Microsoft Defender
Showing terms for the Select/Select Plus (S/S+) program. Not all terms apply to all products and programs. Get help selecting a program.
Availability
Product Conditions:
Provides additional information related to acquiring the Product, such as prerequisites for purchase, prior versions, and the applicable Product Pool.
| Product Conditions - General | |
|---|---|
| Terms of Service | Universal License Terms for all Online Services |
| Product Pool | Server |
| Promotions | No |
| Frontline Worker License | Microsoft Defender for Cloud Apps F1; Defender for Endpoint F1; Defender for Endpoint F2; Microsoft Defender for Identity F1; Microsoft Defender Vulnerability Management FLW; Microsoft Defender Suite FLW; Microsoft Defender + Purview Suite FLW; Microsoft Defender Vulnerability Management FLW; Microsoft Defender for Office 365 F1; Microsoft Defender for Office 365 F2 |
License Prerequisites
| License | License Prerequisites |
|---|---|
| Microsoft Defender for Business servers | Microsoft 365 Business Premium; Microsoft Defender for Business |
| Microsoft Defender for Endpoint P2 for Student | Microsoft 365 Education A5 |
| Microsoft Defender for Endpoint P2 Add On for Microsoft 365 E3 | Microsoft 365 E3 |
| Microsoft Defender Suite | Microsoft 365 E3/A3/G3; Office 365 E3/A3/G3 and Enterprise Mobility + Security E3/A3/G3; |
| Microsoft Defender Suite Edu/Gov | |
| Microsoft Defender Suite FLW | Microsoft 365 F1/F3; Office 365 F3 and Enterprise Mobility + Security E3 (K) |
| Microsoft Defender + Purview Suite FLW | |
| Microsoft Defender for IoT - EIoT Device License - add-on | Microsoft 365 A5/E5/E7; Microsoft Defender Suite / Edu / FLW; Microsoft Defender Suite + Purview Suite FLW; Microsoft Defender for Endpoint P2; Windows 10/11 Enterprise A5/E5 |
| Microsoft Defender Suite for Business Premium | Microsoft 365 Business Premium |
| Microsoft Defender and Purview Suites for Business Premium | |
| Microsoft Defender Vulnerability Management Add-on | Microsoft 365 A5/E5/E7; Microsoft Defender Suite / Edu / FLW; Microsoft Defender + Purview Suite FLW; Microsoft Defender for Endpoint P2; Windows 10/11 Enterprise A5/E5 |
| Microsoft Defender Vulnerability Management Add-On to Microsoft Defender for Endpoint for servers | Microsoft Defender for Endpoint for servers |
| Microsoft Defender for Office 365 Plan 1/Plan 2 | Any Microsoft 365, Office 365, Exchange Online, SharePoint Online or OneDrive license |
Subscription License Suites
In addition to User SLs, refer to Subscription License Suites for other SLs that fulfill requirements for Microsoft Defender.
Service Specific Terms
Microsoft Defender for Cloud Apps
External User Allowance
In addition to access by its Licensed Users, Customer may permit External Users to access the service in connection with access to Customer’s resources using SharePoint Online, OneDrive, Teams and other Microsoft hosted services.
Microsoft Defender for Endpoint
Data Retention
Microsoft Defender for Endpoint does not contain extractable Customer Data therefore the Customer Data extraction terms in the DPA do not apply.
Device Management
Eligible Licensed Users may use Microsoft Defender for Endpoint on up to five concurrent devices. Customers may not use a Microsoft Defender for Endpoint User SL with server OSEs.
Use on Devices Managed by Third-Parties
Notwithstanding the Outsourcing Software Management clause, Customer may use Defender for Endpoint with user desktops running on Microsoft Azure, its own devices, or devices under the day-to-day management and control of third parties.
Microsoft Defender for Endpoint for servers
Eligibility to acquire Microsoft Defender for Endpoint for servers
A separate license is required for each OSE.
Defender for Endpoint for servers migration to Microsoft Defender for Cloud
Customers who acquire Microsoft Defender for Endpoint for servers Licenses, and later during the term of their coverage choose to cover the same servers with Microsoft Defender for Cloud, will be eligible for a credit toward Microsoft Defender for Cloud.
Microsoft Defender External Attack Surface Management
Use Rights and Conditions for Use
Customer may use Microsoft Defender External Attack Surface Management (EASM) solely for Customer’s internal use of defending its and its affiliates’ assets. The EASM data and reports include material that is confidential and proprietary to Microsoft and Customer must keep that material confidential and may not disclose it to any third party.
Microsoft Defender for Identity
Extended Use Rights for Microsoft Defender for Identity Customers
Customer may also install and use Advanced Threat Analytics locally to manage client OSEs (or Server OSEs used as client OSEs) that are used solely by users to whom licenses are assigned. This right expires when Customer’s subscription expires.
Automatic Updates for Microsoft for Identity
Microsoft Defender for Identity may automatically download and install updates for you. You agree to receive these automatic updates without any additional notice.
Microsoft Defender for IoT – Enterprise IoT (EIoT) capabilities
Microsoft 365 E5/E7 or Microsoft Defender Suite customer is entitled to cover up to five concurrent IoT Devices in the context of business operations (EIoT) for each Microsoft 365 E5/E7 or Microsoft Defender Suite License. For any additional EIoT device coverage, the customer must purchase one Microsoft Defender for IoT – EIoT Device License – add-on license per additional EIoT device.
Microsoft Defender Threat Intelligence
Use Rights and Conditions for Use
Microsoft Defender Threat Intelligence (MDTI) is for Customer’s and its affiliates’ internal use only. For example, Customer may not commercially exploit or make available to any third party MDTI or any of its output or reports based on that output. The MDTI data and reports include material that is confidential and proprietary to Microsoft. The compilation of MDTI data and reports is Microsoft’s valuable trade secret. Customer must keep the MDTI data and reports confidential and may not disclose it to any third party.
Microsoft Defender Vulnerability Management
Eligible Licensed Users may use Microsoft Defender Vulnerability Management or Microsoft Defender Vulnerability Management Add-on on up to five concurrent devices. Customer may not use Microsoft Defender Vulnerability Management or Microsoft Defender Vulnerability Management Add-On User SLs with server OSEs.
Cloud Add-ons to SA
Customer may acquire Cloud Add-on to SA User SLs subject to the following conditions:
- Customer must have active SA for the corresponding Qualifying Licenses
- Customer may acquire one Cloud Add-on to SA User SL for each Qualifying License(s), unless provided otherwise in these terms
- Customer may acquire Cloud Add-on to SA User SLs between true-up dates in advance of the acquisition of the Qualifying Licenses
Cloud Add-on to SA User SLs expire upon the earlier of the expiration of the SA coverage for the Qualifying License or the Cloud Add-on to SA User SL term, unless provided otherwise in these terms. Cloud Add-on to SA User SLs may only be reassigned to users with Qualifying Licenses.
| Qualifying License(s) | Cloud Add-on to SA User SL(s) |
|---|---|
| Advanced Threat Analytics 2016 Client Management License per User | Microsoft Defender for Identity Client Management License Add-on (User SL) |