MICROSOFT LICENSING · MODULE 3 · DEFENDER

Microsoft Defender:
Which security capabilities are included, and when is an add-on needed?

Microsoft Defender is a product family covering endpoints, email, identities, and cloud applications. Existing E3, E5, and Business Premium rights must be assessed separately for each capability.

Updated: 25 August 2026Reading time: approx. 10 minutesOfficial Microsoft sources

The short answer

Start with the protected asset: device, mailbox, identity, cloud application, or server.

Different Defender products have different plans, prerequisites, and licensing scopes. Existing Microsoft 365 subscriptions may already include the required protection.

01Defender for Endpoint and Defender for Office 365 are separate products.
02Defender for Endpoint Plan 1 is included in Microsoft 365 E3; Plan 2 is typically associated with E5 or an eligible Defender Suite.
03Defender for Office 365 Plan 1 has also been included in Office 365 E3 and Microsoft 365 E3 since 1 July 2026.
04Enterprise Defender Suite requires Microsoft 365 E3, or Office 365 E3 plus EMS E3.
05Business Premium has a dedicated Defender Suite; servers require separate assessment.

Start with the basics

Which Microsoft Defender products exist?

Each Defender product addresses a different security problem.

ENDPOINT

Defender for Endpoint

Protects user devices and, depending on the plan, supports detection, investigation, and response.

Defender for Office 365

Protects mailboxes, links, attachments, and collaboration from phishing and malware.

IDENTITY

Defender for Identity

Detects suspicious identity activity and attacks across hybrid identity environments.

CLOUD APPS

Defender for Cloud Apps

Improves visibility into cloud application use and risky sessions.

Compare licensing models

Which Defender plan matches which protection?

Endpoint and email protection must be licensed independently; Plan 1 does not automatically include Plan 2.

Capability or product	Typical licence	What to check
Defender for Endpoint Plan 1	Microsoft 365 E3 or standalone	Core endpoint protection.
Defender for Endpoint Plan 2	Microsoft 365 E5, eligible Defender Suite, or standalone	Advanced detection, investigation, remediation, and security analytics.
Defender for Office 365 Plan 1	Business Premium; Office 365 E3 and Microsoft 365 E3 since July 2026	Safe Links, Safe Attachments, and anti-phishing protection.
Defender for Office 365 Plan 2	Microsoft 365 E5, eligible Defender Suite, or standalone	Advanced investigations, automation, and attack simulation.
Defender for Identity	Microsoft 365 E5, EMS E5, eligible Defender Suite, or standalone	Check benefiting identities and tenant-wide coverage.
Defender for Endpoint for Servers	Separate server or eligible cloud-security entitlement	User licences do not automatically cover every server operating-system environment.

Check before buying

What is already included in E3, E5, or Business Premium?

Validate actual service plans before purchasing overlapping security rights.

Existing core protection

Microsoft 365 E3 includes Endpoint Plan 1. Office 365 E3 and Microsoft 365 E3 include Office 365 Plan 1 from 1 July 2026.

Broader protection

Microsoft 365 E5 includes extensive Defender capabilities, while specialised premium add-ons may still require separate licensing.

ENTERPRISE

Enterprise Defender Suite

Requires Microsoft 365 E3, or Office 365 E3 together with Enterprise Mobility + Security E3.

BUSINESS

Defender Suite for Business Premium

This dedicated add-on specifically requires Microsoft 365 Business Premium and is not the enterprise SKU.

Who actually needs a licence?

Who actually benefits from the security capability?

A visible setting in the portal does not prove that everyone benefiting from it has the necessary rights.

USERS

Protected people and mailboxes

Count users whose devices, identities, or mailboxes benefit from the relevant security capability.

IDENTITY

Tenant-wide effects

Microsoft notes that Defender for Identity is tenant-wide and cannot always restrict benefits to selected users.

SERVERS

Separate server licensing

Defender for Endpoint for Servers requires a separate licence per server operating-system environment.

ADD-ONS

Premium and IoT rights

Premium vulnerability management and IoT devices can have separate prerequisites and add-on requirements.

Tenant-wide capabilities and benefiting users explained →

A practical example

300 E3 users and a phishing-protection proposal

An organisation receives an offer for 300 additional email-security licences.

FIRST

Inspect existing service plans

Since July 2026, Defender for Office 365 Plan 1 is included in Office 365 E3 and Microsoft 365 E3.

SECOND

Define the missing feature

Safe Links and Safe Attachments may already be covered; attack simulation and advanced investigations can require Plan 2.

THIRD

Compare only valid options

Assess E5, eligible Defender Suites, or standalone add-ons for the actual users and qualifying base plans.

Practical checklist

01Is the requirement endpoint, email, identity, cloud-app, or server protection?
02Which Defender service plans are already included?
03Is a Plan 1 or Plan 2 capability actually required?
04Which users or systems benefit?
05Does the chosen enterprise or Business Premium add-on have the correct prerequisite?
06Are servers, IoT, or premium vulnerability capabilities licensed separately?
07Can tenant-wide protection actually be restricted?

LizenzFrau principle

Defender is a product family. The right licence follows the actual protection requirement.

Compare existing E3, E5, and Business Premium entitlements with the exact feature and the users or systems it protects.

Official Microsoft sources

Product capabilities, prerequisites, and usage rights can change. The current Microsoft Product Terms and the actual agreement are authoritative.

Note: This article provides practical guidance and does not replace an individual agreement, licensing, or legal assessment.