Microsoft Defender for Business: what is included and what should you turn on?
5 min read · Updated on 20 October 2026
Microsoft Defender for Business is the Microsoft endpoint security solution for small and medium-sized organisations. It is built on Microsoft Defender for Endpoint. Many organisations already have it without having set it up properly.
Who is it for and how do you get it?
- Designed for organisations with up to 300 users.
- Included in Microsoft 365 Business Premium.
- Also available standalone, for example alongside Microsoft 365 Business Basic or Business Standard.
- Each user licence covers up to five devices.
- Works on Windows, macOS, iOS, iPadOS and Android. Servers running Windows Server or Linux need a separate add-on.
More than 300 users? Then Microsoft recommends a solution for larger organisations, such as Microsoft Defender for Endpoint or Microsoft 365 E3 or E5.
What is included?
- Next-generation protection: antivirus and anti-malware.
- Endpoint detection and response (EDR): detecting and responding to suspicious activity on devices.
- Attack surface reduction: rules that block behaviour often associated with attacks.
- Automated investigation and remediation: automatically investigating and resolving alerts.
- Vulnerability management: insight into vulnerable software on your devices.
- Automatic attack disruption, threat analytics and a monthly security summary report.
Setup is simplified. A wizard helps with configuration. Default policies protect devices from day one, without the need for specialist knowledge.
What should you turn on or check?
- Roles and notifications. Agree who gets admin rights in the Microsoft Defender portal. Make sure alerts reach a person or shared mailbox that actually reads them.
- Onboard all devices. A device that is not onboarded is not protected. Onboard macOS, iOS and Android as well as Windows, and compare the number with your own list.
- Tamper protection. This prevents security settings on a device from being turned off or changed. In new deployments it is on by default. In existing deployments you turn it on in the Microsoft Defender portal under Settings, Endpoints, Advanced features. Cloud-delivered protection must be on for this. It turns on automatically when you enable tamper protection.
- Attack surface reduction rules. According to Microsoft, you can usually set the standard protection rules to Block or Warn mode without testing. Test other rules in Audit mode first, review the reports and add exclusions where needed.
- Follow up alerts and incidents. Agree who checks the Defender portal and how often.
What about your email?
Defender for Business protects devices, not your mailbox. Protection of email and files is part of Microsoft Defender for Office 365. Business Premium includes Defender for Office 365 Plan 1, as well as sensitivity labelling and data loss prevention (DLP) for email and files. If you buy Defender for Business standalone, you only get the device protection.
Checklist
- Check that everyone has a licence.
- Check that alerts reach the right person.
- Compare the number of devices in the Defender portal with your own list.
- Turn on tamper protection.
- Enable the standard attack surface reduction rules.
- Review the monthly security summary report.
- Check separately whether Defender for Office 365 is set up.