Googling “Microsoft Defender cost” and walking away more confused than before is a completely normal experience. The problem isn’t you: “Microsoft Defender” is not one product. It’s a family of security tools with separate pricing, separate licensing models, and very different audiences. Asking what it costs is like asking what a car costs. The answer is somewhere between zero and a lot, and it depends entirely on which one you’re buying.
This post breaks down every major Defender product and what each one actually runs. But before the numbers, there’s something worth addressing first.
You May Already Be Paying for Defender
Most pricing guides skip straight to the tables. Here’s what they miss: a lot of Microsoft 365 customers already have some form of Defender included in what they’re paying for today.
Windows 10 and 11 ship with Microsoft Defender Antivirus at no charge. It runs by default, with or without a Microsoft 365 subscription.
Microsoft 365 Personal and Family subscribers get the Defender consumer app: antivirus on up to five devices, identity monitoring, dark web scanning, and up to $1 million in identity theft insurance, all included.
Microsoft 365 Business Premium bundles Defender for Business (EDR for up to 300 users), Defender for Office 365 Plan 1 (Safe Links, Safe Attachments, anti-phishing), and Entra ID P1.
Microsoft 365 E3 includes Defender for Office 365 Plan 1 and baseline endpoint protection via Defender Antivirus managed through Intune.
Microsoft 365 E5 covers the full stack: Defender for Endpoint Plan 2, Defender for Office 365 Plan 2, Defender for Identity, Defender for Cloud Apps, and Defender XDR.
If your organization is on any of these plans, the first question isn’t what Defender costs. It’s whether you’re using what you’re already paying for. TrustedTech regularly audits customer environments, and we find Defender capabilities sitting idle more often than not: licensed but never configured, protecting nothing. That’s a pretty common situation and a fixable one.
Defender Products and Prices
Microsoft Defender Antivirus
Free, built into Windows 10 and 11
Real-time malware protection, cloud-based threat analysis, and tamper protection. On by default on any Windows 10 or 11 device, nothing to purchase.
It won’t do endpoint detection and response, centralized dashboards, or cross-device threat correlation. For individuals and small teams with no centralized device management, it’s a legitimate baseline. For anything bigger, you’ll need one of the products below.
Microsoft Defender for Business
$3/user/month standalone; included in Microsoft 365 Business Premium ($22/user/month)
Defender for Business is the endpoint security product built for organizations with under 300 users. It brings EDR, automated investigation, and threat and vulnerability management into a console that doesn’t require a dedicated security operations team to run, which is the whole point for SMBs.
The $3 standalone option works if you’re already on Business Basic or Business Standard and need serious endpoint protection layered on top. For most SMBs, though, Business Premium at $22/user/month is the stronger call. It includes Defender for Business, Defender for Office 365 Plan 1, Intune, Entra ID P1, and Azure Information Protection, components that cost considerably more when priced individually.
One thing to know about timing: starting July 1, 2026, Microsoft 365 Business Standard will gain Defender for Office 365 Plan 1 and several Intune capabilities, with a $3/user/month price increase. If that’s your current plan, your renewal price is going up. Our Microsoft 365 price increases guide covers what that means in practice.
Microsoft Defender for Endpoint
Plan 1: $2.50/device/month; Plan 2: $5.20/device/month
The enterprise EDR product. Built for organizations that need centralized endpoint management and deep investigation capabilities across large device fleets.
Plan 1 covers next-generation antivirus, attack surface reduction rules, device control, and firewall management; solid policy-driven protection without the investigation layer. Plan 2 adds EDR, automated investigation and remediation, six months of historical endpoint data, and access to Microsoft Threat Experts. That’s the tier competing with CrowdStrike and SentinelOne.
One caveat on the standalone numbers: if you need Defender for Endpoint Plan 2 alongside Defender for Identity and Defender for Cloud Apps, pricing them separately gets expensive fast. The totals can push past what Microsoft 365 E5 or the E5 Security add-on would cost. More on that in the bundling section below.
Microsoft Defender for Office 365
Plan 1: ~$2/user/month; Plan 2: included in M365 E5
Defender for Office 365 adds advanced threat protection on top of the baseline Exchange Online Protection that comes with every M365 subscription. It covers email, SharePoint, OneDrive, and Teams.
Plan 1 adds Safe Links, Safe Attachments, and anti-phishing policies. For any organization where users live in Outlook and Teams, this is the layer that addresses AiTM (Adversary-in-the-Middle) phishing: attacks that bypass MFA by intercepting authentication tokens in transit. That threat category has grown significantly, and basic EOP doesn’t catch it.
Plan 2 adds automated investigation and response, Threat Explorer, and Attack Simulation Training for teams that want proactive detection and red-teaming built in.
If you’re deciding between the two, the Defender for Office 365 Plan 1 vs. Plan 2 comparison breaks down the feature differences.
Microsoft Defender for Identity
~$5.50/user/month standalone; included in M365 E5 and EMS E5
Defender for Identity watches Active Directory and Entra ID for behaviors that endpoint tools typically miss: lateral movement, privilege escalation, and attackers with valid credentials moving quietly through your environment. It catches what has already gotten past the perimeter.
Standalone, it’s priced per user. The organizations that genuinely need it are already in the E5 tier, where it’s included.
Microsoft Defender for Cloud
Free tier (CSPM); paid workload plans vary by resource
Defender for Cloud covers Azure workloads, with coverage for AWS and GCP as well. The foundational CSPM tier: continuous assessments, Secure Score, security recommendations across all three clouds, is free. There’s no real reason not to have it enabled.
The paid workload protection plans cover servers, containers, databases, storage, APIs, and app services, priced by resource type and consumption. Pre-purchasing Commit Units gets you 10–22% off pay-as-you-go rates, depending on volume tier.
More on what the platform does: Microsoft Defender for Cloud overview.
When Standalone Pricing Stops Making Sense
Pricing Defender products individually is a reasonable starting point. It stops being useful around product three.
Run it out: Defender for Endpoint Plan 2 ($5.20/device/month) + Defender for Identity ($5.50/user/month) + Defender for Office 365 Plan 2 + Defender for Cloud Apps. Compare that stack against the Microsoft 365 E5 Security add-on at ~$12/user/month, available to existing E3 customers, which delivers all of that plus Entra ID P2, without paying again for Office apps you already have.
For SMBs with fewer than 300 users, Business Premium at $22/user/month hits the same crossover point.
The standalone prices aren’t inaccurate; they’re just not how most organizations should be running this calculation. TrustedTech works through it regularly for customers. What makes sense depends on your current plan, your seat count, and which Defender workloads you actually need. The answer isn’t always E5. It’s almost never just the sum of the list prices.
The July 2026 Packaging Changes
Microsoft’s July 1, 2026, update folds new capabilities into several plans. For Defender specifically:
Microsoft 365 Business Standard gains Defender for Office 365 Plan 1, Intune Remote Help, Intune Advanced Analytics, and Intune Plan 2, with a $3/user/month increase.
Microsoft 365 E3 gains Defender for Office 365 Plan 1 plus Intune Plan 2, Intune Remote Help, Intune Advanced Analytics, and Intune Privilege Management, also at $3/user/month more.
Microsoft 365 E5 gains additional Intune and Security Copilot entitlements at the same $3/user/month bump.
If you’re currently buying Defender for Office 365 Plan 1 as a standalone add-on on Business Standard or E3, your net cost under the new packaging will likely be flat or lower, since the add-on is folded into the base plan. If you’re not buying the add-on today, you’re getting more security capability, but the base price is going up to cover it.
Any renewal signed before July 1 locks in current pricing for its full term. For organizations with renewals in the next few months, that’s a real window worth thinking about.
What Kind Of Microsoft 365 Admin Are You?
Discover where your Microsoft 365 stack is wasting money, adding risk, or creating unnecessary complexity.
Frequently Asked Questions
Q. Is Microsoft Defender free?A. Depends on which one. Microsoft Defender Antivirus is built into Windows 10 and 11 at no charge. The consumer Defender app comes with Microsoft 365 Personal and Family subscriptions. The business and enterprise products, Defender for Business, Defender for Endpoint, and Defender for Office 365, are either bundled with specific M365 plans or available as standalone add-ons with their own pricing.
Q. Do I need to buy Defender separately if I have Microsoft 365?A. Not necessarily; it depends on which plan you’re on. Business Premium, E3, and E5 each include different tiers of Defender coverage. Many organizations find they already have capabilities they never activated. Before purchasing anything additional, it’s worth knowing what your current license actually includes.
Q. What’s the difference between Defender for Business and Defender for Endpoint?A. Defender for Business is for organizations under 300 users, with a simplified management experience that doesn’t require a dedicated SOC. Defender for Endpoint is the enterprise version: no user cap, deeper telemetry, and more advanced threat hunting. Business Premium customers get Defender for Business; E3 and E5 customers get Defender for Endpoint.
Q. Is Microsoft 365 E5 worth the cost for Defender?A. For organizations that need Endpoint Plan 2, Identity, Office 365 Plan 2, and Cloud Apps, E5 or the E5 Security add-on is usually cheaper than buying those products separately. The value tilts further in E5’s favor after July 2026, when additional Intune and Security Copilot entitlements get rolled in at a $3/user/month increase.
Q. Can a Microsoft CSP get me a better price on Defender?A. Yes. CSP partners can access promotional pricing and structure licensing to avoid paying for coverage you already have or doubling up on standalone products that are included in a bundle. Current Microsoft CSP promotions can reduce effective per-user costs compared to buying direct.
Start With What You Have
The most expensive Defender mistake isn’t picking the wrong plan. It’s buying protection you’re already entitled to, or leaving capabilities licensed but never deployed.
If you’re trying to figure out what Defender should cost your organization, start by auditing what your current Microsoft 365 plan already includes. TrustedTech’s licensing advisors can map that out, identify what’s idle, and work through whether the right move is activating what you own, stepping up to a bundle, or adding a specific product.
