# Microsoft Defender for Business

Microsoft Defender for Business is an endpoint detection and response (EDR) product from Microsoft. Source: Endpoint Index product report, https://endpointindex.com/products/microsoft-defender-for-business/ (data verified 2 Oct 2026, licensed CC BY 4.0).

## SMB Fit Score

Microsoft Defender for Business scores 75 out of 100 on the SMB Fit Score (fit-v1), ranked #3 of the 17 products tracked as of 2 Oct 2026. The score measures fit for a small-business buyer from public evidence, not absolute protection.

- Efficacy: 18 of 35
- Price transparency & level: 25 of 25
- SMB operability: 25 of 25
- Coverage breadth: 7 of 15

## Price

List price, per user per year, from Microsoft's own pricing page (https://www.microsoft.com/en-us/security/business/endpoint-security/microsoft-defender-business), verified 2 Oct 2026:

| Seats | Per user per year | Total per year |
|---|---|---|
| 10 | $36.00 | $360.00 |
| 25 | $36.00 | $900.00 |
| 100 | $36.00 | $3,600.00 |

## Independent test results

- AV-Test protection: 6 out of 6, round 2026-08. Source: https://www.av-test.org/en/antivirus/business-windows-client/windows-11/august-2026/microsoft-defender-antivirus-enterprise-4.18-262411/
- AV-Comparatives protection rate: 98.8%, round 2026-H1. Source: https://av-comparatives.org/tests/business-security-test-2026-march-june/
- MITRE ATT&CK Evaluations: 83.8% analytic coverage, round 2024 (older than 18 months; scores zero). Source: https://evals.mitre.org/results/enterprise?view=cohort&evaluation=er6&result_type=DETECTION&scenarios=1,2,3

## What it includes

- EDR: included
- 24/7 managed response: not offered
- Ransomware rollback: not offered
- Device control: included
- Patch management: not offered
- Email security: not offered
- Identity protection (ITDR): not offered
- Mobile: included
- Linux: paid add-on
- macOS: included
- SIEM integration: included
- RMM / PSA integration: included
- MSP multi-tenant: included

## Buying and running it

- Buy online without sales: yes
- Minimum seats: 1
- Needs in-house security staff: no
- Setup time estimate: about 2 hours

## Who it suits

- small no it: Defender for Business is the default choice for a Microsoft 365 office under 300 users. It adds EDR and automated investigation and remediation for less per user than most rivals charge for plain antivirus, and AV-Comparatives recorded zero false positives in its first-half 2026 test. The trade-off: alerts land in the Defender portal with nobody paid to watch them unless you hire a partner or MSP to do it; Microsoft does not sell its Defender Experts service for this product.
- msp managed: MSPs manage Defender for Business through Microsoft 365 Lighthouse, which works well when clients already live in Microsoft 365 and awkwardly when they do not. Sentinel is the only named SIEM, so reporting stays inside Microsoft's own consoles. Each client tenant tops out at 300 users.
- regulated: For a practice already on Microsoft 365, the included EDR keeps device timelines for incident review, and Defender for Endpoint, the engine under Defender for Business, is in Microsoft's PCI DSS scope. There are gaps. Microsoft's HIPAA BAA covers a published list of services, and neither Defender for Endpoint nor Defender for Business is on it, so a covered entity should ask Microsoft before relying on it. We hold no CMMC record for this product, and Microsoft sat out MITRE's 2025 evaluation, so its newest MITRE result dates from 2024.

## Not for, or worth knowing

- Organisations over 300 users: Defender for Business is licensed for up to 300 users, and Microsoft recommends Defender for Endpoint above that. (source: https://www.microsoft.com/en-us/security/business/endpoint-security/microsoft-defender-business, verified 2026-10-02)
- Linux-heavy server environments: Linux Server needs the separate Defender for Business servers add-on, and Microsoft points to a different licence above 60 servers. (source: https://learn.microsoft.com/en-us/defender-business/mdb-faq, verified 2026-10-02)
- Licensed for up to 300 users. Above that, Microsoft recommends Defender for Endpoint. (source: https://www.microsoft.com/en-us/security/business/endpoint-security/microsoft-defender-business, verified 2026-10-02)
- Patch deployment and email security are not part of Defender for Business. Its vulnerability management finds and ranks weaknesses; email protection comes from Defender for Office 365, which Microsoft 365 Business Premium includes along with Intune Plan 1. (source: https://www.microsoft.com/en-us/security/business/endpoint-security/microsoft-defender-business, verified 2026-10-02)
- No managed SOC or MDR is included. Microsoft's Defender Experts services are not offered for Defender for Business; the Defender Experts Suite is an add-on to Microsoft 365 E5, E7 or Microsoft Defender Suite, sold through Microsoft sales. (source: https://www.microsoft.com/en-us/security/business/services, verified 2026-10-02)
- Did not participate in MITRE ATT&CK Evaluations 2025 (ER7), citing a focus on the Secure Future Initiative. (source: https://techcommunity.microsoft.com/blog/microsoftdefenderatpblog/microsoft%E2%80%99s-participation-in-mitre-attck%C2%AE-evaluations-enterprise-2025/4422639, verified 2026-10-02)

Full report with evidence screenshots: https://endpointindex.com/products/microsoft-defender-for-business/