Microsoft 365 Business Premium plus Defender for Endpoint P2
Microsoft licensing has a way of turning a simple question into a spreadsheet. For businesses of our clients' size, the answer is usually short: Microsoft 365 Business Premium for everyone, plus Microsoft Defender for Endpoint Plan 2 on every managed device. This post explains why.
What Business Premium covers
Business Premium is Microsoft's productivity and security bundle for small and medium-sized businesses, designed for organisations of up to 300 users. Alongside the Microsoft 365 apps, Exchange, SharePoint, OneDrive and Teams, it brings:
- Intune, for managing and securing Windows, Mac and mobile devices and keeping them up to date;
- Microsoft Entra ID P1, which unlocks Conditional Access;
- Defender for Business, Microsoft's endpoint security product for smaller organisations.
For many small businesses that's a solid foundation, and it's far better than a consumer antivirus product and an unmanaged laptop.
Defender for Business and Defender for Endpoint
Microsoft describes Defender for Business as including the features of Defender for Endpoint Plan 1, some features from Plan 2, and some extras aimed at smaller businesses. It has next-generation protection, attack surface reduction, endpoint detection and response in an optimised form, and automated investigation and remediation.
Plan 2 is the full enterprise product. The differences that matter to us:
| Capability | Defender for Business | Defender for Endpoint P2 |
|---|---|---|
| Endpoint detection and response | Yes (optimised) | Yes |
| Advanced hunting, 30 days of raw data | No | Yes |
| Six months of data retention | No | Yes |
| Attack surface reduction rules | Yes | Yes |
Why we add P2
Three reasons, in order of importance.
- Advanced hunting. When the SOC investigates an alert, it can query up to 30 days of raw device and security data to see what happened before and after. Without it, an investigation often stops at "something suspicious ran".
- Richer signals for the SOC. Our 24/7 cybersecurity remediation SOC works from the detection and response data. More depth means faster, more confident decisions about whether to isolate a laptop at two in the morning.
- App Control for Business. P2 supports our work towards App Control for Business, the control that lets only trusted code run. It's the Essential Eight's application control strategy and one of the most effective controls there is.
App Control is not something to switch on in week one. Turned on carelessly, it stops people working. We audit what the devices actually run, write a policy from that, and work towards enforcing it over time.
Is it worth it for everyone?
Not always. A five-person business with no sensitive data and nobody watching alerts may get most of the value from Defender for Business alone. The extra licence earns its keep when someone is actively using the data, which is why we pair it with round-the-clock monitoring rather than selling it on its own.
Whatever you choose, licences should be bought at a price you can see. We're a Microsoft CSP partner and pass licences through at our cost, so there's no incentive for us to push a bigger plan than you need.
How we handle it
Every client tenant runs Business Premium with Defender for Endpoint P2 on every managed device, attack surface reduction rules in the baseline and a 24/7 SOC on the alerts. More in Intune services and cyber security services.
Sources
Checked October 2026.