What Defender for Business is
Defender for Business is Microsoft's endpoint security product for small and medium businesses, built on the same engine as Defender for Endpoint and capped at 300 users with up to five devices each. Standalone it lists at AU$4.50 per user per month ex GST on an annual subscription (checked September 2026 on microsoft.com/en-au); it is also included in Microsoft 365 Business Premium at AU$32.90. Microsoft Learn describes it as containing the features of Defender for Endpoint Plan 1, some features from Plan 2, and SMB-specific extras: next-generation antivirus, attack surface reduction, endpoint detection and response, automated investigation and remediation, automatic attack disruption, core vulnerability management, threat analytics, monthly security summary reports and wizard-driven setup with default policies. Standalone eligibility covers Business Basic, Business Standard and Office 365 E1 tenants, and non-Microsoft shops.
How it differs from Defender for Endpoint P1 and P2
The comparison table on Microsoft Learn (checked September 2026) is the clearest guide. Defender for Endpoint Plan 1 is prevention only: next-generation protection, attack surface reduction, centralised management and cross-platform support, but no EDR, no automated investigation, no attack disruption, no vulnerability management and no threat analytics. Defender for Business has all of those — its EDR and threat analytics are labelled 'optimised' for SMB, meaning a simplified experience rather than a lesser engine. What Plan 2 adds over Defender for Business is the analyst-grade layer: six months of data retention with 30 days of advanced hunting, and Microsoft Threat Experts. Defender for Endpoint proper has no 300-user cap, which is why Microsoft points organisations above that size to it. For a 60-person Australian firm, Defender for Business is a better product than Plan 1 at a lower price.
The servers add-on
Defender for Business protects client devices; servers need the separate Microsoft Defender for Business servers add-on, which Microsoft Learn describes as extending the same protection to Windows Server and Linux. Three rules apply (checked September 2026): you need at least one paid Defender for Business or Business Premium licence before you can buy it, one add-on licence is required per server instance and is not assigned to a user or device, and a subscription can hold a maximum of 60 server licences. Microsoft's Australian product page does not publish the add-on's price, so confirm it with your CSP. Larger server estates, or anything already in Azure, can use Defender for Servers Plan 1 or Plan 2 instead — Microsoft lists that as the alternative for the same job.
Why it matters for Essential Eight
Essential Eight is a set of controls, not a product, and Defender for Business does not tick a strategy by itself. Its value is that it carries the machinery several strategies depend on. Attack surface reduction rules are how Microsoft implements the Office macro and user application hardening strategies on Windows endpoints; core vulnerability management is the evidence base for patching applications and operating systems; and endpoint detection and response is what an assessor expects to see behind any claim that malicious activity would be noticed. Combined with Intune for configuration and Entra ID P1 for MFA policy, it is the reason Frontrow treats Business Premium as the cheapest credible Essential Eight foundation for an SMB. Buying it standalone on Business Basic gets the detection without the device management — half the story.