Microsoft Defender for Endpoint is priced per user per month: Plan 1 costs $3.00/user/month and Plan 2 costs $5.20/user/month at standalone list. Plan 2 is the EDR tier (full endpoint telemetry, threat hunting, automated investigation, vulnerability management); Plan 1 is NGAV and attack-surface reduction only. Both are included at no incremental licence cost in Microsoft 365 E3 (P1) and E5 (P2), so E5 customers effectively already own enterprise EDR. The free built-in Defender Antivirus is signature-based AV, not EDR.
Microsoft Defender for Endpoint pricing tiers
| Tier | Price | Real EDR? | Notes |
|---|---|---|---|
| Defender Antivirus (built-in) | Free$0 | No | Signature + behavioural AV built into Windows. Not EDR. |
| Defender for Endpoint Plan 1 | $36/user/yr$3.00/mo | No | NGAV, attack-surface reduction, device control. No EDR. |
| Defender for Endpoint Plan 2 | $62.40/user/yr$5.20/mo | Yes | Full EDR: telemetry, hunting, auto-investigation, vuln mgmt. |
| Included in M365 E3 | Bundled (P1) | No | Plan 1 is part of M365 E3. No extra licence cost. |
| Included in M365 E5 | Bundled (P2) | Yes | Plan 2 is part of M365 E5 / E5 Security. You already own EDR. |
The entry tier that delivers genuine EDR (continuous telemetry, behavioural detection, threat hunting, and response actions) is Defender for Endpoint Plan 2 ($5.20/user/month, or bundled in M365 E5). Cheaper tiers in the table are NGAV or prevention-only and do not give you the post-incident investigation trail that defines EDR.
What it costs at your size
Worked annual figures at the entry EDR tier, before negotiation. Use these to size the budget line, then run your own numbers in the budget calculator, which layers deployment, tuning, and internal operating cost on top of the licence.
| Organisation | Endpoints | Tier | Annual licence | Per endpoint / mo |
|---|---|---|---|---|
| Micro / SMB | 50 users | P2 standalone | $3,120 | $5.20 |
| Small business | 200 users | P2 standalone | $12,480 | $5.20 |
| Mid-market | 1,000 users | P2 standalone | $62,400 | $5.20 |
| M365 E5 shop | 1,000 users | Bundled in E5 | $0 incremental | $0.00 |
| Enterprise | 25,000 users | P2 standalone | ~$1.56M | $5.20 |
Licence only. Deployment, tuning, IR retainer, and internal operating cost sit on top: see the five TCO categories. At SMB scale the licence is roughly half of true all-in cost.
Four ways to bring the Microsoft Defender for Endpoint number down
Check what your M365 tier already includes
If you are on Microsoft 365 E5 or E5 Security, Plan 2 EDR is already in your licence at zero incremental cost. Many organisations buy a third-party EDR while already paying for E5; auditing the licence is the single biggest saving available.
Price per user, not per device
Defender is licensed per user, and one user can cover up to five devices under standard M365 terms. If your device-to-user ratio is high, the effective per-device cost is lower than per-device competitors.
Don't over-buy E5 just for EDR
If EDR is the only E5 feature you want, standalone Plan 2 at $5.20/user/month is far cheaper than the E5 uplift. Buy the add-on, not the suite, unless you need the rest of E5.
Mind the server licensing
Servers need Defender for Servers (a separate Microsoft Defender for Cloud plan), not the per-user endpoint plans. Budget servers separately or the quote will be wrong.
When Microsoft Defender for Endpoint is the right pick, and when it is not
- + You are already on Microsoft 365 E5 or E5 Security: Plan 2 EDR is included at no extra licence cost.
- + You run a Microsoft-centric estate where native integration with Entra ID, Intune, and M365 telemetry adds real value.
- + You want the lowest standalone EDR list price among the major vendors ($5.20/user/month for P2).
- + Your device-to-user ratio is high and per-user licensing works in your favour.
- − You run a heavily non-Windows estate where Defender's macOS and Linux coverage is less mature than dedicated EDR.
- − An auditor or insurer requires a named third-party EDR from a specific list that excludes Microsoft.
- − You need Defender Antivirus alone to satisfy an EDR requirement: the free AV is not EDR and will fail the control test.
- − You want bundled MDR in the platform price: Defender Experts is a separate Microsoft service.