Microsoft Defender SKUs Australia pricing 2026 — every Defender plan explained

Microsoft has eleven distinct Defender products in 2026 and the SKU map confuses every buyer the first time they hit it. This is the AU mid-market explainer — every Defender SKU, AUD pricing, what each one is for, and which Microsoft 365 bundles include them.

Defender for Endpoint — P1 and P2

Defender for Endpoint is the EDR platform — agent on every endpoint, behavioural detection, automated investigation, threat-and-vulnerability management.

• Defender for Endpoint Plan 1 (P1) — $4.20 AUD/user/month standalone. Included in Microsoft 365 E3, Business Premium. Antivirus, Attack Surface Reduction rules, network protection, web filtering — but no EDR sensor, no automated investigation, no TVM.
• Defender for Endpoint Plan 2 (P2) — $8.60 AUD/user/month standalone. Included in Microsoft 365 E5, E5 Security. Adds EDR sensor (the behavioural detection engine), advanced hunting (KQL across endpoint data), automated investigation, threat-and-vulnerability management core, sandbox-based analysis.
• Defender Vulnerability Management add-on — $2.30 AUD/user/month, layered on Defender P2. Adds security baselines, browser extension assessment, certificate inventory, authenticated network scan.

Defender for Office 365 — P1 and P2

Defender for Office 365 protects email and collaboration (Teams, SharePoint, OneDrive) against phishing, malware, BEC and account takeover.

• Defender for Office 365 Plan 1 (P1) — $3 AUD/user/month standalone. Included in Microsoft 365 Business Premium. Safe Attachments, Safe Links, anti-phishing policies, real-time detections.
• Defender for Office 365 Plan 2 (P2) — $7 AUD/user/month standalone. Included in E5, E5 Security. Adds Threat Explorer (full attack investigation), Attack Simulation Training (phishing simulations), automated investigation and response, advanced campaign view.

Defender for Identity

On-premises Active Directory and ADFS attack detection. The only Defender that protects on-premises identity.

• Defender for Identity — $7.10 AUD/user/month standalone. Included in Microsoft 365 E5, E5 Security, EMS E5. Detects Kerberoasting, Pass-the-Hash, Pass-the-Ticket, DCSync, DCShadow, AD reconnaissance, lateral-movement-path mapping.

Defender for Cloud Apps

The Cloud Access Security Broker (CASB). Shadow IT discovery, SaaS policy enforcement, session policies via reverse proxy.

• Defender for Cloud Apps — $7.50 AUD/user/month standalone. Included in M365 E5, E5 Security, EMS E5. Shadow IT discovery from Defender for Endpoint feeds, API connectors to sanctioned SaaS, in-line session controls.

Defender XDR (formerly Microsoft 365 Defender)

Defender XDR is the unified portal and the correlation engine across the other Defenders. It doesn't have its own licence — having any of Defender for Endpoint P2, Defender for Office P2, Defender for Identity or Defender for Cloud Apps unlocks Defender XDR. Adding more Defenders adds more signal sources to the unified investigation.

Defender for Cloud (separate from Defender for Cloud Apps)

Defender for Cloud is the Azure workload protection platform — VMs, containers, databases, storage. Confusingly named almost identically to Defender for Cloud Apps. Pay-as-you-go through your Azure subscription:

• Defender for Servers Plan 1 — approximately $7.50 AUD per server per month. Foundational EDR for Azure VMs and hybrid via Azure Arc.
• Defender for Servers Plan 2 — approximately $22 AUD per server per month. Adds Just-In-Time VM access, adaptive application controls, file integrity monitoring, regulatory compliance assessments, free Defender Vulnerability Management for the users on those servers.
• Defender for Storage, Databases, Containers, App Service, Key Vault, DNS, Resource Manager — each has its own per-resource or transaction-based pricing.

The bundle math — when do standalone Defenders win, when does E5 Security?

If you're buying every Defender at the user level, standalone pricing adds up: Defender for Endpoint P2 + Defender for Office P2 + Defender for Identity + Defender for Cloud Apps = $30.20 AUD/user/month at standalone. E5 Security bundles all four for $18.30 AUD/user/month — a meaningful saving on top of an E3 base. The full E5 SKU at $89.60 AUD/user/month also bundles Power BI Pro, Audio Conferencing, Phone System, Advanced Compliance, and Sentinel benefits — for tenants using all of those it's the better bundle.

The AU mid-market default

For an AU mid-market organisation in 2026 standardising on Microsoft 365 security, the typical position is: Microsoft 365 E3 + E5 Security add-on (gives you all four user-level Defenders) + Defender for Cloud per-resource pricing on Azure workloads + Defender Vulnerability Management add-on for the security baselines feature. This typically lands cheaper than full E5 unless you need the Phone System and Audio Conferencing.