Compare Microsoft Defender for Endpoint plans

Microsoft Defender for Endpoint is an enterprise endpoint security platform designed to help enterprise networks prevent, detect, investigate, and respond to advanced threats. Defender for Endpoint provides advanced threat protection that includes antivirus, antimalware, ransomware mitigation, and more, together with centralized management and reporting. You can choose from the following options for Microsoft Defender for Endpoint:

• Microsoft Defender for Endpoint Plan 1
• Microsoft Defender for Endpoint Plan 2
• Microsoft Defender Vulnerability Management
• Microsoft 365 Defender

You can use this article to help clarify what protection is provided by the different features available in Defender for Endpoint Plan 1, Defender for Endpoint Plan 2, and the new Defender Vulnerability Management add-on.

Compare Defender for Endpoint plans

The following table summarizes what's included in each Defender for Endpoint plan.

Plan	What's included
Defender for Endpoint Plan 1	Next-generation protection (includes antimalware and antivirus) Attack surface reduction Manual response actions Centralized management Security reports APIs Support for Windows 10, iOS, Android OS, and macOS devices
Defender for Endpoint Plan 2	All of the Defender for Endpoint Plan 1 capabilities, plus: Device discovery Device inventory Core Defender Vulnerability Management capabilities Threat Analytics Automated investigation and response Advanced hunting Endpoint detection and response Microsoft Threat Experts Support for Windows (client and server) and non-Windows platforms (macOS, iOS, Android, and Linux)
Defender Vulnerability Management add-on	Additional Defender Vulnerability Management for Defender for Endpoint Plan 2: Security baselines assessment Block vulnerable applications Browser extensions Digital certificate assessment Network share analysis Support for Windows (client and server) and non-Windows platforms (macOS, iOS, Android, and Linux)

Mixed licensing scenarios

Suppose that your organization is using a mix of Microsoft endpoint security subscriptions, such as Defender for Endpoint Plan 1 and Defender for Endpoint Plan 2. Currently, the highest functional Microsoft endpoint security subscription sets the experience for your tenant. In this example, your tenant experience would be Defender for Endpoint Plan 2 for all users.

However, you can contact support and request an override for your tenant experience. That is, you could request an override to keep the Defender for Endpoint Plan 1 experience for all users.

• For details about licenses and product terms, see Licensing and product terms for Microsoft 365 subscriptions.
• For information about how to contact support, see Contact Microsoft Defender for Endpoint support.

Tip

If your organization is a small or medium-sized business, see the following articles:

• What is Microsoft Defender for Business?
• Compare security features in Microsoft 365 plans for small and medium-sized businesses.

Start a trial

• To try Defender for Endpoint Plan 1, visit https://aka.ms/mdep1trial.
• To try Defender for Endpoint Plan 2, visit https://aka.ms/MDEp2OpenTrial.
• To try the Microsoft Defender Vulnerability Management add-on, visit https://aka.ms/AddonPreviewTrial.

See also

• Microsoft Defender for Business (endpoint protection for small and medium-sized businesses)