Compare security features in Microsoft 365 plans for small and medium-sized businesses

Microsoft offers a wide variety of cloud solutions and services, including plans for small and medium-sized businesses. For example, Microsoft 365 Business Premium includes security and device-management capabilities, along with productivity features such as Office apps. This article describes the security features in Microsoft 365 Business Premium, Microsoft Defender for Business, and Microsoft Defender for Endpoint.

Use this article to:

• Compare Microsoft Defender for Business to Microsoft 365 Business Premium.
• Compare Defender for Business (standalone) to Defender for Endpoint enterprise offerings.

Tip

Defender for Business is available as a standalone security solution for small and medium-sized businesses. Defender for Business is now included in Microsoft 365 Business Premium. If you already have Microsoft 365 Business Basic or Standard, consider either upgrading to Microsoft 365 Business Premium or adding Defender for Business to your current subscription to get more threat protection capabilities for your devices.

Compare Microsoft Defender for Business to Microsoft 365 Business Premium

Note

This article provides a high-level overview of features and capabilities that are included in Microsoft Defender for Business (as a standalone plan) and Microsoft 365 Business Premium (which includes Defender for Business). It's not intended to be a service description or licensing contract document. For more detailed information, see Microsoft 365 licensing guidance for security & compliance.

Microsoft Defender for Business (standalone)

Microsoft 365 Business Premium

Antivirus, antimalware, and ransomware protection capabilities for devices include: Next-generation protection (antivirus/antimalware protection on devices together with cloud protection) Attack surface reduction (network protection, firewall, and attack surface reduction rules) [a] Endpoint detection and response (behavior-based detection and manual response actions) Automated investigation and response (with self-healing for detected threats) Microsoft Defender Vulnerability Management (view exposed devices and recommendations) Cross-platform support for devices (Windows, Mac, iOS, and Android) [b] Centralized management and reporting (Microsoft 365 Defender portal) APIs for integration (for Microsoft partners or your custom tools and apps)

Productivity and security capabilities include: Microsoft 365 Business Standard (Office apps and services, and Microsoft Teams) Shared computer activation (for deploying Microsoft 365 Apps) Windows 10/11 Business (upgrade from previous versions of Windows Pro) Windows Autopilot (for setting up and configuring Windows devices) Exchange Online Protection (antiphishing, antispam, antimalware, and spoof intelligence for email) Defender for Business (everything listed in the "Defender for Business (standalone)" column) Microsoft Defender for Office 365 Plan 1 (advanced antiphishing, real-time detections, Safe Attachments, Safe Links) Auto-expanding archiving (for email) Azure Active Directory Premium Plan 1 (identity management) Microsoft Intune (device onboarding and management) Azure Information Protection Premium Plan 1 (protection for sensitive information) Azure Virtual Desktop (centrally managed, secure virtual machines in the cloud)

(a) Microsoft Intune is required to modify or customize attack surface reduction rules. Intune is included in Microsoft 365 Business Premium.

(b) Microsoft Intune is required to onboard iOS and Android devices. See Onboard devices to Microsoft Defender for Business.

Compare Microsoft Defender for Business to Microsoft Defender for Endpoint Plans 1 and 2

Defender for Business brings the enterprise-grade capabilities of Defender for Endpoint to small and medium-sized businesses. The following table compares security features and capabilities in Defender for Business to the enterprise offerings, Microsoft Defender for Endpoint Plans 1 and 2.

Feature/capability	Defender for Business (standalone)	Defender for Endpoint Plan 1 (for enterprise customers)	Defender for Endpoint Plan 2 (for enterprise customers)
Centralized management	Yes [1]	Yes	Yes
Simplified client configuration	Yes	No	No
Microsoft Defender Vulnerability Management	Yes	No	Yes
Attack surface reduction capabilities	Yes	Yes	Yes
Next-generation protection	Yes	Yes	Yes
Endpoint detection and response	Yes [2]	No	Yes
Automated investigation and response	Yes [3]	No	Yes
Threat hunting and six months of data retention	No [4]	No	Yes
Threat analytics	Yes [5]	No	Yes
Cross-platform support (Windows, Mac, iOS, and Android OS)	Yes [6]	Yes	Yes
Microsoft Threat Experts	No	No	Yes
Partner APIs	Yes	Yes	Yes
Microsoft 365 Lighthouse integration (For viewing security incidents across customer tenants)	Yes	Yes [7]	Yes [7]

(1) Onboard and manage devices in the Microsoft 365 Defender portal (https://security.microsoft.com) or by using Microsoft Intune, managed in the Microsoft Endpoint Manager admin center (https://endpoint.microsoft.com).

(2) Endpoint detection and response (EDR) capabilities in Defender for Business include behavior-based detection and the following manual response actions:

• Run antivirus scan
• Isolate device
• Stop and quarantine a file
• Add an indicator to block or allow a file

(3) In Defender for Business, automated investigation and response is turned on by default, tenant wide. If you turn off automated investigation and response, that affects real-time protection. See Review settings for advanced features.

(4) There's no timeline view in Defender for Business.

(5) In Defender for Business, threat analytics are optimized for small and medium-sized businesses.

(6) See Onboard devices to Microsoft Defender for Business.

(7) The ability to view incidents across tenants using Defender for Endpoint is new!

Also see Compare Microsoft endpoint security plans.

Next steps

• See the requirements for Microsoft Defender for Business
• Get Microsoft Defender for Business
• Learn how to set up and configure Microsoft Defender for Business