Defender for Endpoint: licensing and permissions

1. Microsoft Defender for Endpoint (MDE) is a security solution that safeguards endpoints, including Windows, macOS, Linux, Android, and iOS devices against threats. It offers four key capabilities: behavioral sensors, cloud security analytics, threat intelligence, and vulnerability management. MDE also includes next-generation protection tools such as Microsoft Defender Antivirus, EDR, and Defender Experts for managed hunting services.

2. Microsoft offers two plans for MDE: Plan 1 and Plan 2. Plan 1 includes features such as next-gen antivirus, attack surface reduction (ASR), and manual response capabilities. Plan 2 adds EDR, advanced hunting, and automated investigation, along with extra risk-assessment features from Defender Vulnerability Management. Microsoft Defender for Business is a version specifically designed for small and medium businesses. Servers require separate licensing through Defender for Servers or MDE for Servers.

3. Before implementing MDE, ensure your environment meets the following requirements: operating system versions, hardware specifications, network connectivity, and data location. Additionally, Microsoft Defender Antivirus must be present on the device, even if a third-party antivirus is the primary solution. The ELAM driver should be enabled for seamless integration.

Mixed licensing is possible, allowing different plans to be assigned to different user groups or devices, but it is not supported for servers or Microsoft Defender for Business.