Microsoft Defender for Business: check your existing subscription first

Verdict: strong value if you are already on Microsoft 365, but it is a tool, not a service

Microsoft Defender for Business is a credible endpoint protection and detection layer for small businesses that already run Microsoft 365. It costs $3 per user per month as a standalone subscription, covers up to five devices per user on Windows, macOS, iOS and Android, and is included in Microsoft 365 Business Premium at $22 per user per month. It combines next-generation antivirus, endpoint detection and response with automatic attack disruption, vulnerability management and automated investigation. The catch is that nobody monitors it for you: without a named person or a managed provider reviewing alerts, the license protects less than it appears to. Check your subscription before buying anything else. Prices below were checked October 27, 2026.

The buying brief

What it includes

Microsoft's product page lists these capabilities for Defender for Business: next-generation antivirus, vulnerability management to find weaknesses, attack surface reduction, AI-powered endpoint detection and response with automatic attack disruption, automated investigation and remediation, wizard-based onboarding and monthly security summary reports. It supports up to 300 users and up to five devices per user with no minimum, across Windows, macOS, iOS and Android.

Defender for Business is built on Defender for Endpoint, which is aimed at larger organizations and adds deeper configuration and advanced hunting. For more than 300 users, Microsoft recommends Defender for Endpoint. The antivirus built into Windows, Microsoft Defender Antivirus, provides next-generation protection on Windows devices; Defender for Business adds threat and vulnerability management, attack surface reduction, EDR and automated investigation and response.

What it costs at 10, 25 and 50 users

Microsoft lists Defender for Business at $3.00 per user per month, paid yearly, as an annual subscription that auto-renews, before tax. Servers are not covered by the user license. The servers add-on is $3 per server instance per month, available with Defender for Business or Business Premium, and limited to 60 server licenses.

The comparison to watch is Business Standard plus add-ons against Business Premium. Standard ($14) plus Defender for Business ($3) plus Defender for Office 365 Plan 1 ($2) is $19, and Business Premium is $22. The extra $3 buys Intune Plan 1 for device management, Entra ID Plan 1 for conditional access and multi-factor policies and Purview information protection. If you would use those, Premium is usually the better value. If you only want endpoint protection and already manage devices another way, standalone Defender for Business at $3 is the cheaper route. Our Defender for Office 365 review covers the email add-on.

Microsoft offers a one-month free trial that converts to a paid subscription unless you cancel, and a 7-day cancellation window for a prorated refund after the paid period starts. When a subscription is cancelled, associated data is deleted, so export what you need first.

Strengths and limits

Buying protection and enabling protection are different

An included license has little operational value if devices are not enrolled, reporting and assigned the intended policy. Microsoft 365 Business Premium makes Defender for Business available, but it does not onboard your laptops. For a small firm, the following sequence works.

1. Inventory devices. List every laptop, desktop, phone and server, including personal devices that touch business data and anything unmanaged.
2. Onboard a pilot group. Use the setup wizard on three to five devices, then check that required business applications still work and note any exclusions.
3. Assign alert ownership. Name who reviews the monthly security summary and the incident queue, how quickly, and who escalates.
4. Expand in batches. Cover the rest by department and record any device that fails to report.
5. Check coverage monthly. Look for devices that are missing, inactive or running an outdated agent.

Use vendor-supported test procedures to confirm that detection works, and do not introduce live malware into a production environment. Keep backup recovery checks separate from endpoint checks, because detecting an incident and restoring operations require different evidence.

Defender Antivirus, Defender for Business and Business Premium: untangling the names

Microsoft's naming is the most common source of confusion, and it affects what you pay. There are three layers worth separating.

Microsoft Defender Antivirus is built into Windows and is on by default. It provides next-generation malware protection on Windows devices at no extra cost, but it does not give you a central view of alerts across a fleet or a managed response workflow.

Defender for Business adds the management and response layer. You get a portal where you can see every enrolled device, a vulnerability list, automated investigation and EDR with attack disruption, and protection across Windows, macOS, iOS and Android. This is the $3 product.

Microsoft 365 Business Premium bundles Defender for Business with Defender for Office 365 Plan 1, Intune Plan 1, Entra ID Plan 1 and Purview capabilities, plus the productivity apps. This is the $22 suite. If you are already paying for Premium, you probably own Defender for Business without having switched it on, which is the most useful discovery most small firms make during this exercise.

What to expect in the first month

In the first week after onboarding, expect a list of devices with missing patches, outdated software and risky configuration. That is the vulnerability management feature working, and it can look alarming. Prioritize internet-facing devices, laptops of administrators and finance staff, and anything running an unsupported operating system. In weeks two to four, expect a handful of alerts, most of them low severity or false positives from legitimate tools such as remote-support software, and plan to review each one and record the decision. By the end of the month you should know which devices are not reporting, which exclusions you needed, and who is responsible for the portal.

If the portal produces more alerts than your team can review, tune the policies rather than ignoring the alerts. If it produces none, confirm that detection is working with a vendor-supported test and check that devices are really reporting, because silence is not evidence of safety.

Who actually watches the alerts?

This is the question that decides whether Defender for Business is a good purchase. Microsoft says automated investigation and response resolves most threats without manual work, and that attack disruption can contain compromised users and devices automatically. That helps a firm with no security staff. It does not mean no one ever needs to look. Alerts that require judgment, a device that stops reporting, or a new vulnerability on an internet-facing machine all need a human decision.

If you have an IT contractor, ask in writing whether they will monitor the Defender portal, how fast they respond to a high-severity alert and what that costs. If you do not, consider a managed detection and response service, or an endpoint product bundled with monitoring, and compare the full cost against $3 per user. Our endpoint protection buying guide lists the alternatives, and our CrowdStrike Falcon Go and Malwarebytes reviews cover two of them.

When should you evaluate another product?

Compare alternatives if your device mix, administration workflow or support needs differ from what Microsoft provides. A team that needs a managed response service should say so explicitly, because endpoint software and a staffed service are different purchases. Firms that do not use Microsoft identity may also prefer a vendor-neutral product with its own console. Include implementation effort, ongoing administration and response ownership in the comparison, as well as license cost.

Security and evidence

This review is based on Microsoft's product page, its Defender for Business FAQ and pricing information. We have not deployed Defender for Business for a client, run detection tests, or compared its protection with other products. Microsoft cites analyst recognition for its endpoint platform, but those reports describe the broader enterprise product and are the vendor's choice of evidence. A subscription does not establish regulatory compliance on its own.

Alternatives: when to look elsewhere

• CrowdStrike Falcon Go. Cloud-delivered endpoint protection with a different console and pricing. See our Falcon Go review.
• Malwarebytes. A simpler option for small teams. See our Malwarebytes review.
• Managed detection and response. If nobody will watch alerts, buy the monitoring, not just the software.
• Patch management. Endpoint protection does not replace patching. See our Action1 review and vulnerability scanning vs patch management guide.

Before you buy

1. Check whether your Microsoft 365 plan already includes Defender for Business.
2. Count devices, including servers, and confirm the five-device-per-user limit fits.
3. Decide who monitors alerts and what happens after hours.
4. Use the one-month trial with a pilot group.
5. Save the quote, term and renewal date, because the subscription auto-renews.

Frequently asked questions

Prices and plan details were checked on October 27, 2026 from Microsoft's product pages and Learn documentation. See our research methodology and affiliate disclosure. This review contains no tracked affiliate link.