Microsoft certification badges banner
Headshot of Michael Korting

Blog

Microsoft 365 • Security • Compliance

• Microsoft 365, Defender, Licensing

Microsoft 365 Business Premium Defender Entitlements Explained

A practical guide to the Defender rights actually included with Business Premium, the capabilities that merely overlap, and the add-ons required for P2 and server protection.

Bottom line

Microsoft 365 Business Premium includes two separate, assignable Defender service-plan entitlements:

  • Microsoft Defender for Business, service plan MDE_SMB, GUID bfc1bbd9-981b-4f71-9b82-17c35fd0e2a4.
  • Microsoft Defender for Office 365 Plan 1, service plan ATP_ENTERPRISE, GUID f20fedf3-f3c3-43c3-8267-2bfdd51c0939.
Endpoint entitlementBusiness Premium does not include Microsoft Defender for Endpoint Plan 1 as a separate service plan. MDE P1 uses MDE_LITE, which is not part of the Business Premium SPB SKU.

Defender for Business is a distinct endpoint entitlement with a composite capability set. It includes MDE P1 capabilities, selected P2-class capabilities, and SMB-specific simplified management. Functional overlap does not convert it into separate P1 or P2 entitlements.

Email entitlementDefender for Office 365 Plan 1 is different. Business Premium contains the actual ATP_ENTERPRISE service plan, making it a genuine separate entitlement.
Microsoft 365 Business Premium licensing diagram showing included Defender for Business and Defender for Office 365 Plan 1, MDE Plan 1 overlap, and optional P2 and server add-ons
Figure 1. Business Premium contains distinct Defender for Business and Defender for Office 365 Plan 1 service plans. Defender for Endpoint Plan 1 is a comparison product with overlapping features, not a separately included entitlement. P2 and server rights require additional licensing.

Entitlement versus capability

A feature visible in the Microsoft Defender portal is not proof of a particular product entitlement. The portal brings multiple workloads together, and several products share technologies and controls. Establish entitlement from the assigned SKU and service plans.

Product or capabilityBusiness Premium positionClassificationPractical meaning
Defender for Business (MDE_SMB)IncludedSeparate entitlementEndpoint-security rights, subject to five-device and 300-user limits.
MDE Plan 1 (MDE_LITE)Not presentOverlapping capabilitiesSimilar prevention features are delivered through Defender for Business, but MDE P1 is not separately owned.
MDO Plan 1 (ATP_ENTERPRISE)IncludedSeparate entitlementPlan 1 email and collaboration protection is licensed.
MDE Plan 2Not includedAdd-on or qualifying licenseAvailable through Microsoft Defender Suite for Business Premium or another qualifying P2 subscription; all users must be licensed for P2 before the tenant can switch experiences.
MDO Plan 2Not includedAdd-on requiredAvailable as an MDO add-on or through Defender Suite for Business Premium.
Defender for Business serversNot included in user licensesPer-server add-onOne license per Windows or Linux server instance, up to 60.
Microsoft Defender portalShared admin surfacePortal accessVisibility depends on licensed workloads and administrator permissions.

Defender for Business compared with MDE P1 and P2

Microsoft describes Defender for Business as containing MDE P1 features, some P2 features, and SMB-specific features. It uses the Defender for Endpoint technology platform, but remains separately packaged.

CapabilityDefender for BusinessMDE P1MDE P2
Next-generation antivirus and antimalwareYesYesYes
Attack-surface reductionYesYesYes
Centralized portal management and APIsYesYesYes
Windows, macOS, iOS/iPadOS, and AndroidYesYesYes
Manual endpoint response actionsYesYesYes
Endpoint detection and responseYes, optimizedNoYes
Automated investigation and remediationYesNoYes
Automatic attack disruptionYesNoYes
Core vulnerability managementYesNoYes
Threat analyticsYes, optimizedNoYes
Simplified firewall and antivirus configurationYes, SMB-specificNoNo
Monthly security summary reportingYesNoYes
Threat hunting (30 days of advanced hunting data)NoNoYes
Six-month endpoint data retentionNoNoYes
Microsoft Threat ExpertsNoNoYes

The P1 overlap centers on next-generation protection, attack-surface reduction, manual response actions, centralized management, Intune integration, reporting, and APIs. Defender for Business goes further with optimized EDR, automated investigation and remediation, automatic attack disruption, core vulnerability management, optimized threat analytics, and monthly security summary reporting.

Do not infer P2 ownership from P2-like featuresThese additional capabilities are rights from MDE_SMB, not proof that the user separately owns MDE P2.

The P2 upgrade adds threat hunting with 30 days of advanced hunting data, six months of device-data retention, and Microsoft Threat Experts. Enterprise IoT device security is not part of MDE P2 itself; it is included with Microsoft 365 E5 and E5 Security, or purchased as a per-device add-on to standalone MDE P2.

Defender for Office 365 Plan 1 is separately included

The Business Premium SPB SKU contains ATP_ENTERPRISE, whose friendly name is Microsoft Defender for Office 365 Plan 1. Microsoft’s service description also identifies Plan 1 as included in Business Premium.

Principal Plan 1 capabilities

  • Safe Attachments for email.
  • Safe Attachments for SharePoint, OneDrive, and Teams files.
  • Safe Links for email, supported Office applications, and Teams.
  • Enhanced anti-phishing, user and domain impersonation protection, mailbox intelligence, and phishing thresholds.
  • Email and collaboration alerts.
  • Real-time detections, email entity pages, reporting, and user tags (including the Priority account tag for filtering).
  • Teams protections, including zero-hour auto purge (ZAP) for malicious Teams messages, extended to Plan 1 in January 2026 (not available in GCC, GCC High, or DoD).

The Plan 1 service plan itself is present in the assigned license. That is the key difference from MDE P1.

Practical licensing interpretation

  • Endpoint protection: Defender for Business on up to five concurrent client devices per licensed user. User licenses do not grant server operating-system rights.
  • Email and collaboration protection: MDO Plan 1 for the licensed user’s protected email, links, attachments, Teams, SharePoint, and OneDrive interactions, subject to policy scope.
  • Administration and investigation: The appropriate Defender for Business and MDO P1 experiences in the Defender portal. Portal visibility does not grant rights to unlicensed P2 features or users.
Operating principleA visible feature, shared portal, common API, or overlapping control is not itself a license entitlement. Use SKUs and service-plan identifiers to establish entitlement. Use comparison tables only to establish functional overlap.

Adding Defender for Office 365 Plan 2

What P2 adds

  • Threat Explorer rather than the more limited Real-time detections experience.
  • Threat Trackers and campaign views.
  • Automated Investigation and Response.
  • Attack Simulation Training.
  • Advanced hunting, Defender XDR incident and alert investigation, and additional API and SIEM integration.
  • Priority account protection (differentiated filtering for tagged users, beyond the tag itself) and additional Teams investigation and remediation.

Acquisition paths

  1. MDO add-on subscription: Business Premium supplies P1; the add-on upgrades the licensed user to P2.
  2. Microsoft Defender Suite for Business Premium: This add-on, which requires Business Premium, supplies MDO P2, MDE P2, Defender for Identity, Defender for Cloud Apps, and Microsoft Entra ID P2 capabilities.

The standalone MDO P2 SKU contains both ATP_ENTERPRISE and THREAT_INTELLIGENCE. P2 is a cumulative capability level, not a second independently usable email-security stack.

Per-user considerations

Licenses are required for every user or resource benefiting from protection, including users accessing protected mailboxes, protected shared mailboxes, users of SharePoint, OneDrive, or Teams where Safe Attachments is enabled, and users of Microsoft 365 Apps or Teams benefiting from Safe Links.

Tenant-wide visibility is not tenant-wide licensingMDO is provisioned at the tenant level, but policies can be scoped. A small number of P2 seats does not license the entire tenant for P2.

Defender for Business servers

Business Premium user licenses do not cover Windows Server or Linux server operating-system environments. The customer must own at least one paid Business Premium or standalone Defender for Business license, purchase one Defender for Business servers license for each instance, and remain within the maximum of 60 server licenses per customer or subscription. These licenses are capacity and are not assigned to users or individual devices in the admin center.

Above 60 servers, Microsoft directs customers to Defender for Endpoint for servers or Microsoft Defender for Servers Plan 1 or Plan 2 (part of Microsoft Defender for Cloud). A tenant that moves all endpoint users to the Defender Suite or MDE P2 experience must also transition existing Defender for Business servers licensing.

Material limits and transition caveats

  • 300-seat ceiling: The Microsoft 365 Business family is limited to 300 seats.
  • Five client devices per user: This is a concurrent client-device entitlement, not a pooled server right.
  • Endpoint mixed licensing: A tenant with Defender for Business and MDE P2 defaults to the Defender for Business experience. All users must be licensed for MDE P2 and Microsoft Support must switch the tenant before P2 becomes authoritative.
  • MDO policy scoping differs: Policies can be scoped to appropriately licensed users, but all benefiting users, mailboxes, and collaboration users must be licensed.
  • Crossing 300 users requires planning: Move deliberately to enterprise endpoint subscriptions rather than assuming added E3 or E5 users automatically convert the tenant experience. Note the trade-offs: Microsoft 365 E3 includes MDE P1 (not P2-class EDR), and since July 1, 2026 it also includes MDO P1, so email protection carries over while endpoint capability steps down unless MDE P2 or E5 is added.

Final takeaway

Business Premium includes substantial endpoint, email, and collaboration security, but accurate licensing language matters. Defender for Business is its own entitlement with P1 overlap and selected P2-class features. Defender for Office 365 Plan 1 is a separate included service plan. MDE P2, MDO P2, and server protection require additional licensing paths.

For assessments and customer designs, begin with the assigned SKU and service-plan identifiers. Then map capabilities, policy scope, device limits, and transition requirements. That is more defensible than inferring licensing from controls visible in a shared portal.

References

← Back to Blog