Defender for Endpoint Plan 2: what it adds over Plan 1
Microsoft Defender for Endpoint P2
per user per month, excluding VAT
Ask a questionNo markup on top of Pax8's suggested retail. My margin is the Pax8 wholesale discount.
Check whether your current plan already includes this: Licence Overlap Check, free, and nothing leaves your browser.
Microsoft Defender for Endpoint Plan 2
Microsoft Defender for Endpoint Plan 2 is the full tier of Microsoft's endpoint security platform. It contains everything in Plan 1 and adds the capabilities that Plan 1 leaves out: endpoint detection and response, automated investigation and remediation, threat and vulnerability management, advanced hunting over six months of retained data, threat intelligence, deep analysis sandboxing, and Microsoft Threat Experts. It is the plan to choose when the requirement is not only to block threats but to see what happened, reconstruct it and respond. Plan 2 is included in Microsoft 365 E5, and is available as a standalone licence for organisations on other plans.
What it is
Microsoft Defender for Endpoint Plan 2 is the complete Defender for Endpoint offering. It covers prevention, detection, investigation and response across an organisation's devices.
Who it is for
Organisations that need to investigate what happened on a device, not only to block what tried to run. That usually means a security team or a managed provider that will act on the telemetry. Plan 2 is the endpoint component of Microsoft 365 E5.
Key capabilities
- Everything in Defender for Endpoint Plan 1
- Endpoint detection and response
- Automated investigation and remediation
- Threat and vulnerability management
- Advanced hunting across six months of retained data
- Threat intelligence and threat analytics
- Deep analysis sandboxing
- Microsoft Threat Experts
How it differs from Plan 1
Plan 1 is preventive. It has no endpoint detection and response, no automated investigation and remediation, and no threat and vulnerability management, and its response actions are manual. Every one of those gaps is filled by Plan 2. If the difference between the two plans is unclear, that list is the difference.
Where it is already included
Defender for Endpoint Plan 2 is included in Microsoft 365 E5, A5 and G5, in Windows 10 and Windows 11 Enterprise E5 and A5, and in the Microsoft Defender Suite. Buying it standalone applies to organisations that are not on one of those plans.
What does Plan 2 add over Plan 1?
Endpoint detection and response, automated investigation and remediation, threat and vulnerability management, advanced hunting with six months of data retention, threat intelligence, deep analysis sandboxing and Microsoft Threat Experts. Plan 1 has none of these.
Is Plan 2 already included in a Microsoft 365 plan?
Yes. It is included in Microsoft 365 E5, A5 and G5, in Windows 10 and Windows 11 Enterprise E5 and A5, and in the Microsoft Defender Suite. A standalone licence is for organisations not on one of those.
Should a business under 300 users buy Plan 2 or Defender for Business?
Microsoft Defender for Business is designed for up to 300 users and covers most of Plan 2, including endpoint detection and response and automated investigation. Plan 2 adds six months of retention with advanced hunting and Microsoft Threat Experts.
How long is endpoint data kept?
Plan 2 retains six months of data for advanced hunting, which is what allows an investigation to look back to the start of an incident.
Does Plan 2 cover servers?
Server coverage is licensed separately. Defender for Endpoint for Servers requires a licence for each server operating system environment.
- Vendor
- Microsoft
- Category
- Security
- Type
- SaaS
- Billing
- Monthly
- Commitment
- 1-Year
- Available terms
- 1-Year, Monthly
- SKU
- MST-NCE-LMW-C100
- 1You request the licence, or add it to the cart.
- 2I confirm price, term and seats, and check your VAT number in VIES. Businesses in the EU only.
- 3You pay before we provision, under the CSP Marketplace Terms. The invoice comes from Michal Jatczak, a sole trader registered in Malta, trading as ITSailor. Reverse charge for an EU VAT number that validates in VIES.
- 4Your authorised signatory accepts the Microsoft Customer Agreement before activation.
- 5I place the order with Pax8 within one business day of payment.