Microsoft Defender for Endpoint Pricing 2026 (P1 vs P2)

Quick Answer

Microsoft Defender for Endpoint pricing in 2026 is $3 per user per month for Plan 1 (NGAV and attack surface reduction) and $5.20 per user per month for Plan 2 (full EDR with threat hunting and vulnerability management). Plan 1 ships with Microsoft 365 E3; Plan 2 ships with Microsoft 365 E5. Defender for Servers is $11 per server per month when purchased standalone (Microsoft Defender pricing page, September 2026).

The single user license covers up to 5 devices per user, which is why Microsoft Defender for Endpoint is the most cost-efficient endpoint platform for organizations already standardized on Microsoft 365.

Last verified: Sep 15, 2026.

At a glance

• Plan 1 $3 per user per month (NGAV, included in Microsoft 365 E3)
• Plan 2 $5.20 per user per month (EDR, included in Microsoft 365 E5)
• Defender for Servers $11 per server per month standalone
• Single license covers up to 5 devices per user
• Cross-platform support for Windows, macOS, Linux, iOS, Android at no extra cost

What Defender for Endpoint Plan 1 and Plan 2 include

Plan 1 is the prevention layer and Plan 2 is the detection and response layer. Microsoft splits Defender for Endpoint the same way every endpoint platform does, with Plan 1 covering next-generation antimalware and attack surface reduction rules and Plan 2 adding the full EDR engine, automated investigation, threat analytics, threat hunting, and vulnerability management. Plan 1 supports Windows devices only. Plan 2 extends to macOS, Linux, iOS, and Android at no extra cost (Microsoft Defender pricing page, September 2026).

Most compliance programs (SOC 2 Type II, HIPAA, PCI DSS 4.0) require endpoint detection and response, which makes Plan 2 the realistic baseline for regulated buyers. Plan 1 is sufficient only for small organizations without SOC 2 or HIPAA scope that just want next-generation antivirus replacing a legacy endpoint product (Microsoft Defender pricing page, September 2026).

Microsoft 365 bundling and the effective cost

Defender for Endpoint is included with Microsoft 365 E3 (Plan 1) and E5 (Plan 2). For organizations already paying for Microsoft 365 E3, upgrading to E5 unlocks Plan 2 without a new line item. Microsoft 365 E5 lists at $57 per user per month and includes Plan 2, Defender for Identity, Defender for Cloud Apps, Defender for Office 365 P2, and Azure AD P2 (Microsoft 365 pricing, September 2026).

The marginal cost analysis matters here. If an organization is already paying for Microsoft 365 E5, Defender for Endpoint Plan 2 is effectively free. If the organization is on E3, the cheapest path to Plan 2 is either the $5.20 per user per month standalone add-on or the upgrade to E5 for $21 per user per month additional, which brings the full Defender suite plus Azure AD P2 in one stack (Microsoft 365 pricing, September 2026).

Cost comparison at 1,000 and 5,000 users

Defender for Endpoint Plan 2 at $5.20 per user per month stays below CrowdStrike Falcon Enterprise for the same EDR scope. The table below shows the annual list at two common scales, before volume discount and bundled Microsoft 365 E5 pricing (Costbench, July 2026).

Compared to CrowdStrike Falcon Enterprise at $184.99 per endpoint per year ($15.42 per endpoint per month) or SentinelOne Singularity Complete at $179.99 per endpoint per year ($15.00 per endpoint per month), Microsoft Defender for Endpoint Plan 2 at $5.20 per user per month is structurally cheaper. The cost advantage is largest for organizations buying standalone Defender for Endpoint outside Microsoft 365; for organizations already paying for Microsoft 365 E5, Defender for Endpoint Plan 2 is effectively included (Costbench, July 2026).

Defender for Servers and the cross-cloud cost

Servers are priced separately from user licenses. Defender for Servers Plan 2 is $11 per server per month when bought standalone through the Microsoft 365 admin center, and is included in Defender for Cloud Standard and Deployments Standard tiers. Azure workloads typically include Defender for Servers under Defender for Cloud; AWS and Google Cloud workloads buy the standalone license (Microsoft Defender for Cloud pricing page, September 2026).

The mixed-cloud pricing model is the most common procurement surprise for organizations buying Defender for Endpoint. The user license covers the laptop and desktop estate, but every Windows or Linux server in scope needs its own $11 per server per month license unless the workload is already on Defender for Cloud. For a mid-market organization with 500 servers, Defender for Servers adds $66,000 per year to the total Defender bill (Microsoft Defender for Cloud pricing page, September 2026).

What Defender for Endpoint Plan 2 includes that competitors charge for

The bundled packaging is what makes Plan 2 meaningful at $5.20 per user per month. Plan 2 includes threat analytics, threat hunting, vulnerability management, automated investigation, and EDR coverage for macOS, Linux, iOS, and Android at no add-on cost. Competitors like CrowdStrike bundle threat intelligence, identity protection, and cloud workload protection as separately priced modules that lift the per-endpoint cost above the listed base license (Microsoft Defender pricing page, September 2026).

Procurement teams that compare Defender for Endpoint Plan 2 against CrowdStrike Falcon Enterprise at list price sometimes miss the add-on gap. CrowdStrike Identity Threat Detection, CrowdStrike Falcon Cloud Workload Protection, Falcon Intelligence, and Falcon LogScale SIEM each sit at separate per-endpoint pricing. Once a Defender for Endpoint Plan 2 deployment is sized against a CrowdStrike Enterprise deployment with the same add-ons, the per-endpoint gap widens to Defender's advantage (Costbench, July 2026).