Microsoft Defender for Business: what it covers and how to deploy it in an SMB

The short answer: Microsoft Defender for Business is the endpoint security solution Microsoft designs for organisations of up to 300 users. It uses the engine of Microsoft Defender for Endpoint, the enterprise tool, with a simplified console: next-generation antivirus, attack surface reduction, endpoint detection and response (EDR), automated investigation and remediation. It is included in Microsoft 365 Business Premium or sold standalone, protects up to five devices per user (Windows, Mac, Android, iOS), and servers need an extra licence. Deployment uses Intune, Group Policy or a local script. This guide covers what it includes, its limits and the deployment method we use.

At ALLSAFE SOLUTIONS, a managed IT provider in Casablanca and a Microsoft partner, we deploy and monitor Defender for Business as part of our business cybersecurity in Morocco offering. All capabilities quoted come from Microsoft Learn documentation on Defender for Business.

What Defender for Business covers

Microsoft presents Defender for Business as protection against ransomware, malware, phishing and other threats on devices. In practice it includes:

• Next-generation protection: antivirus and real-time protection, built into Windows and available as an app on Mac, Android and iOS.
• Attack surface reduction: rules that block typical attack behaviours (macros, scripts, executables launched from email), network protection, web protection.
• Endpoint detection and response (EDR): recording device activity to reconstruct an attack and respond, for example by isolating a device from the network.
• Automated investigation and remediation: the tool analyses an alert and fixes some threats by itself.
• Automatic attack disruption: listed by Microsoft among the included features, to contain an attack in progress.
• Vulnerability management (core capabilities): a list of vulnerable software and missing patches across the fleet.
• Simplified Windows firewall and antivirus configuration, a feature unique to Defender for Business.
• Monthly security summary reporting and threat analytics.

To understand why EDR changes the game compared with traditional antivirus, read our article EDR vs antivirus.

Defender for Business, Defender for Endpoint P1 and P2

Microsoft describes Defender for Business as all Defender for Endpoint Plan 1 features, some Plan 2 features, and features unique to SMBs.

Feature	Defender for Business	Defender for Endpoint P1	Defender for Endpoint P2
Next-generation antivirus	Yes	Yes	Yes
Attack surface reduction	Yes	Yes	Yes
EDR	Yes (optimised)	No	Yes
Automated investigation and remediation	Yes	No	Yes
Automatic attack disruption	Yes	No	Yes
Vulnerability management (core)	Yes	No	Yes
Advanced hunting and long data retention	No	No	Yes
Simplified firewall and antivirus configuration	Yes	No	No
Servers	Extra licence	Extra licence	Extra licence

Source: Microsoft Learn, “What is Microsoft Defender for Business”. For an SMB, what is missing compared with Plan 2 is mainly advanced threat hunting and data retention length, which matter to a dedicated security team.

Licensing: standalone or in Business Premium

Defender for Business comes in two forms:

• Included in Microsoft 365 Business Premium, with Intune, Entra ID P1 conditional access and Defender for Office 365 Plan 1 for email. We compare the editions in Microsoft 365 Business Basic, Standard or Premium.
• Standalone, for companies on Business Basic, Business Standard or Office 365 E1, or that do not use Microsoft 365.

Three licensing rules to know, according to Microsoft’s FAQ:

1. 300 users maximum. Beyond that, Microsoft points to Defender for Endpoint or Microsoft 365 E3/E5.
2. Five client devices per user licence.
3. Servers are extra: Windows Server and Linux need an additional licence, such as Microsoft Defender for Business servers, available as an add-on to the standalone version and to Business Premium. Beyond 60 servers, Microsoft says a different type of licence is required.

Microsoft also notes that licences do not mix: an organisation with both Defender for Business and a few Defender for Endpoint Plan 2 licences stays on the Defender for Business experience. If you buy your licences in Morocco, see buying Microsoft 365 in Morocco.

Supported systems

Device	Support	Deployment methods offered by Microsoft
Windows 10 and 11	Pro, Enterprise and Business editions	Intune, Group Policy, local script
Mac	Yes	Local script (recommended by Microsoft), Intune
Android, iOS and iPadOS	Yes	Microsoft Defender app, Intune
Windows Server	With server licence	Local script
Linux	With server licence	Defender deployment tool, script, Ansible, Chef, Puppet

Watch the Windows edition: PCs running Windows Home are not on the list of required operating systems. This is common in SMBs that bought consumer laptops; an upgrade to Windows Pro is then needed.

Deployment, step by step

This is the method we follow, aligned with Microsoft’s setup guide.

1. Prepare the ground

• Check assigned licences and the Windows edition of each PC.
• Inventory the current antivirus. Microsoft warns that with third-party antivirus in place, real-time protection may be turned off and the device shown as unprotected: so plan to cleanly uninstall the old product, device by device, at cutover.
• Define access roles for the Microsoft Defender portal, keeping administrators to a minimum, as explained in our guide to privileged admin account management.

2. Choose the device onboarding method

• Intune, if your PCs are already enrolled or you have Business Premium: the cleanest method, because the same console then manages updates, encryption and compliance. See our guide Microsoft Intune for SMBs.
• Group Policy, if you have an on-premises Active Directory and no Intune yet.
• Local script, for a few devices. Microsoft says the script creates the trust with Microsoft Entra ID, enrols the device in Intune if it is not already enrolled and onboards it to Defender for Business; it recommends batches of no more than ten devices.

3. Test detection

After onboarding, Microsoft provides a detection test for Windows and a phishing test: the device must block a test address and an alert must appear in the portal. Do not move on until these tests pass.

4. Apply and harden policies

Defender for Business applies default security policies from onboarding. We complement them:

• Attack surface reduction rules, first in audit mode to spot what would break, then in block mode. According to Microsoft, some features such as these rules and controlled folder access are configured in the Intune admin center.
• Device groups: standard PCs, management and finance PCs, servers, each with suitable policies.
• Web content filtering: Microsoft notes that only one web content filtering policy is possible per organisation.
• Tamper protection, so that an attacker or a user cannot turn protection off.

5. Onboard servers and mobiles

Servers are onboarded once server licences are acquired and the policy enforcement scope is enabled for Windows Server. Business phones get the Microsoft Defender app, which adds anti-phishing protection on mobile.

6. Monitor and handle incidents

This is the step most often forgotten. Defender for Business automatically fixes some threats, but incidents still need to be read and handled: an isolated PC must be cleaned, a compromised account reset, a vulnerability patched. Without someone watching the console, an EDR tool loses most of its value. That is the whole point of managed EDR with 24/7 monitoring.

Defender for Business or another solution?

Defender for Business is a natural choice if you are already on Microsoft 365 Business Premium: you have already paid for it, and it integrates with Intune and Entra ID. It is not the only good choice. A company with many servers, a mixed fleet or a preference for a console independent of Microsoft may prefer another solution, such as Kaspersky or WatchGuard. We compare the options in business antivirus in Morocco: how to choose.

Whatever the product, endpoint protection is only one layer: it goes with multi-factor authentication, secured email, see secure Microsoft 365 in 10 settings, and a hardened directory, see Active Directory hardening for SMBs.

The mistakes we fix most often

1. Business Premium paid for, Defender for Business never activated: the licences exist but no device is onboarded.
2. Two antivirus products at once, cancelling each other out or slowing PCs down.
3. PCs on Windows Home, which cannot be onboarded.
4. Forgotten servers, even though they are what ransomware encrypts first.
5. Attack surface reduction rules never enabled, for fear of blocking a business application.
6. A console nobody looks at, with alerts left unhandled for weeks.

Checklist

• Licences checked: Business Premium or Defender for Business, plus server licences.
• All PCs on Windows Pro, Enterprise or Business.
• Old antivirus cleanly removed at cutover.
• Devices onboarded through Intune, Group Policy or script, in batches.
• Detection and phishing tests passed.
• Attack surface reduction rules moved from audit to block.
• Tamper protection and web filtering enabled.
• Servers and business phones onboarded.
• Incidents monitored and handled, including outside business hours.

How we do it

We start with a free initial audit: licences in place, Windows editions, current antivirus, state of Intune and the directory. We then prepare the policies, deploy Defender for Business in batches starting with a pilot group, check each device in the console and onboard the servers. Incidents are then watched by our 24/7 monitoring team, and a critical incident is handled in under 15 minutes, as part of our managed IT services in Morocco.

ALLSAFE SOLUTIONS also supplies Microsoft 365 and Defender for Business licences, with or without deployment. Request your free initial audit: we reply within 24 business hours.