Evaluate a working system
- Start with supported device coverage and an owner for alerts, not a feature count.
- Test one approved detection, investigation, isolation and recovery workflow.
- Check included capabilities in your current subscription before comparing incremental cost.
- Separate software features from a staffed managed-detection service.
Last updated: September 25, 2026
Endpoint marketing lists often combine prevention, EDR, XDR and MDR into a single impression of protection. These are different capabilities and service commitments. The endpoint implementation guide explains the operating baseline; this page is a buying test for teams with a documented gap. CISA's StopRansomware Guide treats endpoint controls as part of wider prevention and response, not a substitute for updates or backups.
The evaluation matrix
| Capability | Ask the vendor | Pilot evidence |
|---|---|---|
| Platform coverage | Which exact Windows, macOS, Linux, server and mobile versions are supported on this plan? | Agent healthy on representative devices |
| Prevention | Which policy is assigned and how are exclusions governed? | Approved test or configuration review |
| Detection | What telemetry and alerts are available on this edition? | Alert reaches a named responder |
| Investigation | Can the responder see device, user and event context? | Test ticket with decision trail |
| Containment | Who can isolate, reverse isolation and protect a critical host? | Controlled exercise and rollback |
| Operations | How are failed agents, updates and missing devices flagged? | Coverage and exception export |
| Service | Which hours and actions are staffed under a separate MDR contract? | Written scope and escalation test |
| Exit | How are logs and policies exported or removed? | Documented offboarding plan |
A detection demonstration on a vendor laptop is not the same as a repeatable pilot on your fleet. Record false positives, support effort and the time needed for your team to understand an alert. A product with deep telemetry may still be a poor fit if no one can respond after hours.
Check what is already included
Microsoft documents Defender for Business as included in Microsoft 365 Business Premium. Check the exact tenant edition, enrolled devices, policy and alert routing before adding another endpoint license. Other security suites may also include relevant capabilities. The Microsoft Defender review and endpoint shortlist discuss plan-specific fit; do not assume every plan has the same platform support or service level.
Ask for a real quote
Count supported devices, servers and any minimum-seat rules using the vendor's billing unit. Add deployment assistance, management time, log retention, support hours, renewal price and contract term. If the remaining need is staffing rather than a sensor, compare the MDR service's response scope and authority. If the need is missing updates, a patch-management workflow may be the better first fix; NIST SP 800-40r4 treats patching as preventive maintenance.
A pass/fail pilot
Reconcile a small sample of devices with the console. Trigger an approved low-risk alert, trace who receives it, test the decision to isolate and restore normal access, and verify a leaver's device is handled. Have the business owner judge the operational disruption. If the pilot fails, record whether the cause is missing product capability, poor configuration or unstaffed operations before buying a higher tier.
Decision rule
Choose the plan that closes a specific tested gap at a support burden the team can sustain. A higher feature count without coverage and response ownership does not meet that rule.
Sources checked September 25, 2026: CISA StopRansomware Guide, Microsoft Defender for Business overview, and NIST SP 800-40r4. This is documentation-based evaluation guidance, not a comparative hands-on test.