Monday, 8:40 a.m. The accountant at a distribution company opens an email about an "overdue invoice", downloads the attachment and sees nothing odd. By mid-morning, files with an extension nobody recognizes start showing up in the shared folder. The free antivirus that came with the laptop never flagged anything, and nobody at the company has watching alerts as part of their job.
For a small business in that spot, Microsoft Defender for Business is probably the shortest path from "we have antivirus" to "we know what's happening on our devices". It comes with Microsoft 365 Business Premium, it's also sold on its own, and it's built for companies with up to 300 users. This article covers what it includes, how it's licensed and what to configure first if you're about to turn it on.
What it is and how it differs from antivirus
Defender for Business is the SMB version of Microsoft Defender for Endpoint, the endpoint security platform large enterprises use. Microsoft describes it as a solution for organizations with up to 300 users that protects devices against ransomware, malware and phishing.
A traditional antivirus blocks files it already knows about. Defender for Business does that too, but it also records what happens on each device, spots suspicious behavior even when the file is new, and can investigate and fix things on its own. That last part matters most in a small company, where the security console tends to be the browser tab nobody opens.
According to Microsoft's comparison table, it includes:
| Capability | What it does in practice |
|---|---|
| Next-generation protection | Real-time antivirus and antimalware, built on Microsoft Defender Antivirus |
| Attack surface reduction | Rules that shut down common attack techniques on the device |
| Endpoint detection and response (EDR) | Shows the sequence of an attack and lets you act on the affected device |
| Automated investigation and remediation | Reviews alerts and fixes what it can without waiting for a person |
| Automatic attack disruption | Contains an attack in progress before anyone has time to react |
| Vulnerability management | Lists outdated software and weak settings, ranked by risk |
| Simplified configuration | Setup wizard and default antivirus and firewall policies for Windows |
| Monthly security summary | A readable report for people who don't live in the console |
Compared with Defender for Endpoint Plan 2, what's missing is advanced threat hunting with six months of data retention and the Microsoft Threat Experts service. For a company without its own security team, that's rarely the gap that hurts.
How it's licensed
There are two ways to get it, per the official documentation:
- Standalone, added to plans such as Microsoft 365 Business Basic, Business Standard or Office 365 E1. The product page lists it at USD 3 per user per month, paid yearly.
- Inside Microsoft 365 Business Premium, listed on that same page at USD 22 per user per month. It adds Defender for Office 365 for email, Intune Plan 1 for device management, Microsoft Entra ID with multifactor authentication, and the Microsoft Purview labeling and DLP features.
Those are US list prices. In Chile the final cost depends on currency and purchasing channel, so get a quote before you build the budget.
Microsoft's FAQ spells out a few rules that tend to catch people off guard:
- The cap is 300 users.
- Each user license covers up to five devices: Windows, Mac, iPhone/iPad or Android.
- Servers aren't included. For Windows Server or Linux you need the Defender for Business servers add-on, which Microsoft lists at USD 3 per server. Past 60 servers you need a different license, such as Defender for Servers Plan 1 or Plan 2.
- Mixed licensing isn't supported. If you have Business Premium and add Microsoft 365 E5 Security for only some users, the whole organization stays on the Defender for Business experience.
With that in mind, the decision usually looks like this:
| Your situation | Sensible option |
|---|---|
| You already pay for Business Basic or Standard and only want to protect devices | Defender for Business standalone |
| You also want email protection, Intune device management and DLP | Microsoft 365 Business Premium |
| You run your own Windows or Linux servers (up to 60) | Add Defender for Business servers |
| You've grown past 300 users | Microsoft 365 E3 (Defender for Endpoint Plan 1), E5 (Plan 2) or standalone Defender for Endpoint |
What to configure first
Microsoft provides a setup wizard that handles much of the basics. This is the order we recommend, building on that process:
- Assign licenses and turn on multifactor authentication for everyone. Microsoft calls this out in the manual setup steps, and for good reason.
- Decide who manages it. There's a security administrator role, which can change policies and respond to threats, and a security reader role, which only sees reports. Ideally that's two people, or one internal person plus your support provider.
- Set up email notifications for alerts and new vulnerabilities. Skip this and alerts pile up in a portal nobody checks.
- Onboard Windows devices with the wizard. If you already use Intune, turn on automatic onboarding for all enrolled devices. Macs and phones come next.
- Apply the default antivirus and firewall policies as they are. Tune them once you have a couple of weeks of data, not on day one.
- Decide what happens to any third-party antivirus. Microsoft warns that running another antivirus alongside can switch off real-time protection and leave the device flagged as unprotected. Pick one.
- Set up web content filtering (only one policy is allowed per organization) and review the attack surface reduction rules. Creating custom rules requires Intune.
- Open the vulnerability section and start with the highest-risk recommendations. It's the quickest way to see concrete improvements in the first month.
What Defender for Business won't solve on its own
Phishing arrives by email, and stopping it before someone clicks takes Defender for Office 365, which is part of Business Premium but not the standalone version. Identity is another front: if someone steals a password and there's no MFA, they sign in to Microsoft 365 from their own computer and your protected endpoint never knows. We covered those settings in Microsoft 365 security for businesses.
Against ransomware, you still need backups that can actually be restored and that someone has tested. No endpoint tool replaces that.
Then there's the human side of administration. Automated remediation handles a lot, but someone still has to read the monthly report and look at the incidents the tool doesn't close by itself. If your company handles personal data about customers or employees, Chile's Law 21,719 requires security measures proportionate to the risk, and a control nobody reviews hardly counts as one. We went into detail in Microsoft Purview and Law 21,719.
Frequently asked questions
Does Defender for Business replace the antivirus I already have?
Yes. It includes Microsoft Defender Antivirus capabilities and adds detection and response, vulnerability management and automated remediation. Microsoft advises against running another antivirus in parallel because it can turn off real-time protection.
Does it work on Macs and phones?
Yes. It protects Windows, macOS, iOS/iPadOS and Android, with up to five devices per user license. Servers need a separate add-on.
What happens if the company grows past 300 users?
Defender for Business and Business Premium both have that cap. Microsoft recommends moving, at renewal, to a plan that includes Defender for Endpoint for every user, such as Microsoft 365 E3 or E5.
How we can help
At Disrupsoft we start with an assessment of where your devices, identities and email stand today. Then we define the controls, deploy Defender for Business or other Microsoft Security solutions, and stay on for monitoring and support so alerts have someone looking at them. If you want to know how well protected your company's devices really are, let's talk about Microsoft security.
