Which Microsoft 365 licenses include Microsoft Defender? The short answer is Microsoft 365 Business Premium for small and midsize businesses, Microsoft 365 E3 for several core Defender services, and Microsoft 365 E5 for the broadest advanced Defender capabilities. Business Basic and Business Standard include baseline Microsoft security, but they do not include the full Defender for Business and Defender for Office 365 package.
Talk with IGTech365 about choosing and securing the right Microsoft 365 license.
Which Microsoft 365 licenses include Microsoft Defender?
Microsoft Defender is not one single feature or license. It is a family of security products covering email and collaboration, endpoints, identities, cloud applications, and threat detection. The right answer depends on whether you mean Defender for Office 365, Defender for Business, or Defender for Endpoint.
For most Tampa Bay businesses with up to 300 users, Microsoft 365 Business Premium is the clearest all-in-one starting point. Microsoft says Business Premium includes Microsoft Defender for Business for endpoint protection and Defender for Office 365 Plan 1 for enhanced email and collaboration security. It also includes Microsoft Intune Plan 1 and Microsoft Entra ID Plan 1, which help an organization manage devices and apply access controls.
Microsoft 365 Business Basic and Business Standard include built-in security for cloud mailboxes and Microsoft Entra ID Free with security defaults. Those protections are useful, but they are not the same entitlement as Defender for Office 365 Plan 1 or Defender for Business.
| Microsoft 365 license | Defender coverage included | Best fit |
|---|---|---|
| Business Basic | Built-in mailbox protection; no Defender for Business or Defender for Office 365 Plan 1 included | Organizations needing core Microsoft 365 productivity and baseline security |
| Business Standard | Built-in mailbox protection; no Defender for Business or Defender for Office 365 Plan 1 included | Organizations needing desktop apps plus baseline security |
| Business Premium | Defender for Business and Defender for Office 365 Plan 1 | SMBs that need endpoint, email, identity, and device-management controls |
| Microsoft 365 E3 | Defender for Endpoint Plan 1 and, beginning July 1, 2026, Defender for Office 365 Plan 1 | Larger organizations needing enterprise productivity and core endpoint protection |
| Microsoft 365 E5 | Defender for Office 365 Plan 2 plus broader advanced Defender capabilities | Organizations needing advanced investigation, hunting, automation, and response |
Microsoft’s Microsoft 365 for business security overview and Defender service description are the best references for checking the current feature-to-license mapping. Microsoft can change service entitlements, so confirm the service plan in the Microsoft 365 admin center before making a purchasing or compliance decision.
What does Microsoft Defender include in Business Basic, Standard, and Premium?
Business plans are often compared as if their security coverage were identical. It is not. The biggest security difference between the three plans is the step from built-in protection to a dedicated endpoint and email-defense layer.
Microsoft 365 Business Basic
Business Basic includes Microsoft 365 cloud services and baseline security features for cloud mailboxes. Microsoft describes built-in protection against common email threats, along with Microsoft Entra ID Free and security defaults. It does not include Microsoft Defender for Business or Defender for Office 365 Plan 1. A business on Basic may still purchase eligible Defender products separately, subject to current licensing requirements.
Microsoft 365 Business Standard
Business Standard adds desktop versions of Microsoft 365 apps, but its baseline security position is broadly similar to Business Basic. It includes built-in cloud mailbox security, but not the dedicated endpoint protection and advanced email protections bundled into Business Premium.
Microsoft 365 Business Premium
Business Premium is the business plan that includes the most complete built-in security set. Microsoft lists Defender for Business, Defender for Office 365 Plan 1, Intune Plan 1, and Entra ID Plan 1 as part of the plan’s security coverage. That combination supports endpoint protection, Safe Links, Safe Attachments, stronger phishing controls, device management, and more granular access policies.
That does not mean every security control is automatically configured. MFA, Conditional Access, device compliance, security policies, alert routing, and incident-response procedures still need to be designed and maintained. Licensing creates an available capability. It does not replace implementation or monitoring.
How are Defender for Office 365 Plan 1 and Plan 2 different?
Defender for Office 365 protects email and collaboration services such as Exchange Online, SharePoint, OneDrive, and Microsoft Teams. Both plans add protection beyond basic anti-spam and anti-malware, but Plan 2 adds investigation and response capabilities that matter more to organizations with dedicated security operations.
Defender for Office 365 Plan 1
Plan 1 includes protections such as Safe Links, Safe Attachments, anti-phishing policies, real-time detections, and protection for SharePoint, OneDrive, and Teams. Microsoft lists Plan 1 as included with Microsoft 365 Business Premium. As of July 1, 2026, Microsoft also lists Defender for Office 365 Plan 1 as included with Office 365 E3 and Microsoft 365 E3. E3 customers receive Plan 1, not Plan 2.
Defender for Office 365 Plan 2
Plan 2 includes Plan 1 protections and adds deeper threat investigation, Threat Trackers, Campaign Views, automated investigation and response, attack simulation training, and integration with Microsoft Defender XDR. Microsoft lists Plan 2 with enterprise subscriptions such as Microsoft 365 E5, A5, and GCC G5.
For a small business, Plan 1 may be a sensible baseline when it is paired with endpoint protection and strong identity controls. Plan 2 becomes more relevant when the organization needs advanced hunting, automated response, investigation workflows, or a security team that can use those features consistently. Buying a higher plan without assigning ownership for configuration and response can create unused capability rather than measurable risk reduction.
Review your Microsoft 365 security controls with IGTech365’s cybersecurity team.
When do you need a separate Defender license?
A separate license may be appropriate when the base Microsoft 365 plan does not include the Defender product your environment requires, when only some users need advanced protection, or when the organization has servers and nonstandard endpoints outside the included coverage.
- Business Basic or Standard: Evaluate standalone Defender for Business or Defender for Office 365 when baseline mailbox protection is not enough.
- Business Premium: Check whether the included Defender for Business and Defender for Office 365 Plan 1 cover the required users, devices, servers, and email workloads. Defender for Business Servers is a separate add-on with its own eligibility and quantity limits.
- Microsoft 365 E3: Confirm the included Defender for Endpoint Plan 1 and current Defender for Office 365 Plan 1 entitlement. Advanced Plan 2 features are not included simply because the organization has E3.
- Microsoft 365 E5: Verify the exact service plans assigned to users and workloads. E5 is designed for broader advanced security coverage, but deployment and operational ownership still determine the result.
- Mixed-license environments: Map each user’s role, device type, mailbox, and access requirement. Do not assume that one executive, shared mailbox, contractor, or server has the same entitlement as every other account.
Microsoft’s Defender for Office 365 service description states that appropriate subscription licenses are required for use of online services. An audit should therefore compare purchased SKUs with assigned service plans, not just the plan name shown on an invoice.
A practical review asks four questions: Which users need protection? Which devices and servers are in scope? Which email and collaboration workloads need advanced controls? Who will configure, monitor, and respond to alerts? The answers often reveal that the best licensing decision is role-based rather than a single plan for every employee.
Request a Microsoft 365 licensing and security review for your Tampa Bay business.
Frequently Asked Questions
Does Microsoft 365 Business Standard include Microsoft Defender?
Microsoft 365 Business Standard includes baseline security for cloud mailboxes, but it does not include Microsoft Defender for Business or Defender for Office 365 Plan 1. Businesses that need those dedicated protections should evaluate Business Premium or eligible standalone Defender licenses.
Does Microsoft 365 Business Premium include Defender for Office 365?
Yes. Microsoft 365 Business Premium includes Defender for Office 365 Plan 1. It also includes Microsoft Defender for Business for endpoint protection. The included plan still needs to be configured, monitored, and matched to the organization’s users, devices, and workloads.
Does Microsoft 365 E3 include Microsoft Defender?
Microsoft 365 E3 includes Microsoft Defender for Endpoint Plan 1. Microsoft also lists Defender for Office 365 Plan 1 as included with Microsoft 365 E3 effective July 1, 2026. E3 does not include the full Plan 2 feature set, so verify the exact service plans in the tenant.
What is the difference between Defender for Business and Defender for Office 365?
Defender for Business focuses on endpoint protection for small and medium-sized businesses, including defenses against malware and ransomware on supported devices. Defender for Office 365 focuses on email and collaboration threats, including malicious links, attachments, and phishing. They protect different parts of the environment.
Is Microsoft Defender included automatically when a license is purchased?
The eligible service may be included with the subscription, but protection is not complete until the tenant is configured. Review assigned licenses, activate the relevant security policies, enroll devices, configure identity controls, and establish an alert and incident-response process.
Microsoft 365 licensing is easiest to manage when security requirements are mapped to user roles and workloads before licenses are renewed or changed. IGTech365 helps Tampa Bay organizations select, configure, and support Microsoft 365 security without paying for capabilities they cannot use or leaving important workloads outside the protection plan.
Call IGTech365 at (866) 365-7798 to discuss your Microsoft 365 licensing and security needs.
Sources:
- Microsoft 365 for business security overview
- Microsoft Defender for Office 365 service description
- Microsoft Defender service description.
Microsoft licensing details were checked against these official sources on September 22, 2026.