How much does Microsoft Defender for Endpoint cost per user in 2026?

Microsoft Defender for Endpoint has two published plans: Plan 1 at $3 per user per month (bundled with Microsoft 365 E3) and Plan 2 at $5.20 per user per month (bundled with Microsoft 365 E5). The standalone license covers up to 5 devices per user. Servers are licensed separately (Microsoft Defender pricing page, September 2026).

Is Defender for Endpoint included in Microsoft 365 E3 or E5?

Yes. Defender for Endpoint Plan 1 ships with Microsoft 365 E3, and Defender for Endpoint Plan 2 ships with Microsoft 365 E5. Microsoft 365 E5 Security is the standalone bundle that includes Plan 2 without the full E5 productivity stack. For organizations already on Microsoft 365, the marginal cost of Plan 2 over Plan 1 is effectively zero when they upgrade to E5 (Microsoft, September 2026).

How much does Defender for Servers cost?

Defender for Servers is a separate Plan 2 add-on priced at $11 per server per month, or included with Microsoft Defender for Cloud for Azure workloads. Standalone deployments outside Azure buy the same Plan 2 server license per workload. Microsoft Defender for Cloud customers receive Defender for Servers included in the standard tier at no extra cost (Microsoft Defender for Cloud pricing page, September 2026).

How does Defender for Endpoint compare to CrowdStrike at $5.20 per user per month?

Microsoft Defender for Endpoint Plan 2 at $5.20 per user per month lists below CrowdStrike Falcon Enterprise's $184.99 per endpoint per year ($15.42 per endpoint per month). The gap narrows once CrowdStrike volume discounts apply at 1,000+ seats, but Microsoft retains a structural cost advantage for organizations already on Microsoft 365 because the marginal incremental cost of Plan 2 over Plan 1 is zero in E5 (Costbench, July 2026).

Defender for Endpoint Pricing 2026: P1 vs P2

Q: What is the difference between Defender for Endpoint Plan 1 and Plan 2?

Plan 1 covers next-generation antimalware and attack surface reduction. Plan 2 adds endpoint detection and response, automated investigation and remediation, threat analytics, threat hunting, and vulnerability management for Windows, macOS, Linux, iOS, and Android. Plan 2 is the tier that maps to most mid-market and enterprise EDR requirements (Microsoft Defender pricing page, September 2026).

Microsoft Defender for Endpoint Pricing 2026 (P1 vs P2)

Microsoft Defender for Endpoint pricing in 2026 is $3 per user per month for Plan 1 (NGAV and attack surface reduction) and $5.20 per user per month for Plan 2 (full EDR with threat hunting and vulnerability management). Plan 1 ships with Microsoft 365 E3; Plan 2 ships with Microsoft 365 E5. Defender for Servers is $11 per server per month when purchased standalone (Microsoft Defender pricing page, September 2026).

The single user license covers up to 5 devices per user, which is why Microsoft Defender for Endpoint is the most cost-efficient endpoint platform for organizations already standardized on Microsoft 365.

Last verified: Sep 15, 2026.

Plan 1 $3 per user per month (NGAV, included in Microsoft 365 E3)
Plan 2 $5.20 per user per month (EDR, included in Microsoft 365 E5)
Defender for Servers $11 per server per month standalone
Single license covers up to 5 devices per user
Cross-platform support for Windows, macOS, Linux, iOS, Android at no extra cost

What Defender for Endpoint Plan 1 and Plan 2 include

Plan 1 is the prevention layer and Plan 2 is the detection and response layer. Microsoft splits Defender for Endpoint the same way every endpoint platform does, with Plan 1 covering next-generation antimalware and attack surface reduction rules and Plan 2 adding the full EDR engine, automated investigation, threat analytics, threat hunting, and vulnerability management. Plan 1 supports Windows devices only. Plan 2 extends to macOS, Linux, iOS, and Android at no extra cost (Microsoft Defender pricing page, September 2026).

TOP PICK FOR SOC ANALYSTS CompTIA CySA+ CS0-004 Study Guide

Sybex • CS0-004 edition - 4.6

Check price on Amazon

Capability	Plan 1 (E3)	Plan 2 ($5.20 + E5)
Next-generation antimalware	Yes	Yes
Attack surface reduction	Yes	Yes
Endpoint detection and response	No	Yes
Automated investigation and remediation	No	Yes
Threat analytics	No	Yes
Threat hunting	No	Yes
Vulnerability management	No	Yes
macOS, Linux, iOS, Android coverage	Windows only	All listed platforms

Most compliance programs (SOC 2 Type II, HIPAA, PCI DSS 4.0) require endpoint detection and response, which makes Plan 2 the realistic baseline for regulated buyers. Plan 1 is sufficient only for small organizations without SOC 2 or HIPAA scope that just want next-generation antivirus replacing a legacy endpoint product (Microsoft Defender pricing page, September 2026).

Microsoft 365 bundling and the effective cost

Defender for Endpoint is included with Microsoft 365 E3 (Plan 1) and E5 (Plan 2). For organizations already paying for Microsoft 365 E3, upgrading to E5 unlocks Plan 2 without a new line item. Microsoft 365 E5 lists at $57 per user per month and includes Plan 2, Defender for Identity, Defender for Cloud Apps, Defender for Office 365 P2, and Azure AD P2 (Microsoft 365 pricing, September 2026).

Microsoft 365 plan	Defender for Endpoint included	Other Defender bundles	Microsoft 365 list price
Microsoft 365 E3	Plan 1	None	$36 per user per month
Microsoft 365 E5	Plan 2	Defender for Identity, Defender for Cloud Apps, Defender for Office 365 P2, Azure AD P2	$57 per user per month
Microsoft 365 E5 Security	Plan 2	E5 Security bundle (no full E5 productivity stack)	$12.40 per user per month standalone add-on

The marginal cost analysis matters here. If an organization is already paying for Microsoft 365 E5, Defender for Endpoint Plan 2 is effectively free. If the organization is on E3, the cheapest path to Plan 2 is either the $5.20 per user per month standalone add-on or the upgrade to E5 for $21 per user per month additional, which brings the full Defender suite plus Azure AD P2 in one stack (Microsoft 365 pricing, September 2026).

Cost comparison at 1,000 and 5,000 users

Defender for Endpoint Plan 2 at $5.20 per user per month stays below CrowdStrike Falcon Enterprise for the same EDR scope. The table below shows the annual list at two common scales, before volume discount and bundled Microsoft 365 E5 pricing (Costbench, July 2026).

TOP CERT PREP FOR SECURITY PROFESSIONALS CompTIA Security+ SY0-801 Study Guide

Sybex • SY0-801 edition - 4.7

Check price on Amazon

Deployment profile	Users	Defender for Endpoint Plan 2 (standalone)	Microsoft 365 E5 (Plan 2 included)	Annual total (E5)
Mid-market	1,000	$5.20 per user per month · $62,400 per year	$57 per user per month	$684,000 per year
Enterprise	5,000	$5.20 per user per month · $312,000 per year	$57 per user per month	$3,420,000 per year

Compared to CrowdStrike Falcon Enterprise at $184.99 per endpoint per year ($15.42 per endpoint per month) or SentinelOne Singularity Complete at $179.99 per endpoint per year ($15.00 per endpoint per month), Microsoft Defender for Endpoint Plan 2 at $5.20 per user per month is structurally cheaper. The cost advantage is largest for organizations buying standalone Defender for Endpoint outside Microsoft 365; for organizations already paying for Microsoft 365 E5, Defender for Endpoint Plan 2 is effectively included (Costbench, July 2026).

Defender for Servers and the cross-cloud cost

Servers are priced separately from user licenses. Defender for Servers Plan 2 is $11 per server per month when bought standalone through the Microsoft 365 admin center, and is included in Defender for Cloud Standard and Deployments Standard tiers. Azure workloads typically include Defender for Servers under Defender for Cloud; AWS and Google Cloud workloads buy the standalone license (Microsoft Defender for Cloud pricing page, September 2026).

The mixed-cloud pricing model is the most common procurement surprise for organizations buying Defender for Endpoint. The user license covers the laptop and desktop estate, but every Windows or Linux server in scope needs its own $11 per server per month license unless the workload is already on Defender for Cloud. For a mid-market organization with 500 servers, Defender for Servers adds $66,000 per year to the total Defender bill (Microsoft Defender for Cloud pricing page, September 2026).

What Defender for Endpoint Plan 2 includes that competitors charge for

For the competing quotes, see CrowdStrike Falcon pricing and SentinelOne pricing, or the head-to-head in our CrowdStrike vs SentinelOne comparison.

The bundled packaging is what makes Plan 2 meaningful at $5.20 per user per month. Plan 2 includes threat analytics, threat hunting, vulnerability management, automated investigation, and EDR coverage for macOS, Linux, iOS, and Android at no add-on cost. Competitors like CrowdStrike bundle threat intelligence, identity protection, and cloud workload protection as separately priced modules that lift the per-endpoint cost above the listed base license (Microsoft Defender pricing page, September 2026).

Procurement teams that compare Defender for Endpoint Plan 2 against CrowdStrike Falcon Enterprise at list price sometimes miss the add-on gap. CrowdStrike Identity Threat Detection, CrowdStrike Falcon Cloud Workload Protection, Falcon Intelligence, and Falcon LogScale SIEM each sit at separate per-endpoint pricing. Once a Defender for Endpoint Plan 2 deployment is sized against a CrowdStrike Enterprise deployment with the same add-ons, the per-endpoint gap widens to Defender's advantage (Costbench, July 2026).