Defender for Endpoint Server: counted per OS environment
Microsoft Defender for Endpoint Server
per licence per month, excluding VAT
Ask a questionNo markup on top of Pax8's suggested retail. My margin is the Pax8 wholesale discount.
Check whether your current plan already includes this: Licence Overlap Check, free, and nothing leaves your browser.
Defender for Endpoint Server is the enterprise server licence for Microsoft's endpoint security platform. It covers traditional on-premises server workloads on Windows and Linux, with advanced detection and automatic attack disruption surfaced through the Microsoft Defender XDR console, and deep visibility into server activity including kernel and memory attack detection so response actions can run at scale. The licensing rule is the one to plan around: a separate licence is required for each server operating system environment, so the count is per operating system instance, including virtual machines, rather than per physical host.
What it is
Microsoft Defender for Endpoint Server extends Defender for Endpoint to server workloads. It is the enterprise line, distinct from Defender for Business Servers, which is the small business product.
Who it is for
Organisations running Windows or Linux servers, on-premises or as virtual machines, that already run Defender for Endpoint on their client estate and want servers in the same console and the same incident view.
Key capabilities
- Endpoint security for traditional on-premises server workloads, Windows and Linux
- Advanced detection and automatic attack disruption through Microsoft Defender XDR
- Deep visibility into server activity, including kernel and memory attack detection
- Response actions that can run at scale across the server estate
How it is counted
A separate licence is required for each server operating system environment. That means each operating system instance, virtual machines included, not each physical host. On a virtualised estate that distinction is usually the difference between a correct quote and a surprise.
Which server product applies to you
- Defender for Endpoint Server, this one, for organisations on the enterprise Defender for Endpoint line.
- Defender for Business Servers, for small organisations, requiring a Microsoft 365 Business Premium or Defender for Business licence and capped at 60 licences per customer.
- Microsoft Defender for Servers, the Azure product, where the server count is above the Defender for Business ceiling or the workload is cloud-hosted.
A licensing discount worth asking about
Microsoft documents a discount for organisations running both Defender for Endpoint and Microsoft Defender for Servers. If both are in play, raise it before the order rather than after.
How is it counted on a virtualised estate?
One licence per server operating system environment, which means each operating system instance including virtual machines, not each physical host. On a virtualised estate that is usually where quotes go wrong.
How is it different from Defender for Business Servers?
Defender for Business Servers is the small business product: it requires a Microsoft 365 Business Premium or Defender for Business licence and is capped at 60 licences per customer. This is the enterprise line with no such cap.
When does Microsoft Defender for Servers apply instead?
When the server count exceeds the Defender for Business ceiling, or the workload is cloud-hosted. Defender for Servers is the Azure product.
Does it see kernel-level activity?
Yes. It provides deep insight into server activities and covers kernel and memory attack detection, which is what enables response actions at scale.
Is there a discount for running it alongside Defender for Servers?
Microsoft documents licensing discounts for organisations holding both Defender for Endpoint and Microsoft Defender for Servers. Raise it before the order is placed.
- Vendor
- Microsoft
- Category
- Security
- Type
- SaaS
- Billing
- Monthly
- Commitment
- 1-Year
- Available terms
- 1-Year, Monthly
- SKU
- MST-NCE-132-C100
- 1You request the licence, or add it to the cart.
- 2I confirm price, term and seats, and check your VAT number in VIES. Businesses in the EU only.
- 3You pay before we provision, under the CSP Marketplace Terms. The invoice comes from Michal Jatczak, a sole trader registered in Malta, trading as ITSailor. Reverse charge for an EU VAT number that validates in VIES.
- 4Your authorised signatory accepts the Microsoft Customer Agreement before activation.
- 5I place the order with Pax8 within one business day of payment.