Written and maintained by CASRAI Editorial Board
Last updated
If you administer IT for a research group, department, or small institute running on Microsoft 365, the honest answer to “what does Microsoft Defender for Business cost” is usually: you may already be paying for it and not know it. As of this writing (August 2026), Microsoft lists Defender for Business as a standalone add-on at $3.00 per user, per month on an annual commitment — but it is also bundled into Microsoft 365 Business Premium, which Microsoft currently lists at $32.00 per user, per month (annual billing, Copilot features included). If your institution already licenses Business Premium for its research staff, Defender for Business is already switched on for those seats at no incremental cost.
This page walks through the actual current pricing, what you get at each Microsoft 365 tier, and — honestly — when Defender for Business is genuinely enough versus when a research institution has outgrown it and should look at a dedicated platform like Bitdefender GravityZone. If you want the feature-by-feature breakdown rather than the pricing question, see our companion page, Microsoft Defender vs. Bitdefender GravityZone for Research Institutions.
What Microsoft Defender for Business actually costs (verified August 2026)
Pricing below is Microsoft’s published list pricing, checked directly against microsoft.com on 2026-08-30. Microsoft’s packaging and pricing change without much notice — if you’re budgeting a renewal, re-check the current figures against your own tenant’s licensing agreement rather than relying on any published page, including this one.
| Plan | List price (annual billing) | Includes Defender for Business? |
|---|---|---|
| Microsoft 365 Business Basic | $7.00/user/mo | No — spam/malware email filtering only |
| Microsoft 365 Business Standard | $23.50/user/mo | No — same baseline email protection as Basic |
| Microsoft 365 Business Premium | $32.00/user/mo | Yes — Defender for Business is bundled in |
| Microsoft Defender for Business (standalone) | $3.00/user/mo | N/A — this is the standalone product itself |
A few things worth being direct about:
- The standalone $3/user/month add-on is the cheapest path if you’re on Business Standard or Basic and want real endpoint protection without upgrading the whole seat to Premium. It is genuinely a separate purchase, not a bundled-only feature.
- Business Premium’s list price has moved. Earlier public pricing for Business Premium sat closer to $22/user/month before Microsoft began bundling Copilot features into the plan; the current $32/user/month figure reflects that repackaging, confirmed directly against Microsoft’s own pricing page as of this writing. Don’t assume an older $22 figure you may have seen elsewhere (including in older CASRAI content) is still current — check your renewal quote.
- Defender for Business standalone is capped at 300 users, five devices per user, no minimum device count. Above 300 seats, Microsoft routes you to Defender for Endpoint Plan 1 or Plan 2 (sold under enterprise licensing, not the small-business SKU this page covers) — a separate product with separate pricing, not a simple continuation of the same line item.
Why so many institutions think their endpoint security is “free”
This is the actual source of the pricing confusion behind this search. Windows ships with Microsoft Defender Antivirus built in at no separate charge — that’s real, basic, signature-and-heuristic antivirus. Microsoft Defender for Business is a different, paid product layered on top: centralized management across all your org’s devices, next-generation antivirus tuned centrally rather than per-device, vulnerability management, and endpoint detection and response (EDR) with automated investigation and attack disruption. If your institution licenses Microsoft 365 Business Premium, that upgrade is already paid for as part of the M365 bill — which is exactly why IT staff who didn’t set up the original licensing often assume endpoint security is “free”: someone else already paid for it, bundled into a line item that says “Microsoft 365,” not “security.”
Before spending anything additional, the first real step for any lab or department IT lead is simply: find out which Microsoft 365 plan your institution’s central IT actually licenses for your seats. If it’s Business Premium (or an equivalent enterprise E3/E5 tier with Defender for Endpoint), you may already have real protection switched on and simply not configured or monitored.
Compare centralized protection options →
When Defender for Business is genuinely good enough — be honest about this
For a large share of small research groups, labs, and departments already paying for Microsoft 365 Business Premium, Defender for Business is the right call, and switching to a dedicated third-party platform would be wasted spend. If your environment looks like this, stop reading the “upgrade” pitch below and keep what you have:
- Your devices are almost entirely Windows, managed through the same Microsoft 365/Entra ID tenant.
- You’re a single lab, single department, or small institute — not managing security separately across multiple grant-funded sub-groups or sub-tenants with different reporting lines.
- Your compliance obligations (e.g. a funder’s basic cybersecurity attestation) don’t require a named EDR/XDR platform or vendor-specific reporting.
- You have someone who can actually configure and monitor the Microsoft 365 Defender portal — the capability is only real if it’s turned on and watched.
In that case, paying separately for GravityZone or a comparable platform on top of a Business Premium seat you’re already paying for is duplicate spend on the same job. Say so plainly to whoever’s asking for a security-tool budget line.
When a research institution has genuinely outgrown Defender for Business
The honest case for upgrading to a dedicated platform like Bitdefender GravityZone shows up when one of these is actually true — not as a generic “more security is always better” pitch:
- Cross-platform lab equipment beyond Windows. Research environments routinely run instrument-control workstations, imaging consoles, and lab servers on Linux, along with a mix of macOS in the same building. Defender for Business’s small-business SKU is scoped to Windows, macOS, iOS, and Android — it does not cover Linux endpoints, which is a real gap for labs running instrumentation or HPC-adjacent Linux boxes alongside their Windows fleet.
- Centralized management across grant-funded sub-groups. A single principal investigator’s lab is one thing; a center or institute managing security posture across several federally-funded sub-groups, each with its own device inventory and sometimes its own compliance reporting requirement, needs multi-tenant-style centralized console management that the small-business Defender tier isn’t built for.
- Deeper EDR/XDR telemetry and threat-hunting. Defender for Business gives you EDR with automated investigation; if your institution needs to correlate telemetry across email, identity, cloud workloads and endpoints in one console with more granular hunting queries, that’s the case for a full EDR/XDR platform, whether that’s GravityZone or Defender for Endpoint Plan 2 under an enterprise agreement.
- You are not a Microsoft 365 shop. If your institution runs Google Workspace or a mixed environment without a Business Premium/E5 tenant to bundle into, there’s no “free” path through Microsoft licensing at all — the standalone $3/user/month Defender add-on and a third-party platform are then genuinely comparable line items, and the decision comes down to platform coverage and management console fit, not price.
If none of those describe your actual environment, the honest answer is: don’t upgrade yet. If one or more genuinely does, GravityZone is worth evaluating specifically for the gap you have — not as a blanket replacement for licensing you’re already paying for.
See GravityZone plans and coverage →
How to check what you already have before buying anything
- Ask your institution’s central IT or your Microsoft 365 admin which license SKU is assigned to your seats — not just “Microsoft 365,” but specifically Business Basic, Standard, Premium, or an enterprise E3/E5 tier.
- If you’re on Business Premium or E5, sign in to the Microsoft 365 Defender portal (security.microsoft.com) and confirm Defender for Business/Endpoint is actually onboarded on your devices — licensing a feature and activating it are two different steps, and it’s common for the license to be paid for and the rollout to have stalled.
- If you’re on Basic or Standard with no endpoint protection layer, price the $3/user/month standalone add-on against your device count before considering a full platform switch.
- Only once you’ve confirmed what’s actually switched on today should you evaluate whether a dedicated platform closes a real gap, using the capability list above rather than a general sense that “more security software is better.”
Frequently asked questions
Is Microsoft Defender for Business the same as Windows Defender?
No. Windows Defender (Microsoft Defender Antivirus) is free, built into Windows, and provides baseline antivirus on a single device. Microsoft Defender for Business is a separate, paid, centrally-managed product covering next-generation antivirus, vulnerability management, and endpoint detection and response (EDR) across your whole device fleet from one console.
Does Microsoft 365 Business Premium include Defender for Business at no extra cost?
Yes — Defender for Business is bundled into Business Premium. If your institution already licenses Business Premium for a seat, you are not paying anything additional for Defender for Business on that seat; it’s included in the $32/user/month (as of this writing) Business Premium price.
Can I buy Microsoft Defender for Business without Microsoft 365 Business Premium?
Yes. It’s sold as a standalone add-on at $3.00/user/month (annual billing) for organizations up to 300 users, independent of which Microsoft 365 plan you’re on.
What does Bitdefender GravityZone cost compared to Defender for Business?
GravityZone doesn’t publish a flat per-device list price the way Microsoft does — it’s quoted against your specific endpoint count at checkout. That makes a direct dollar-for-dollar comparison to Defender for Business’s published $3/user/month figure hard to state honestly without your own quote; the decision usually comes down to whether you need the capability gaps described above, not a simple price comparison.
My institution has more than 300 users — what are our options?
Microsoft’s small-business Defender for Business SKU caps out at 300 users. Above that, Microsoft routes larger organizations to Defender for Endpoint Plan 1 or Plan 2 under enterprise licensing (often bundled into Microsoft 365 E3/E5), which is a different product and pricing structure from what’s covered on this page. A dedicated platform like GravityZone is also built to scale past that headcount with its own centralized console.
Check GravityZone pricing for your device count →
For the feature-level comparison — what each platform actually catches, how management consoles differ, and where GravityZone’s advantage is most concrete — see Microsoft Defender vs. Bitdefender GravityZone for Research Institutions.
