Free tool · 2 minutes · Defender licensing · Australia
DO YOU ALREADY HAVE
MICROSOFT EDR?
“Microsoft EDR” is not a product. Endpoint detection and response is a capability that appears in some Defender plans and not others, and the plan carrying it is not the one most people expect. Enter what you hold and this checker returns what Microsoft actually names against it, the eligibility ceilings that catch people out, and what closes the gap.
Defender for Business caps at 300.
Windows and Linux OS environments.
What you have today
Defender for Endpoint Plan 1
No. Defender for Endpoint Plan 1 is what these licences deliver, and Microsoft names endpoint detection and response against Plan 2, not Plan 1. This is the trap: an organisation can hold an expensive enterprise suite and still have anti-malware and hardening without detection and response.
- · Microsoft 365 E3 includes Defender for Endpoint Plan 1. Microsoft's plan description for P1 covers next generation anti-malware, attack surface reduction rules, device control, endpoint firewall, network protection and application control — endpoint detection and response is named against Plan 2, not Plan 1.
6 servers carry no endpoint licence. Server operating systems always need their own.
The plan that closes the gap
Defender for Business, either standalone or by moving to Microsoft 365 Business Premium, which includes it. Both are inside the 300-employee ceiling at this size.
Rules that bite
- 6 servers carry no endpoint licenceMicrosoft states plainly that Defender for Endpoint Plan 1 and Plan 2 do not include server licences. Neither does Microsoft 365 E3, E5 or Business Premium. Servers need Defender for Business servers, Defender for Endpoint for Servers, or Defender for Servers Plan 1 or Plan 2 through Defender for Cloud, and the licence is per operating system environment, so a virtual machine counts the same as a physical box.
Requirement by requirement
- Endpoint detection and responseGap
Defender for Endpoint Plan 1 does not carry this. Microsoft names it against Defender for Business and above.
Move to Defender for Business or higher.
Microsoft source - Windows and Linux server coverageGap
Defender for Endpoint Plan 1 and Plan 2 do not include server licences, and neither do the Microsoft 365 suites. Server operating system environments are licensed separately, one per environment.
Defender for Business servers, which needs at least one Defender for Business or Business Premium licence first, or Defender for Servers Plan 1 or Plan 2 through Defender for Cloud.
Microsoft source - Australian data residencyAction
Australia is one of the regions Defender for Endpoint operates in, alongside the European Union, United Kingdom, United States, Switzerland, India and the United Arab Emirates. The catch is timing: the storage location is chosen when the onboarding wizard runs for the first time, and Microsoft states it cannot be changed afterwards.
Decide the data location before anyone onboards the first device, and have whoever runs the wizard confirm the choice in writing. A tenant that has already onboarded should check where its data sits rather than assume.
Microsoft source
What to do, most urgent first
- 1. Close the detection and response gap the Plan 1 entitlement leavesDefender for Business, either standalone or by moving to Microsoft 365 Business Premium, which includes it. Both are inside the 300-employee ceiling at this size.
- 2. License the 6 server operating system environmentsServer licensing is separate and per operating system environment, so each virtual machine counts. Under 60 servers with a Defender for Business or Business Premium licence already in the tenant, the Defender for Business servers add-on is the simplest path. Above that, Defender for Servers Plan 1 or Plan 2 through Defender for Cloud.
- 3. Fix the data location before the first device is onboardedAustralia is available as a Defender for Endpoint storage region, but the choice is made once, during first-time setup, and Microsoft states it cannot be changed afterwards. Get it in the deployment plan rather than the retrospective.
- 4. Turn the licence into postureEndpoint detection and response is not one of the Essential Eight — the words do not appear in ASD's maturity model. What does appear is application control, user application hardening and restricting administrative privileges, and Defender's attack surface reduction rules and application control support those. Score the eight properly rather than treating a Defender licence as a maturity result.
What this tool will not price
- · Defender for Endpoint Plan 1 and Plan 2 standalone licences
- · Defender for Business and the Defender for Business servers add-on
- · Defender for Servers Plan 1 and Plan 2 through Microsoft Defender for Cloud
Why this is hard to answer
The expensive suite can have less than the cheap one.
Microsoft 365 E3 includes Defender for Endpoint Plan 1. Microsoft does not name endpoint detection and response against Plan 1 — it names it against Plan 2, which arrives with E5 or as an add-on. Microsoft 365 Business Premium includes Defender for Business, and Microsoft does name endpoint detection and response against that. So a 400-seat E3 tenant can have no EDR while a 40-seat Business Premium tenant does. Nothing about the product names tells you this, which is why so many Australian businesses believe they are covered when they are not.
Two ceilings decide whether the cheaper path is even open to you. Defender for Business is built for organisations up to 300 employees, and the servers add-on that extends it is only available to Defender for Business and Business Premium customers. Past those limits, the Plan 2 route is the one that scales. Server operating systems always need a licence of their own regardless of path, and that is the gap this checker finds most often.
Every statement in the tool is checked against the Microsoft page it cites, July 2026. Where Microsoft does not name a capability against a plan, the tool says so rather than inferring it — and where the answer depends on how your specific tenant was provisioned, such as data storage location, it asks you to verify rather than guessing on your behalf. It prices nothing, because Australian businesses buy through a CSP partner quoting in Australian dollars against their own agreement.
Frequently asked questions
What Australian businesses ask about Defender licensing.
Does Microsoft 365 E3 include EDR?
Not in the way most people assume, and this is the single most expensive misunderstanding in Microsoft endpoint licensing. Microsoft 365 E3 includes Defender for Endpoint Plan 1. Microsoft's own Defender service description does not name endpoint detection and response against Plan 1 — Plan 1 is the protection tier, covering next-generation antivirus, attack surface reduction, device control and manual response actions. Endpoint detection and response, automated investigation and remediation, threat and vulnerability management, threat analytics and deep analysis are named against Defender for Endpoint Plan 2, which comes with Microsoft 365 E5 or is bought as an add-on. The practical consequence is that a 400-seat E3 tenant paying enterprise money can have no EDR, while a 40-seat Business Premium tenant does, because Business Premium includes Defender for Business and Microsoft does name EDR against that.
Why does Defender for Business rank above Plan 1 here?
Because this tool answers one question — do you have endpoint detection and response — and ranks plans by what Microsoft names against them for that question, not by price or by which suite sounds more enterprise. Defender for Business is the endpoint offering in Microsoft 365 Business Premium and is documented as including endpoint detection and response with behavioural blocking and containment, plus automated investigation and remediation. Plan 1 is not. So for the EDR question specifically, Defender for Business sits higher, even though it is the cheaper, small-business product. That inversion is real and it is the reason this checker exists.
We have 300 users. Does the Defender for Business cap apply to us?
You are exactly on the line, and it is worth confirming before you plan around it. Defender for Business is designed for businesses up to 300 employees, and Microsoft 365 Business Premium carries the same 300-seat ceiling. If your headcount is growing through that number, buying into a Business Premium path is buying a migration in twelve months' time. The checker flags this when the user count you enter is at or near the ceiling, because the cost of discovering it after a rollout is far higher than the cost of knowing now. Above 300, the Defender for Endpoint Plan 2 path is the one that scales.
Do servers need their own licence?
Yes, always, and this is the second most common gap. A user licence covers that user's client devices; it does not extend to server operating systems. Servers need either the Defender for Business servers add-on, which is only available to Defender for Business and Business Premium customers, or Defender for Servers through Microsoft Defender for Cloud, which is licensed per server per hour rather than per user. If you enter servers into this checker and hold no server-capable licence, it will say so plainly rather than assuming the user licence stretches. Australian businesses running a handful of on-premises servers alongside a cloud tenant are the usual case, and it is very often the servers that are unmonitored.
Where does Microsoft store the data, and does that matter for Australian obligations?
It matters, and it is worth checking rather than assuming. Microsoft documents the geographic locations where Defender for Endpoint stores customer data and the retention periods that apply, and the storage location is set when the service is provisioned. If your organisation has data residency commitments — through a government contract, an APRA-regulated arrangement, or a customer contract that specifies where data sits — confirm the tenant's actual storage location in the Microsoft 365 admin centre rather than relying on where you assume it was set up. This checker flags data residency as something to verify rather than telling you the answer, because the answer depends on how your specific tenant was provisioned and no tool can see that from the outside.
Is this a licensing quote?
No, and it deliberately avoids becoming one. This is an indicative entitlement and gap check built from Microsoft's published service descriptions. It does not read your tenant, does not see your actual subscriptions, and does not price anything — Australian businesses buy these licences through a CSP partner who quotes in Australian dollars against your specific agreement, term and volume, and any figure published elsewhere is a list price in US dollars at best. Use this to find out which conversation to have and which plan to ask about. Then confirm against the subscription list in your own Microsoft 365 admin centre, because that is the only source of truth about what you actually own.