Microsoft Defender for Business
UK SOFTWARE PROFILE
Microsoft Defender for Business
Small-business endpoint protection with investigation and automated response.
One product. Different jobs.
Each score uses that category's criteria. Compare products within a category, rather than comparing scores across unrelated tasks.
Pricing & practicalities
Model your total cost ↗Published starting point
£2.30
Defender for Business standalone · user/month, paid yearly · annual billing
excl. VAT
£2.30 per user/month on annual payment; VAT excluded.
Check current price ↗Consider before choosing
- Limited to 300 users and five devices per user; server protection needs extra licences.
- Do not assume the full Defender for Endpoint Plan 2 feature set.
Connected workflows
- Microsoft 365 Lighthouse
- RMM/PSA integrations
Confirm the integration's direction, permissions, plan and sync behaviour with the supplier.
BEHIND THE AI CLAIM
AI capabilities
AI contributes to detection and automated investigation.
Documented capabilities
- AI-supported endpoint detection
Plans, limits & questions
- Copilot summaries and natural-language hunting were not established for this licence.
Feature-by-feature evidence
Endpoint security — 20 scored checks
| Capability & demo question | Microsoft Defender for Business75–100/100 documented fit |
|---|---|
Core workflowMalware prevention5.0 points availableAsk in the demoShow an isolated test alert and the prevention policy. | ✓ Supported Next-generation malware protection. 5.0 / 5.0 pointsEvidence ↗ |
Core workflowRansomware protection5.0 points availableAsk in the demoExplain detection and recovery behaviour without running live malware. | ✓ Supported Ransomware-focused protection and attack disruption. 5.0 / 5.0 pointsEvidence ↗ |
Core workflowWindows and Mac protection5.0 points availableAsk in the demoShow both operating systems in the supported-device list. | ✓ Supported Windows and macOS are supported. 5.0 / 5.0 pointsEvidence ↗ |
Core workflowCentral device management5.0 points availableAsk in the demoIdentify an unhealthy endpoint from the console. | ✓ Supported Central management is included. 5.0 / 5.0 pointsEvidence ↗ |
Core workflowEndpoint firewall controls5.0 points availableAsk in the demoShow a firewall rule assigned centrally. | ✓ Supported Simplified Windows firewall configuration. 5.0 / 5.0 pointsEvidence ↗ |
Core workflowMalicious website protection5.0 points availableAsk in the demoShow the policy for blocked destinations. | ? Not verified Not established by the reviewed official evidence; request a demonstration. 0.0–5.0 / 5.0 points |
Core workflowRemovable-device controls5.0 points availableAsk in the demoDemonstrate a USB access restriction. | ? Not verified Not established by the reviewed official evidence; request a demonstration. 0.0–5.0 / 5.0 points |
Core workflowVulnerability prioritisation5.0 points availableAsk in the demoFind a vulnerable application and its recommended action. | ✓ Supported Core vulnerability-management capabilities. 5.0 / 5.0 pointsEvidence ↗ |
Core workflowEndpoint detection and investigation5.0 points availableAsk in the demoTrace a sample endpoint incident. | ✓ Supported EDR optimised for small businesses. 5.0 / 5.0 pointsEvidence ↗ |
Workflow depthRemote device isolation5.0 points availableAsk in the demoIsolate and reconnect a safe test endpoint. | ✓ Supported Manual device isolation is documented. 5.0 / 5.0 pointsEvidence ↗ |
Workflow depthFile quarantine workflow5.0 points availableAsk in the demoShow a quarantined sample and review its disposition. | ✓ Supported Automated investigations can quarantine files. 5.0 / 5.0 pointsEvidence ↗ |
Workflow depthRemote investigation commands5.0 points availableAsk in the demoShow an authorised remote diagnostic action. | ✓ Supported Live response supports scripts and forensic collection. 5.0 / 5.0 pointsEvidence ↗ |
Workflow depthResponse action history5.0 points availableAsk in the demoIdentify who acted and when on a past response. | ✓ Supported Action Centre retains completed response actions. 5.0 / 5.0 pointsEvidence ↗ |
Workflow depthSeparate device policies5.0 points availableAsk in the demoAssign a stricter policy to a selected device group. | ? Not verified Not established by the reviewed official evidence; request a demonstration. 0.0–5.0 / 5.0 points |
Workflow depthSecurity reporting5.0 points availableAsk in the demoProduce a report covering device protection and incidents. | ✓ Supported Monthly security summary reports. 5.0 / 5.0 pointsEvidence ↗ |
Workflow depthSecurity data API5.0 points availableAsk in the demoRetrieve sample device or incident data using a documented API. | ✓ Supported APIs included in the comparison table. 5.0 / 5.0 pointsEvidence ↗ |
Workflow depthSecurity-tool integrations5.0 points availableAsk in the demoDemonstrate one supported monitoring or management integration. | ✓ Supported Lighthouse and RMM/PSA connections documented. 5.0 / 5.0 pointsEvidence ↗ |
AIMachine-learning threat detection5.0 points availableAsk in the demoExplain where a model contributes to detection. | ✓ Supported AI-powered EDR is described. 5.0 / 5.0 pointsEvidence ↗ |
AIAI incident explanation5.0 points availableAsk in the demoGenerate a summary tied to an actual incident record. | ? Not verified Not established by the reviewed official evidence; request a demonstration. 0.0–5.0 / 5.0 points |
AINatural-language investigation5.0 points availableAsk in the demoAsk a plain-language question about endpoint evidence. | ? Not verified Not established by the reviewed official evidence; request a demonstration. 0.0–5.0 / 5.0 points |
“Not verified” means the recorded evidence does not settle this specific check. It does not mean the feature is absent. Read the scoring method.