Microsoft Defender for Endpoint P2 [New Commerce Experience]
Microsoft Defender for Endpoint Plan 2
Microsoft Defender for Endpoint Plan 2 is the full tier of Microsoft's endpoint security platform. It contains everything in Plan 1 and adds the capabilities that Plan 1 leaves out: endpoint detection and response, automated investigation and remediation, threat and vulnerability management, advanced hunting over six months of retained data, threat intelligence, deep analysis sandboxing, and Microsoft Threat Experts. It is the plan to choose when the requirement is not only to block threats but to see what happened, reconstruct it and respond. Plan 2 is included in Microsoft 365 E5, and is available as a standalone licence for organisations on other plans.
What it is
Microsoft Defender for Endpoint Plan 2 is the complete Defender for Endpoint offering. It covers prevention, detection, investigation and response across an organisation's devices.
Who it is for
Organisations that need to investigate what happened on a device, not only to block what tried to run. That usually means a security team or a managed provider that will act on the telemetry. Plan 2 is the endpoint component of Microsoft 365 E5.
Key capabilities
- Everything in Defender for Endpoint Plan 1
- Endpoint detection and response
- Automated investigation and remediation
- Threat and vulnerability management
- Advanced hunting across six months of retained data
- Threat intelligence and threat analytics
- Deep analysis sandboxing
- Microsoft Threat Experts
How it differs from Plan 1
Plan 1 is preventive. It has no endpoint detection and response, no automated investigation and remediation, and no threat and vulnerability management, and its response actions are manual. Every one of those gaps is filled by Plan 2. If the difference between the two plans is unclear, that list is the difference.
Where it is already included
Defender for Endpoint Plan 2 is included in Microsoft 365 E5, A5 and G5, in Windows 10 and Windows 11 Enterprise E5 and A5, and in the Microsoft Defender Suite. Buying it standalone applies to organisations that are not on one of those plans.
What does Plan 2 add over Plan 1?
Endpoint detection and response, automated investigation and remediation, threat and vulnerability management, advanced hunting with six months of data retention, threat intelligence, deep analysis sandboxing and Microsoft Threat Experts. Plan 1 has none of these.
Is Plan 2 already included in a Microsoft 365 plan?
Yes. It is included in Microsoft 365 E5, A5 and G5, in Windows 10 and Windows 11 Enterprise E5 and A5, and in the Microsoft Defender Suite. A standalone licence is for organisations not on one of those.
Should a business under 300 users buy Plan 2 or Defender for Business?
Microsoft Defender for Business is designed for up to 300 users and covers most of Plan 2, including endpoint detection and response and automated investigation. Plan 2 adds six months of retention with advanced hunting and Microsoft Threat Experts.
How long is endpoint data kept?
Plan 2 retains six months of data for advanced hunting, which is what allows an investigation to look back to the start of an incident.
Does Plan 2 cover servers?
Server coverage is licensed separately. Defender for Endpoint for Servers requires a licence for each server operating system environment.
- Vendor
- Microsoft
- Category
- Security
- Type
- SaaS
- Billing
- Monthly
- Commitment
- 1-Year
- Available terms
- 1-Year, Monthly
- Unit price
- €4.30 /mo
- SKU
- MST-NCE-LMW-C100
Attachable SKUs from the same category. Check each add-on's prerequisites for base-licence eligibility.
- 1You prepay through ITSailor (Malta) — VAT handled, reverse-charge for valid EU VAT IDs.
- 2We provision through Pax8 wholesale into your Microsoft tenant — no third-party MSP markup.
- 3You keep the tenant. Sovereign by default — every engagement closes with an Exit Kit.
Pax8 wholesale, margin in the price
Microsoft Defender Vulnerability Management Add-on (Education Student Pricing) [New Commerce Experience]
Microsoft Defender Vulnerability Management add-on is available to Defender for Endpoint Plan 2 customers to access continuous asset visibility, in-depth vulnerability assessments, and risk-based prioritization to help teams address critical vulnerabilities and misconfigurations.
Microsoft Entra ID P1 (Education Student Pricing) [New Commerce Experience]
Microsoft Entra ID P1 provides single sign-on to thousands of cloud (SaaS) apps and access to web apps you run on-premises. Built for ease of use, Microsoft Entra ID P1 features multi-factor authentication (MFA); access control based on device health, user location, and identity; and holistic security reports, audits,
Microsoft Entra ID P2 (Education Student Pricing) [New Commerce Experience]
Microsoft Entra ID P2 includes all the capabilities of P1 plus advanced identity protection features such as Identity Protection, which helps detect potential vulnerabilities affecting your organization’s identities, and Privileged Identity Management, which helps manage, control, and monitor access within your organiz
Microsoft Defender Vulnerability Management (Education Student Pricing) [New Commerce Experience]
Microsoft Defender Vulnerability Management standalone is a comprehensive vulnerability management solution to access continuous asset visibility, in-depth vulnerability assessments, and risk-based prioritization to help teams address critical vulnerabilities and misconfigurations.