What is the difference between Defender for Endpoint Plan 1 and Plan 2?

Plan 1 ($4.20 AUD/user/month standalone, included in Microsoft 365 E3 and Business Premium) covers antivirus, Attack Surface Reduction rules, network protection and web filtering — but no EDR sensor. Plan 2 ($8.60 AUD/user/month standalone, included in E5 and E5 Security) adds the EDR behavioural detection engine, advanced hunting with KQL, automated investigation and threat-and-vulnerability management.

Which Defender products are included in Microsoft 365 E5?

E5 (and the E5 Security add-on) includes all four user-level Defenders: Defender for Endpoint P2, Defender for Office 365 P2, Defender for Identity and Defender for Cloud Apps. Having any one of the four also unlocks Defender XDR, the unified portal and correlation engine, which has no licence of its own.

Is E5 Security cheaper than buying Defender products standalone?

Yes, if you want all four. Standalone, Defender for Endpoint P2 + Defender for Office P2 + Defender for Identity + Defender for Cloud Apps adds up to $30.20 AUD/user/month; the E5 Security add-on bundles all four for $18.30 AUD/user/month on top of an E3 base. Full E5 at $89.80 AUD/user/month wins only when Power BI Pro, Audio Conferencing, Phone System and the compliance suite are also in use.

What Defender setup should an Australian mid-market organisation run?

The typical 2026 position Frontrow recommends: Microsoft 365 E3 plus the E5 Security add-on (all four user-level Defenders), Defender for Cloud per-resource pricing on Azure workloads, and the Defender Vulnerability Management add-on for security baselines. That usually lands cheaper than full E5 unless Phone System and Audio Conferencing are needed.

All 11 Microsoft Defender plans: AUD pricing (2026)

Q: What is the difference between Defender for Cloud and Defender for Cloud Apps?

Almost identically named, completely different products. Defender for Cloud Apps is the per-user CASB ($7.50 AUD/user/month, in E5) — shadow IT discovery, SaaS policy enforcement, session controls. Defender for Cloud is the Azure workload protection platform for VMs, containers, databases and storage, billed pay-as-you-go through the Azure subscription — for example Defender for Servers P1 at roughly $7.50 AUD per server per month and P2 at roughly $22.

Microsoft has eleven distinct Defender products in 2026 and the SKU map confuses every buyer the first time they hit it. This is the AU mid-market explainer — every Defender SKU, AUD pricing, what each one is for, and which Microsoft 365 bundles include them.

Defender for Endpoint — P1 and P2

Defender for Endpoint is the EDR platform — agent on every endpoint, behavioural detection, automated investigation, threat-and-vulnerability management.

Defender for Endpoint Plan 1 (P1) — $4.20 AUD/user/month standalone. Included in Microsoft 365 E3, Business Premium. Antivirus, Attack Surface Reduction rules, network protection, web filtering — but no EDR sensor, no automated investigation, no TVM.
Defender for Endpoint Plan 2 (P2) — $8.60 AUD/user/month standalone. Included in Microsoft 365 E5, E5 Security. Adds EDR sensor (the behavioural detection engine), advanced hunting (KQL across endpoint data), automated investigation, threat-and-vulnerability management core, sandbox-based analysis.
Defender Vulnerability Management add-on — $2.30 AUD/user/month, layered on Defender P2. Adds security baselines, browser extension assessment, certificate inventory, authenticated network scan.

Defender for Office 365 — P1 and P2

Defender for Office 365 protects email and collaboration (Teams, SharePoint, OneDrive) against phishing, malware, BEC and account takeover.

Defender for Office 365 Plan 1 (P1) — $3 AUD/user/month standalone. Included in Microsoft 365 Business Premium. Safe Attachments, Safe Links, anti-phishing policies, real-time detections.
Defender for Office 365 Plan 2 (P2) — $7 AUD/user/month standalone. Included in E5, E5 Security. Adds Threat Explorer (full attack investigation), Attack Simulation Training (phishing simulations), automated investigation and response, advanced campaign view.

Defender for Identity

On-premises Active Directory and ADFS attack detection. The only Defender that protects on-premises identity.

Defender for Identity — $7.10 AUD/user/month standalone. Included in Microsoft 365 E5, E5 Security, EMS E5. Detects Kerberoasting, Pass-the-Hash, Pass-the-Ticket, DCSync, DCShadow, AD reconnaissance, lateral-movement-path mapping.

Defender for Cloud Apps

The Cloud Access Security Broker (CASB). Shadow IT discovery, SaaS policy enforcement, session policies via reverse proxy.

Defender for Cloud Apps — $7.50 AUD/user/month standalone. Included in M365 E5, E5 Security, EMS E5. Shadow IT discovery from Defender for Endpoint feeds, API connectors to sanctioned SaaS, in-line session controls.

Defender XDR (formerly Microsoft 365 Defender)

Defender XDR is the unified portal and the correlation engine across the other Defenders. It doesn't have its own licence — having any of Defender for Endpoint P2, Defender for Office P2, Defender for Identity or Defender for Cloud Apps unlocks Defender XDR. Adding more Defenders adds more signal sources to the unified investigation.

Defender for Cloud (separate from Defender for Cloud Apps)

Defender for Cloud is the Azure workload protection platform — VMs, containers, databases, storage. Confusingly named almost identically to Defender for Cloud Apps. Pay-as-you-go through your Azure subscription:

Defender for Servers Plan 1 — approximately $7.50 AUD per server per month. Foundational EDR for Azure VMs and hybrid via Azure Arc.
Defender for Servers Plan 2 — approximately $22 AUD per server per month. Adds Just-In-Time VM access, adaptive application controls, file integrity monitoring, regulatory compliance assessments, free Defender Vulnerability Management for the users on those servers.
Defender for Storage, Databases, Containers, App Service, Key Vault, DNS, Resource Manager — each has its own per-resource or transaction-based pricing.

The bundle math — when do standalone Defenders win, when does E5 Security?

If you're buying every Defender at the user level, standalone pricing adds up: Defender for Endpoint P2 + Defender for Office P2 + Defender for Identity + Defender for Cloud Apps = $30.20 AUD/user/month at standalone. E5 Security bundles all four for $18.30 AUD/user/month — a meaningful saving on top of an E3 base. The full E5 SKU at $89.80 AUD/user/month also bundles Power BI Pro, Audio Conferencing, Phone System, Advanced Compliance, and Sentinel benefits — for tenants using all of those it's the better bundle.

The AU mid-market default

For an AU mid-market organisation in 2026 standardising on Microsoft 365 security, the typical position is: Microsoft 365 E3 + E5 Security add-on (gives you all four user-level Defenders) + Defender for Cloud per-resource pricing on Azure workloads + Defender Vulnerability Management add-on for the security baselines feature. This typically lands cheaper than full E5 unless you need the Phone System and Audio Conferencing.