Microsoft Defender for Business

Microsoft needs no ownership section, but the brief asks the same question of everyone: Redmond, Nasdaq-listed, widely held, with the UK entity Microsoft Limited in Reading since 1982. Microsoft suspended sales in Russia on 4 March 2022 and its Russian office was wound down that year; Microsoft Research Asia in Beijing, founded in 1998, is still open. We record that as an adjacent, historical link: the research lab is not the Defender engineering line and it does not affect the score.

Prices are in pounds excluding VAT, read on 9 September 2026 on microsoft.com/en-gb. Defender for Business standalone is £2.30 a user a month paid yearly, which is £27.60 a user a year for up to five devices per user, and that is the plan we score: it is the cheapest Microsoft product with a console (the Defender portal) covering Windows, macOS, iOS and Android. Windows Server and Linux Server are not included: they need the Defender for Business servers add-on, priced per server instance (Microsoft's US FAQ gives $3 a server a month; we could not confirm a GBP figure), capped at 60 servers a subscription. Microsoft 365 Business Premium at £16.90 a user a month annually (£20.28 month to month) bundles Defender for Business with Defender for Office 365 Plan 1 for the mailbox, Intune Plan 1 for BitLocker and device management, Entra ID P1 and the Office apps, which for most of the readers of this page is the better buy. Both stop at 300 users. A 30-day trial needs a card and converts to paid.

EDR is included, in what Microsoft calls an optimised version of Defender for Endpoint Plan 2's EDR, with automated investigation and attack disruption but without Microsoft Threat Experts or six months of retention. MDR is the gap: Defender Experts requires Defender for Endpoint Plan 2, so a Defender for Business customer cannot buy 24/7 human monitoring from Microsoft without upgrading. Vulnerability management, web and network protection, device control, a simplified firewall configuration and mobile threat defence are all in. Patching is assessment and tracking, not deployment. The console data region is chosen at setup from the European Union, the United Kingdom, the United States or Australia. Deployment is the simplified onboarding wizard, Intune or a local script; ConnectWise publishes an integration and Microsoft 365 Lighthouse gives partners multi-tenant management. The Defender APIs are shared with Defender for Endpoint; the MCP servers on GitHub are community-built, not Microsoft's.

AV-TEST's May to June 2026 business Windows 11 round gave Microsoft Defender Antivirus (Enterprise) 6 for protection, 5 for performance and 6 for usability, 17 of 18 and half a point short of Top Product. AV-Comparatives lists Microsoft with an Approved badge in the H1 2026 Business Security Test, with 99.0 per cent in its real-world round. SE Labs' AAA figures for Q2 2026 came from search results because the lab's site blocked us. Microsoft sat out the 2025 MITRE ATT&CK Enterprise evaluation, citing its Secure Future Initiative, after 100 per cent technique-level detection in 2024. On the record are Storm-0558 (2023, a Chinese actor forging tokens into Exchange Online) and Midnight Blizzard (2024, Russian state actors in Microsoft's own corporate email); neither touched Defender for Business, but both are why the Secure Future Initiative exists. Trustpilot's 1.2 on 4,005 reviews for microsoft.com is Windows, Xbox and account recovery, not this product. Not yet tested by Saaskly: assessed on published pricing, the independent test labs, vendor documentation and third-party reviews.