Tools for Cybersecurity
Practical guide / 2026-11-14

What does Microsoft Defender for Business include?

Defender for Business is Microsoft’s small-business endpoint-security offering. Check your existing Microsoft subscription, count users and devices separately, and price servers separately before deciding whether the license fits.

Based on the linked documentation and our buying worksheets. Examples are illustrative.

The licensing facts to check first

Microsoft’s FAQ describes a limit of 300 users and up to five client devices per user license. Server protection requires additional licensing. Do not treat a spare client-device allowance as a server entitlement.

On a small screen, scroll the table sideways to see every column.

The licensing facts to check first
Your inventoryWhat to do with it
People who need a licenseCheck the purchased user count
Laptops and other client devicesMap devices to the applicable user entitlement
ServersObtain the separate server-license terms
Current Microsoft planCheck whether Defender for Business is already included

Source: Microsoft Learn: Defender for Business FAQ

Is it included in Microsoft 365?

Microsoft lists Defender for Business as available standalone or as part of Microsoft 365 Business Premium. The overview also distinguishes it from Defender for Endpoint Plan 2: it combines Plan 1 capabilities, selected Plan 2 capabilities and small-business features. It is not a shorthand name for all of Plan 2.

Source: Microsoft Learn: Defender for Business overview

Example: count people, clients and servers separately

For a fictional 20-person company, create three inventory lines: 20 users, the actual client devices assigned to them, and any servers. Request a license check against that inventory. Do not reduce the user count simply because the number of laptops happens to fit a five-devices-per-user calculation.

Then add deployment and management to the worksheet. Which devices are enrolled? Who reviews policy health? Who investigates alerts? A license purchase alone does not answer those operational questions.

What should you confirm before choosing it?

Start with the tasks your administrator needs to perform. Ask for a demonstration on your actual operating-system versions and a written explanation of any mixed-license situation. If you need a particular enterprise feature, verify that feature directly instead of inferring it from a related Microsoft product name.