Microsoft Defender for Business: what the SMB tier actually covers

A 15-person office pays for Microsoft 365 Business Premium, gets a cyber insurance renewal questionnaire asking “do you have EDR deployed?” and prepares to go shopping for a security product. Then someone checks the license details and finds the surprise: the company has been paying for a real EDR platform all along. It was never onboarded, never configured and its dashboards have never been opened.

That surprise is Microsoft Defender for Business, and it is one of the most commonly owned, least commonly deployed security products in the small business market.

What Defender for Business is, precisely

Naming first, because Microsoft made this genuinely confusing. “Defender” appears on at least half a dozen products. The free antivirus built into every Windows machine is Microsoft Defender Antivirus. That is not what this post is about.

Microsoft Defender for Business is the endpoint detection and response platform Microsoft built for organizations up to 300 users. It is included in Microsoft 365 Business Premium or available standalone for roughly $3 per user per month. It is a scoped-down sibling of Defender for Endpoint Plan 2, the enterprise product, running on the same detection engine.

The distinction between antivirus and EDR matters enough that we wrote a full comparison, but the short version: antivirus tries to block known-bad files at the door. EDR continuously records what happens on the machine (processes, network connections, credential access) and detects attack behavior, so you can see an intrusion in progress and respond, rather than learning about it from the ransom note.

What you actually get

Onboarded and configured, Defender for Business provides:

• EDR with behavioral detection. The recording-and-detection capability above, including automated investigation that can resolve routine alerts without a human.
• Attack surface reduction rules. Policies that block the standard ransomware entry techniques: Office macros spawning processes, scripts pulling payloads, credential theft from memory. A meaningful share of real-world intrusions die against these rules alone when they are enabled.
• Vulnerability management. A continuously updated view of which machines are missing patches or running exploitable software versions, ranked by actual exposure.
• Automated response actions. The one that matters most for a small business: isolate a machine from the network with 1 click while keeping it reachable for investigation. At 2 am, that is the difference between 1 encrypted laptop and an encrypted company.
• Cross-platform coverage. Windows, macOS and mobile, managed from one console.

For a 10 to 30 user company, this feature set answers the insurance questionnaire’s EDR question honestly and covers the technical detection layer that plain antivirus cannot. If you already pay for Business Premium, the marginal license cost of all this is zero. We ran through the rest of what that license includes in our Business Premium breakdown.

What the enterprise tier adds, and why you probably do not need it

Defender for Endpoint Plan 2, the enterprise product, adds capabilities aimed at security teams:

• Advanced hunting with a full query language over raw telemetry
• Longer data retention for investigations
• More granular role-based access for security operations staff
• No 300-user ceiling

Notice what those have in common: they assume dedicated security analysts who write queries and run investigations as their job. A 20-person company does not have that team, and buying the enterprise tier does not conjure one. The SMB tier’s detections, automated investigation and 1-click isolation are the parts that map to how a small business actually operates. Save the difference.

The catch: EDR is a smoke detector, not a fire department

Here is the part the license sheet does not say. Deploying Defender for Business gets you alerts. It does not get you anyone watching them.

EDR alerts arrive at inconvenient hours, in security vocabulary, with severity ratings that need interpretation. A “multi-stage incident involving credential access” notification at 11 pm on a Friday is only useful if someone competent reads it that night and acts. In most small businesses, the honest answer to “who reads these?” is nobody, which converts your EDR investment into a very detailed forensic record of the breach nobody stopped.

The realistic options at this size:

• Your managed IT provider watches it. Fine for business-hours triage if that is genuinely in your agreement. Ask specifically who sees alerts at night and on weekends.
• A managed detection and response service watches it. MDR puts 24/7 human analysts behind the tooling, with authority to isolate machines when minutes matter. Attackers demonstrably favor nights, weekends and holidays for exactly the reason you would expect. We compared the service models in MDR vs SOC-as-a-service.
• Nobody watches it. The default outcome, and the one to refuse.

Our position: for most small businesses, Defender for Business plus an MDR layer is the right-sized stack. You use the EDR you already own instead of buying a parallel agent, and you rent the 24/7 eyes you cannot staff.

Deployment is real work, but bounded

Onboarding is not a checkbox. A competent rollout for a 10 to 30 user company looks like:

• Enroll devices through Intune or the provided onboarding packages, typically over 1 to 2 weeks in waves
• Enable attack surface reduction rules in audit mode first, review what would have been blocked, then enforce, so you do not break a line-of-business app on day 1
• Tune policies for your actual environment (exclusions for legitimate tools, alert notification routing)
• Verify every device reports healthy, because the machine that never onboarded is always the one that gets hit

Plan for a few weeks of calendar time and modest disruption, mostly none. The work is front-loaded. After tuning, the platform runs quietly until it matters.

The bottom line

If you have Business Premium, you likely already own EDR that satisfies underwriters and stops real attacks. The gaps to close are deployment, configuration and 24/7 response, in that order. That is a project measured in weeks and a monthly service cost, not a new 5-figure security purchase.

Atticus Rowan deploys and manages Defender for Business as part of our security stack for small businesses, including the attack surface reduction tuning most rollouts skip and MDR coverage for the hours your office is dark. If your Business Premium licenses are quietly holding an EDR platform nobody ever turned on, contact us and we will put it to work.