Endpoint Index
Microsoft Defender for Business
Microsoft · EDR · Checked weekly, last verified
On this page
Microsoft Defender for Business costs $36.00 per user per year at list price for 10 seats (verified 2 Oct 2026). Its SMB Fit Score is 75 out of 100, ranked #3 overall. EDR is included, and 24/7 managed response is not offered.
Why it scores 75
How the Fit Score works ›- Lab efficacy18 / 35AV-Test 6.0/6 (Aug 2026) and AV-Comparatives 98.8% (2026 H1) count. MITRE ATT&CK (2024) is older than 18 months, so it scores zero.
- Price25 / 25Published price, $36.00 per user per year at list.
- Easy for a small team25 / 25Buy online, no security staff needed, from 1 seat, about 2 hours to set up.
- Feature coverage7 / 157 of 13 tracked capabilities included, 1 as paid add-ons.
The Fit Score (fit-v1) measures fit for a small-business buyer from public evidence. It is not a measure of absolute protection.
How much does it cost?
List price from Microsoft's own pricing page, verified 2 Oct 2026.
| Seats | List / year | Per user | Evidence |
|---|---|---|---|
| 5 | $180.00 | $36.00 |  Captured 1 Oct 2026 ↗ |
| 10 | $360.00 | $36.00 |  Captured 30 Sep 2026 ↗ |
| 25 | $900.00 | $36.00 | Captured 30 Sep 2026 ↗ |
| 50 | $1,800.00 | $36.00 | Captured 1 Oct 2026 ↗ |
| 100 | $3,600.00 | $36.00 | Captured 30 Sep 2026 ↗ |
- Billed annually
- Auto-renews
- 12-month minimum term
- 1 to 300 users
At 10 seats, Microsoft Defender for Business has the lowest list price of the 7 EDR and XDR products that publish one, in the SMB endpoint security price index. Microsoft's other plans, and what each adds, are on the Microsoft pricing page.
How well does it perform in independent tests?
How every tracked product compares across the three labs: the endpoint security lab results scorecard.
What does it include?
- EDR
- Device control
- Mobile
- macOS
- SIEM integration
- RMM / PSA integration
- MSP multi-tenant
- Linux
- 24/7 managed response
- Ransomware rollback
- Patch management
- Email security
- Identity protection (ITDR)
Who is it for, and who is it not for?
Defender for Business is the default choice for a Microsoft 365 office under 300 users. It adds EDR and automated investigation and remediation for less per user than most rivals charge for plain antivirus, and AV-Comparatives recorded zero false positives in its first-half 2026 test. The trade-off: alerts land in the Defender portal with nobody paid to watch them unless you hire a partner or MSP to do it; Microsoft does not sell its Defender Experts service for this product.
MSPs manage Defender for Business through Microsoft 365 Lighthouse, which works well when clients already live in Microsoft 365 and awkwardly when they do not. Sentinel is the only named SIEM, so reporting stays inside Microsoft's own consoles. Each client tenant tops out at 300 users.
For a practice already on Microsoft 365, the included EDR keeps device timelines for incident review, and Defender for Endpoint, the engine under Defender for Business, is in Microsoft's PCI DSS scope. There are gaps. Microsoft's HIPAA BAA covers a published list of services, and neither Defender for Endpoint nor Defender for Business is on it, so a covered entity should ask Microsoft before relying on it. We hold no CMMC record for this product, and Microsoft sat out MITRE's 2025 evaluation, so its newest MITRE result dates from 2024.
- Organisations over 300 users: Defender for Business is licensed for up to 300 users, and Microsoft recommends Defender for Endpoint above that.microsoft.com · 2 Oct ↗
- Linux-heavy server environments: Linux Server needs the separate Defender for Business servers add-on, and Microsoft points to a different licence above 60 servers.learn.microsoft.com · 2 Oct ↗
- Licensed for up to 300 users. Above that, Microsoft recommends Defender for Endpoint.microsoft.com · 2 Oct ↗
- Patch deployment and email security are not part of Defender for Business. Its vulnerability management finds and ranks weaknesses; email protection comes from Defender for Office 365, which Microsoft 365 Business Premium includes along with Intune Plan 1.microsoft.com · 2 Oct ↗
- No managed SOC or MDR is included. Microsoft's Defender Experts services are not offered for Defender for Business; the Defender Experts Suite is an add-on to Microsoft 365 E5, E7 or Microsoft Defender Suite, sold through Microsoft sales.microsoft.com · 2 Oct ↗
- Did not participate in MITRE ATT&CK Evaluations 2025 (ER7), citing a focus on the Secure Future Initiative.techcommunity.microsoft.com · 2 Oct ↗
Our full verdict, with the evidence for and against: Is Microsoft Defender for Business Enough for a Small Business?
What does it integrate with?
- SIEM
- Microsoft Sentinel
- Identity
- Microsoft Entra ID
- Other
- Microsoft 365 Lighthouse · Microsoft Intune
Alternatives
Full leaderboard ›| Product | Fit Score | $ / seat / yr at 25 | Compare |
|---|---|---|---|
 Bitdefender GravityZone Business Security Premium Bitdefender · Antivirus · buy online · min 5 seats | 74 | $74.80 | Compare › |
 CrowdStrike Falcon Go CrowdStrike · Antivirus · buy online · min 1 seat | 62 | $59.99 | Compare › |
 SentinelOne Singularity Control SentinelOne · EDR · buy via sales · min 5 seats | 37 | $79.99 | Report › |
Microsoft Defender for Business ranks first of 8 in the EDR ranking for small business, on SMB Fit Score.
What changed
Full changelog ›- RECHECKPrices re-verified at 10, 25 and 100 seats.
- LAB RESULTAV-Test, August 2026: Microsoft scored 6.0 out of 6 for protection.
- EVIDENCEPrice evidence captured at 5 and 50 seats.
- EVIDENCEPrice evidence captured at 10, 25 and 100 seats.
Sources
- Pricing, Capabilities, Buying and setup, Contract terms, Limitations · microsoft.com · vendor page · verified 2 Oct 2026
- AV-Test · av-test.org · independent lab · verified 2 Oct 2026
- AV-Comparatives · av-comparatives.org · independent lab · verified 2 Oct 2026
- MITRE ATT&CK · evals.mitre.org · independent lab · verified 2 Oct 2026
- Compliance · microsoft.com · vendor page · verified 2 Oct 2026
- Integrations · learn.microsoft.com · vendor page · verified 2 Oct 2026
- Deployment, Limitations · learn.microsoft.com · vendor page · verified 2 Oct 2026
- Regulatory · learn.microsoft.com · vendor page · verified 2 Oct 2026
- Limitations · microsoft.com · vendor page · verified 2 Oct 2026
- Limitations · techcommunity.microsoft.com · vendor_press · verified 2 Oct 2026
Methodology · Report an error · Your product? Claim this listing