Defender for Endpoint P1 vs P2, the real gap
Plan 1 is the antivirus baseline your E3 estate already pays for. Plan 2 is the full EDR product Microsoft would rather sell you through E5. The licensing question is not which plan is better, it is which users need the difference, because the answer prices three different ways.
Prepared by Redress Compliance · August 6, 2026 · Microsoft security licensing advisory. Based on 35 to 45 security estate benchmarks 2024 to 2026.
Executive summary
The plans split cleanly. Plan 1 is prevention: next generation antivirus, attack surface reduction, device control, and web protection, and it is already included in Microsoft 365 E3. Plan 2 is detection and response: full EDR with live response and six month retention, advanced hunting in KQL.
Threat and vulnerability management, and automated investigation, included in Microsoft 365 E5 and the E5 Security add on.
The money question is the route to Plan 2, because the same capability prices three ways: standalone at $5.20 per user per month against Plan 1 at $3, the E5 Security add on at $12 list on an E3 base, where negotiated rates run $8 to $10 at median and $6 to $8 at top quartile.
Or full Microsoft 365 E5, which rises from $57 to $60 per user per month on July 1, 2026 and carries far more than security.
The estates overpay in one direction and under license in the other, usually at the same time.
Across the security estates we benchmarked, 55 to 65 percent were running Plan 2 features on users licensed for Plan 1 at first review.
An audit finding waiting to be monetized, while flat Plan 2 coverage across the whole estate paid the EDR premium for thousands of users whose devices no analyst will ever hunt across.
The defensible position is a persona mix: Plan 2 where the SOC actually works, Plan 1 where prevention is the job, servers licensed through Defender for Servers rather than user SKUs.
In our benchmarks the persona aligned mix cut the Defender line 20 to 30 percent against a flat Plan 2 estate, with no change in security posture.
What each plan actually covers
Plan 1 is the prevention stack: Microsoft Defender Antivirus with cloud delivered protection, attack surface reduction rules across Office macros and scripts, device control down to USB blocking and application control, SmartScreen web protection, network protection against malicious destinations.
And the Defender portal with basic reporting.
For a workforce whose threat model is commodity malware and phishing payloads, this is the job, and E3 estates already pay for it.
| Capability | Plan 1 | Plan 2 |
|---|---|---|
| Next generation antivirus, cloud delivered | Included | Included |
| Attack surface reduction rules | Included | Included |
| Device control and web protection | Included | Included |
| Endpoint detection and response, live response, six month retention | Not included | Included |
| Advanced hunting, KQL across the endpoint dataset | Not included | Included |
| Threat and vulnerability management dashboard | Not included | Included |
| Automated investigation and response | Not included | Included |
| Defender Experts managed hunting eligibility | Not included | Plan 2 base required |
Plan 2 is what a SOC consumes: the EDR evidence trail, the hunting surface, the vulnerability dashboard, and the automation that closes routine alerts without analyst time. Defender Experts, Microsoft's managed hunting service, is a separate SKU that requires the Plan 2 base.
The plans are a capability split, not a good better tier: a user whose alerts nobody will ever investigate gets nothing from Plan 2 except the invoice.
The three routes to Plan 2, and what each really costs
Plan 2 rarely sells standalone. Most enterprises reach it through a bundle, and the route decides the price:
| Route | List price | What you actually pay | When it wins |
|---|---|---|---|
| Standalone Plan 2 | $5.20 per user per month | Close to list, thin discounting | Non Microsoft 365 estates and mixed vendor stacks |
| E5 Security add on, on E3 | $12 per user per month | $8 to $10 median negotiated, $6 to $8 top quartile | E3 estates that want the security suite without full E5 |
| Full Microsoft 365 E5 | $57, rising to $60 on July 1, 2026 | Discounted off the E5 rate, but you buy the whole suite | Only when compliance, voice, and analytics workloads justify the rest of E5 |
The add on carries four other products alongside Defender for Endpoint Plan 2: Entra ID P2, Defender for Office 365 Plan 2, Defender for Cloud Apps, and Defender for Identity.
That makes the E5 Security conversation the real negotiation, and it behaves like one: the gap between $12 list and the $6 to $8 top quartile is wider than most whole product discounts.
The trap to refuse is the account team reframing an E5 Security need as an E5 upgrade, because the E3 versus E5 decision should be made on the full suite, never on security alone.
Lock the add on price for the full EA term. Microsoft's default position is that the E5 Security add on reprices at each anniversary.
A price hold on the add on, written into the enrollment, is a standard ask that most buyers never make, and it is worth more than an extra point of discount, especially across the July 2026 list increase.
The Defender for Endpoint licensing playbook
The persona model worksheet, the three route price math, the server licensing rules, and the compliance gap checklist from 35 plus security estate benchmarks.
Get the white paper →The persona mix, sizing Plan 2 to the SOC
The unit of decision is the user persona, not the company. A defensible mix comes from one question asked honestly per population: will an analyst ever hunt across this device's telemetry, or investigate its alerts beyond the automated verdict?
- Plan 2 populations. Privileged accounts and admins, developers and build infrastructure users, executives and their staff, high risk roles handling money or sensitive data, and every device the SOC's detection engineering actually covers.
- Plan 1 populations. Frontline and task workers on managed devices, kiosk and shared device users, and populations whose incident path is reimage rather than investigate. These riders usually sit on E3 or F3 already.
- Servers are not users. Server endpoint protection licenses through Defender for Servers under Defender for Cloud, per server, not through user SKUs. In 1 estate out of 3 we found server EDR posture enabled with no server plan behind it, which is the same compliance gap as the desktop one, with a bigger invoice attached.
In our benchmarks the persona aligned mix cut the Defender line 20 to 30 percent against flat Plan 2 coverage.
The same persona worksheet drives the neighboring decisions: Intune Plan 1 versus Plan 2 follows the identical logic on the management side, and the Microsoft 365 licensing pillar places both inside the full suite architecture.
- Percentile standing for your exact deal size and industry, from real closed transactions
- Scenario simulation before the call: test alternative terms and see the financial impact of each
- A negotiation playbook, talking points, and a two page executive brief on day one
The compliance gap running the other way
The overspend has a mirror image. Plan 2 features are tenant wide switches in places: advanced hunting, the vulnerability dashboard, and automated investigation do not check per user licensing before they run.
Across the estates we benchmarked, 55 to 65 percent were consuming Plan 2 capabilities on users licensed only for Plan 1 at first review.
Microsoft's audit and true up machinery treats that as under licensing, and the finding usually lands at the worst moment: inside an EA renewal, where it becomes leverage for the E5 conversation you were trying to avoid.
The defense is the same list the persona mix needs anyway: a named user inventory of who consumes Plan 2 features, reconciled against entitlements, before Microsoft builds it for you.
Not one of the 35 to 45 estates we benchmarked could produce that list on day one. Every misalignment in both directions, paid but unused Plan 2 and used but unpaid Plan 2, follows from that missing inventory.
Building it takes days, and it converts the renewal from a defensive conversation into a pricing one. The EA guide covers where the finding lands in the agreement mechanics.
The competitive frame, and why it matters even if you stay
Defender for Endpoint competes with CrowdStrike Falcon and SentinelOne, and the comparison matters commercially even for committed Microsoft estates: the E5 Security discount, the add on price hold, and the Defender Experts rate all move when a credible alternative sits in the file.
The CrowdStrike versus SentinelOne versus Defender comparison covers the capability and pricing detail.
The honest buyer side reading: Defender's economics are hard to beat when Plan 2 rides inside an add on you were negotiating anyway, and weakest standalone against per endpoint EDR pricing.
Which is precisely why Microsoft prices the routes the way it does, and why the persona mix, not the vendor choice, is where most of the recoverable money sits.
Your first five moves
- Build the named user list of actual Plan 2 consumption. Who has opened advanced hunting, the vulnerability dashboard, or live response in ninety days. This list settles both the overspend and the compliance gap.
- Define the personas and assign plans per population, not per company. Plan 2 where the SOC works, Plan 1 where prevention is the job.
- License servers as servers. Move server EDR onto Defender for Servers under Defender for Cloud and out of the user SKU math.
- Negotiate the E5 Security add on as its own line with a price hold for the term. $12 list is a starting position; the market clears at $8 to $10 and top quartile buyers sign $6 to $8.
- Refuse the E5 reframe until the suite math works. Security alone never justifies full E5. Run the Microsoft 365 license optimizer against the estate, and bring the Microsoft practice in for the renewal itself.
Frequently asked questions
What is the difference between Defender for Endpoint Plan 1 and Plan 2?
Plan 1 is prevention: next generation antivirus, attack surface reduction, device control, and web protection.
Plan 2 adds detection and response: full EDR with live response and six month retention, advanced hunting in KQL, threat and vulnerability management, automated investigation, and eligibility for Defender Experts. Plan 1 protects the device; Plan 2 equips a SOC to investigate it.
Is Defender for Endpoint included in Microsoft 365 E3 or E5?
Plan 1 is included in Microsoft 365 E3. Plan 2 is included in Microsoft 365 E5 and in the E5 Security add on for E3. Standalone, Plan 1 lists at $3 and Plan 2 at $5.20 per user per month. Most enterprises reach Plan 2 through E5 or the add on rather than standalone.
What does the E5 Security add on cost in 2026?
List is $12 per user per month on an E3 base, covering Defender for Endpoint Plan 2 plus Entra ID P2, Defender for Office 365 Plan 2, Defender for Cloud Apps, and Defender for Identity.
Negotiated rates run $8 to $10 at median and $6 to $8 at top quartile, and the add on price can and should be locked for the full EA term.
Do all users need Plan 2?
No, and flat Plan 2 coverage is the most common overspend. Plan 2 belongs on populations a SOC actually investigates: privileged users, developers, executives, and high risk roles. Prevention only populations do the job on Plan 1.
In our benchmarks the persona aligned mix cut the Defender line 20 to 30 percent with no posture change.
How are servers licensed for Defender for Endpoint?
Through Defender for Servers under Microsoft Defender for Cloud, priced per server, not through user SKUs. User licenses cover up to five client devices each but do not cover server operating systems.
In roughly 1 estate in 3 we found server EDR enabled without a server plan behind it, which is an audit finding at true up.
Can Microsoft detect Plan 2 features used on Plan 1 licenses?
Yes. Plan 2 capabilities like advanced hunting and the vulnerability dashboard are tenant level, and consumption is visible to Microsoft.
Fifty five to 65 percent of the estates we benchmarked ran Plan 2 features on Plan 1 users at first review, and the finding typically surfaces as renewal leverage. A named user reconciliation closes the gap on your terms.
