Microsoft Defender for Business and Defender for Endpoint

What it is

Microsoft Defender for Endpoint is Microsoft’s security product for laptops, desktops, servers and phones, sold to larger organisations in Plan 1 and Plan 2. Defender for Business is a version designed for small and medium-sized businesses with up to 300 users. Microsoft describes it as bringing Defender for Endpoint’s capabilities to small businesses with simpler, wizard-driven set-up and default policies that protect devices from day one.

According to Microsoft, Defender for Business includes everything in Defender for Endpoint Plan 1 and some features from Plan 2, including:

• Next-generation protection (antivirus and anti-malware)
• Attack surface reduction rules that block common attack techniques
• Endpoint detection and response (EDR), which spots suspicious behaviour and lets you isolate a device
• Automated investigation and remediation
• Automatic attack disruption
• Core vulnerability management, showing missing updates and weak settings
• Monthly security summary reports

It covers Windows, Mac, iOS and Android. Protecting Windows and Linux servers needs extra licences.

Why it matters for a UK small business

Malware protection is one of the five Cyber Essentials controls, and Cyber Essentials Plus tests it on a sample of your devices. Basic antivirus stops known files. EDR adds the ability to see and contain an attack that is already under way, such as ransomware starting to encrypt files.

How it works in Microsoft 365

Defender for Business is included in Microsoft 365 Business Premium. It is also available on its own for businesses using Business Basic or Business Standard. Devices are usually onboarded through Intune, and their risk level can feed into Conditional Access so a compromised laptop is cut off from company data. Alerts and incidents appear in the Microsoft Defender portal, and Microsoft Secure Score includes Defender recommendations.

Someone still has to look at the alerts. That is the gap a managed detection and response service fills.

How &DEV helps: the Microsoft 365 MOT onboards your devices to Defender with sensible policies, and our full cover adds round-the-clock monitoring of the alerts.