PRICING
Microsoft Defender pricing
Learn about the plans and standalone options for purchasing Microsoft Defender products.
HOW TO PURCHASE
Explore purchase options
Purchase Defender products through different licenses or on a pay-as-you-go basis.
Microsoft 365 E5
Get the most value with Defender products in Microsoft 365 E5, which includes Security Copilot at no additional cost.
Microsoft Defender Suite
Add on to Microsoft 365 E3 with Defender products that provide unified protection, detection, and response across identities, endpoints, email, and SaaS apps.
Additional products
Get additional products to add on to a Microsoft Defender license or purchase as standalones with flexible pay-as-you-go pricing.
Pricing
See pricing details
Find the plan that best meets your needs.
Get the Microsoft Defender Suite as part of Microsoft 365 E5. Microsoft 365 E5 provides unified protection, detection, and response across identities, endpoints, email, and SaaS apps; plus comprehensive compliance and data governance solutions, best-in-class productivity apps, and Windows for Enterprise.
Extend Microsoft 365 E3 with advanced threat protection delivered through the Microsoft Defender Suite. Elevate your security with unified visibility, investigation, and response across the cyberattack chain with an industry-leading XDR solution.
Microsoft Defender Suite
$12.00
user/month, paid yearly
(Annual subscription—auto renews)
Requires: Microsoft 365 E3; or Office 365 E3 and Enterprise Mobility + Security E3.
Requires: Microsoft 365 E3; or Office 365 E3 and Enterprise Mobility + Security E3.
(Annual subscription—auto renews)
Requires: Microsoft 365 E3; or Office 365 E3 and Enterprise Mobility + Security E3.
Requires: Microsoft 365 E3; or Office 365 E3 and Enterprise Mobility + Security E3.
This product is not available in your market.
A comprehensive XDR solution that delivers layered threat protection, data security, compliance, and identity management and governance.
Features:
Features:
- Email and collaboration security
- Endpoint security
- Identity security
- SaaS security
- Extended detection and response (XDR)
Looking for small business? Explore the Defender Suite for small or mid-sized businesses.
Get the security features you need with Defender products that can be purchased on their own or added to your existing Microsoft plan through pay-as-you-go or pre-purchase plans.
Microsoft Defender for Cloud
Help protect multicloud and hybrid environments with comprehensive security across the full app lifecycle, from development to runtime.
Pay-as-you-go
See terms1
Help protect multicloud and hybrid environments with comprehensive security across the full app lifecycle, from development to runtime.
See terms1
This product is not available in your market.
Add-on
Microsoft Defender Vulnerability Management Add-on
Reduce risk with continuous vulnerability assessment, risk-based prioritization, and remediation.
$2.00
user/month
See terms2
Reduce risk with continuous vulnerability assessment, risk-based prioritization, and remediation.
See terms2
This product is not available in your market.
Standalone
Microsoft Defender Experts Suite
Get comprehensive, expert-led services to help defend against threats, build cyber resilience, and modernize security operations.
Pre-purchase plan
Per user per month pricing. Pricing varies by plan.
See terms3
Get comprehensive, expert-led services to help defend against threats, build cyber resilience, and modernize security operations.
Per user per month pricing. Pricing varies by plan.
See terms3
This product is not available in your market.
Add-on
Microsoft Sentinel
Available in the Microsoft Defender portal, Sentinel is an industry-leading SIEM and AI‑ready platform that unifies data and helps power agentic defense.
Pay-as-you-go
See terms1
Available in the Microsoft Defender portal, Sentinel is an industry-leading SIEM and AI‑ready platform that unifies data and helps power agentic defense.
See terms1
This product is not available in your market.
Add-on
RELATED PRODUCTS
Get more protection with related security products and services
RESOURCES
Explore additional resources
TEI Study
Reduced incident response effort by 80%
Learn more in the Forrester Total Economic Impact™ Of Microsoft Defender4 study.
Resource library
Cybersecurity and AI news
Discover the latest trends and best practices in cyberthreat protection and AI for cybersecurity.
Frequently asked questions
- Microsoft Defender for Endpoint licenses include protection for up to 5 devices per user license. This does not include servers, which must be licensed separately.
- Microsoft Defender for Office 365 provides comprehensive protection against email-based threats, Teams-based threats, as well as security for your collaboration tools including SharePoint, and OneDrive.
- Microsoft 365 E5 is a comprehensive enterprise subscription that combines productivity, identity, device, and security capabilities in one license. In addition to Microsoft Security, it includes Microsoft 365 Apps, Exchange, SharePoint, Teams, advanced compliance, and identity protection.
Microsoft Defender Suite is a security focused on threat protection and detection and response across endpoints, identities, email, and SaaS apps. It delivers Microsoft Defender capabilities without the productivity or compliance services included in Microsoft 365 E5. - Microsoft Defender XDR is not a standalone offering. XDR capabilities are included with eligible Microsoft plans and supported Defender products; for standalone offerings, Defender for Endpoint Plan 2 and Defender for Office 365 Plan 2 are required, and XDR capabilities are automatically enabled when multiple Defender workloads are in use.
- Microsoft 365 E5, Microsoft 365 A5, and the Microsoft Defender Suite provide comprehensive identity security. These bundled offerings provide an integrated approach to identity threat detection, investigation, and response across on-premises and cloud environments, without the complexity of managing multiple standalone licenses.
- Automatic attack disruption autonomously contains sophisticated attacks while they’re still in progress. It is a core capability built into the individual Defender solutions. The more solutions an organization has deployed, the more disruption scenarios are unlocked. Autonomic attack disruption is included with Defender for Endpoint Plan 2, Defender for Cloud Apps, Defender for Identity, Defender for Office 365 Plan 2 and suites that include these products. Microsoft 365 E5/A5, Microsoft Defender Suite, EMS E5/A5.
- [1]Microsoft Azure subscription required
- [2]Annual commitment.
After your one-month free trial ends, your subscription will automatically convert into a 12-month paid subscription and you will be charged the applicable subscription fee. Cancel any time during your free trial to stop future charges. A credit card is required to sign up. Learn more.
Requires Microsoft Defender for Endpoint P2 or any suite or plan that includes Microsoft Defender for Endpoint P2 (including Microsoft 365 E5, Microsoft 365 E5 Security, Windows 10/11 Enterprise E5). Get more information about terms and conditions at Product terms.
Defender for Endpoint Plan 2 and Microsoft 365 E5 customers can add on premium vulnerability management capabilities for comprehensive endpoint protection, including versions of E5 that do not include Microsoft Teams. - [3]Microsoft Defender Experts Suite Plan 1 and 2 include Microsoft Defender Experts for XDR, Microsoft Incident Response, and Microsoft Designated Engineering. Defender Experts Suite Plan 2 additionally includes Microsoft Unified Enterprise for Defenders Experts Suite.
- [4]The Total Economic Impact™ Of Microsoft Defender, Cost Savings And Business Benefits Of Microsoft Defender, Including Microsoft Sentinel SIEM Capabilities, A Forrester Total Economic Impact Study commissioned by Microsoft, June 2025.
To better understand the benefits, costs, and risks associated with this investment, Forrester interviewed four decision-makers with experience using Microsoft Defender. For the purposes of this study, Forrester aggregated the experiences of the interviewees and combined the results into a single composite organization.
Follow Microsoft Security