Enterprise EDR Just Landed in Business Premium, and Microsoft Is Not Charging Extra

The $20 per user plan most MSPs already sell now includes endpoint detection and response. In November 2021, Microsoft announced Microsoft Defender for Business, a new endpoint security offering that will be bundled into Microsoft 365 Business Premium at no additional cost. For a SKU that already carried a strong security lineup, this is a significant amount of capability added without touching the price.

The announcement rides alongside a second change: Microsoft is splitting Defender for Endpoint into two plans. Defender for Endpoint has historically been an enterprise-grade product, locked inside top-shelf bundles like Microsoft 365 E5. Over the past few years Microsoft made it a standalone add-on so smaller plans could pick it up cost-effectively. The new fork formalizes the tiers: Plan 1 is a lightweight version covering capabilities like next-generation protection and attack surface reduction, while Plan 2 carries the full detection and response stack.

How close does Defender for Business get to Plan 2?#

Very close. As part of Microsoft 365 Business Premium, Defender for Business includes almost every feature that ships with Defender for Endpoint Plan 2.

Here is what the headline capabilities actually do, as Microsoft describes them in the Defender for Business introduction (opens in new tab):

• Threat and vulnerability management. Helps you prioritize and focus on the weaknesses that pose the most urgent and highest risk to the business. By discovering, prioritizing, and remediating software vulnerabilities and misconfigurations, you proactively build a secure foundation for the environment.
• Attack surface reduction. Shrinks the places where a company is vulnerable to cyberattacks across devices and applications, using capabilities such as ransomware mitigation, application control, web protection, network protection, network firewall, and attack surface reduction rules.
• Next-generation protection. Antimalware and antivirus protection on devices and in the cloud, preventing threats at the front door.
• Endpoint detection and response (EDR). Behavioral-based detection and response alerts that let you identify persistent threats and remove them. Manual response actions let you act on processes and files, while live response puts you in direct control of a device to make sure it is remediated, secured, and ready to go.
• Automated investigation and remediation. Scales your security operations by examining alerts and taking immediate action to resolve attacks for you. Reduced alert volume and automatic remediation let you focus on the sophisticated threats.
• APIs and integration. Automate workflows and pull security data into existing platforms and reporting tools, for example feeding detections from Defender for Business into your SIEM.

What does the endpoint lineup cost as of November 2021?#

Defender for Business arrives inside Business Premium at no extra charge. Defender for Endpoint remains available standalone, which matters when you want to add endpoint protection to lower-tier plans like Business Standard.

Defender for Endpoint Plan 1:

• $3 per user per month
• $1.45 per user per month for EDU

Defender for Endpoint Plan 2:

• $5.20 per user per month
• $2.50 per user per month for EDU

Why Business Premium is now the easiest bundle math in the stack#

Tally up what Microsoft 365 Business Premium contains after this addition:

• Microsoft 365 email and Office apps
• File storage with OneDrive and SharePoint
• Collaboration with Teams
• DLP policies
• Azure Information Protection Plan 1 (standalone $2 per user per month, email encryption and document classification)
• Azure AD Premium P1 (standalone $6 per user, Conditional Access policies)
• Defender for Office 365 Plan 1 (standalone $2 per user, advanced email protection)
• Intune (standalone $8 per user per month, MDM and device management)
• Defender for Endpoint capability via Defender for Business (standalone $3 per user per month, EDR)

That is a lot of platform for $20 per user per month. Worth noting: the price rises to $22 in March 2022, so the window to anchor customers at the current rate is finite.

The multi-tenant catch, and what Microsoft says is coming#

The real concern for MSPs is operational: every customer gets a siloed management portal for configuring policies and investigating or remediating threats. Multiply that by your customer count and the bundled EDR starts generating real labor.

Microsoft's answer is Microsoft 365 Lighthouse, its multi-tenant management solution for MSPs. The Defender for Business feature set is slated to appear there, and the breadth of what you can actually do from Lighthouse once it lands will determine how manageable this product is at MSP scale. We will be watching that release closely.

The full capability matrix#

For the line-by-line comparison across the endpoint SKUs, refer to these detailed breakdowns: