per organization is supported.
• Monthly security summary reports and a simplified setup wizard.

Everything is managed in the Microsoft Defender portal at security.microsoft.com.

Which Microsoft 365 plans include it?

How you get it	List price (September 2026)	Notes
Defender for Business standalone	$3.00 per user per month, paid yearly	Can be added to Business Basic, Business Standard, or used without Microsoft 365. Does not include Intune.
Microsoft 365 Business Premium	$22.00 per user per month, paid yearly	Includes Defender for Business plus Intune, Entra ID P1 (needed for Conditional Access), Defender for Office 365 Plan 1, and the Office apps.
Business Basic or Business Standard	Not included	Devices rely on built-in Microsoft Defender Antivirus unless you add something.

Each user license covers up to five client devices, and the ceiling is 300 users.

Servers are separate. Microsoft’s Defender for Business FAQ prices the Defender for Business servers add-on at $3 per server instance, for Windows Server or Linux, with a limit of 60 servers.

To see what you have today, open the Microsoft 365 admin center and go to Billing, then Licenses. Our comparison of Business Premium and Business Standard covers the rest of what the higher plan adds.

Standalone or Business Premium: which makes sense?

The standalone license is the cheaper way to get EDR. The catch is management. Microsoft states that the standalone version does not include Intune, and that attack surface reduction rules and controlled folder access must be configured through Intune (or, without it, through Group Policy or PowerShell on each device). In a small office without a Windows domain, that makes the more advanced protections hard to roll out.

Business Premium costs more per user but brings Intune device management, Conditional Access, and email protection in one license. If your staff already need the Office desktop apps and you want device compliance tied to sign-in, Premium is usually the simpler path. If you only need EDR on a few machines and already have another way to manage them, standalone can be enough.

How do you set up Defender for Business?

Microsoft documents a six-step setup process, with an optional wizard that handles most of it for Windows devices.

1. Get the license. Buy or trial the standalone product or Business Premium.
2. Add users and assign licenses in the Microsoft 365 admin center under Users, then Active users. Microsoft says to make sure multi-factor authentication is on for everyone at this stage.
3. Assign security roles. Give the people who will manage alerts the Security Administrator or Security Reader role.
4. Set up email notifications so alerts and new vulnerabilities reach a real inbox.
5. Onboard devices. In the Defender portal, go to Settings, then Endpoints, then Onboarding. For Windows you can use a local script (Microsoft recommends no more than 10 devices at a time this way), Group Policy, or Intune. Devices already enrolled in Intune can be onboarded automatically. Macs use a local script or Intune. Phones use the Microsoft Defender app or Intune.
6. Review security policies. Default policies for next-generation protection and firewall apply right away. Web content filtering and attack surface reduction rules have to be set up separately.

After first sign-in, provisioning can take up to 24 hours. You will know it is done when Assets, then Devices, shows a device list rather than a “preparing” message.

Check that it works

Microsoft provides two simple tests in its device onboarding guide. On a Windows device you can run a harmless detection test script, and an alert should appear in the portal within about 10 minutes. On any onboarded device, browsing to Microsoft’s phishing test address should be blocked and logged under Incidents. Run one of these on every new device. It takes a minute and proves the device is actually reporting.

How long does setup take?

For a small office, plan for a few hours of onboarding work spread over a day or two, because of the provisioning wait. Tuning attack surface reduction rules takes longer, because the safe approach is to run them in audit mode first, see what your line-of-business software would trip, and only then switch to block mode.

What are the limits?

• Windows editions. Managed Windows devices must run Windows 10 or 11 Pro, Business, or Enterprise. Windows Home is not on Microsoft’s requirements list. Macs must be on one of the three most recent macOS releases.
• No advanced hunting. Compared with the enterprise product, Defender for Endpoint Plan 2, Defender for Business leaves out advanced hunting with six months of data retention and the Microsoft Threat Experts service.
• No mixed licensing. If some users have Defender for Business and others have Defender for Endpoint Plan 2, the whole organization gets the Defender for Business experience.
• Other antivirus can interfere. Microsoft says a non-Microsoft antivirus can turn off real-time protection, which makes a device show as unprotected.
• Windows 10 has reached end of support. Defender still runs on it, but Windows 10 stopped receiving regular security updates on October 14, 2025 unless the device is enrolled in Extended Security Updates. See our Windows 10 end-of-life guide.
• It is one layer. It does not filter email (that is Defender for Office 365), protect sign-ins (Entra ID), or back up data.

The biggest limit is not technical. Defender for Business generates alerts and recommendations, and someone has to read them. Automated remediation handles a lot, but decide up front who receives notifications and what they do with a high-severity alert.

When you do not need it

If your devices are Windows Home editions, it will not manage them. If you already run another EDR product that someone actively monitors, adding Defender for Business on top creates conflict, not extra safety. And a very small office with no sensitive data on its computers may be served well enough by built-in Defender Antivirus, automatic updates, multi-factor authentication, and good backups.

Common questions

Is Defender for Business the same as Windows Security?

No. Windows Security is the app on each PC that shows Microsoft Defender Antivirus status. Defender for Business is a paid cloud service that manages that antivirus centrally and adds EDR, vulnerability reporting, automated investigation, and coverage for Mac and mobile devices, all viewed from the Microsoft Defender portal.

Does Defender for Business work on Macs and phones?

Yes. Microsoft supports Windows, macOS, iOS, iPadOS, and Android. Macs are onboarded with a local script or Intune. Phones are onboarded with the Microsoft Defender app or Intune. On iOS, the app asks permission to add a VPN configuration as part of onboarding.

Do we need Intune to use it?

Not for the basics. The standalone product has a simplified configuration experience in the Defender portal. You do need Intune, or Group Policy and PowerShell, to deploy attack surface reduction rules and controlled folder access. Intune Plan 1 is included in Business Premium.

Can we keep our current antivirus alongside it?

It is possible, but Microsoft warns it can leave real-time protection off on those devices. In most small offices it is cleaner to use Microsoft Defender Antivirus as the single antivirus once Defender for Business is in place, and remove the old product after confirming every device is onboarded.

How we can help

Coastal Growth Co. can check which licenses you already hold, onboard your devices, set policies in audit mode before enforcing them, and agree with you on who receives alerts. This fits inside our Microsoft 365 and cloud email work or an ongoing managed IT arrangement. Scope and price are agreed before paid work begins. Contact us to get started.