Introduction & Licenses

Introduction

​Microsoft Defender for Endpoint is an enterprise security platform designed to help organizations prevent, detect, investigate, and respond to advanced threats across various devices, including laptops, desktops, mobile devices, and network equipment. ​Microsoft+2Microsoft Learn+2Agile IT+2

There are two primary licensing plans available:​Agile IT

1. Microsoft Defender for Endpoint Plan 1 (P1): This plan focuses on prevention and includes features such as:​TECHCOMMUNITY.MICROSOFT.COM+1Agile IT+1

   • Next-generation antimalware​TECHCOMMUNITY.MICROSOFT.COM+1Microsoft+1

   • Attack surface reduction capabilities​Microsoft+2Microsoft Learn+2TECHCOMMUNITY.MICROSOFT.COM+2

   • Device-based conditional access​Microsoft Learn+5TECHCOMMUNITY.MICROSOFT.COM+5Microsoft+5

   As of January 14, 2022, Defender for Endpoint P1 is automatically included in Microsoft 365 E3 and A3 licenses.

2. Microsoft Defender for Endpoint Plan 2 (P2): This comprehensive plan offers all P1 capabilities plus:​Microsoft Learn+2Microsoft+2TECHCOMMUNITY.MICROSOFT.COM+2

   • Endpoint detection and response​Microsoft+1Microsoft Learn+1

   • Automated investigation and remediation​Agile IT+4TECHCOMMUNITY.MICROSOFT.COM+4Microsoft+4

   • Threat and vulnerability management​Microsoft Learn+2TECHCOMMUNITY.MICROSOFT.COM+2Microsoft+2

   Defender for Endpoint P2 is included with Microsoft 365 E5 licenses.

Licenses for Microsoft Defender for Endpoint are assigned per user, not per device or tenant. Each user requires a separate license to access the features of Defender for Endpoint P1 or P2. ​Microsoft Learn+3TECHCOMMUNITY.MICROSOFT.COM+3TECHCOMMUNITY.MICROSOFT.COM+3

For organizations with mixed-license environments, it's possible to manage subscription settings to specify which plan's features are applied to devices. This configuration is done through the Microsoft Defender portal by navigating to Settings > Endpoints > Licenses and selecting Manage subscription settings. ​Microsoft Learn

To monitor license usage, administrators can sign in to the Microsoft Defender portal and review the number of licenses utilized within their organization. ​Microsoft Answers

For detailed information on features, system requirements, and deployment guidance, refer to Microsoft's official documentation. ​Microsoft

---

REFERENCES

• https://learn.microsoft.com/en-us/defender-endpoint/microsoft-defender-endpoint