In brief: Defenders can now easily identify logons involving high-privilege identities or special logon flags to better hunt threats and fine-tune detections. When a user logs on, Windows’ Local Security Authority (LSA) constructs an access token that represents the user’s securi…
M
Microsoft Defender for Endpoint
Microsoft · Endpoint Security
Enterprise endpoint security included with Microsoft 365
Overview
Microsoft Defender for Endpoint is an enterprise EDR solution built into Windows and available for macOS, Linux, iOS, and Android. For organisations on M365 Business Premium or above, it's included at no extra cost, making it the default security baseline for UK SMBs.
UK Pricing
Included in M365 Business Premium (~£18.60/user/mo). Standalone Plan 1 from ~£2.30/user/mo, Plan 2 from ~£4.60/user/mo.
Target Size
Any size
Why Use It
For the majority of UK SMBs already on M365, Defender for Endpoint is the right starting point. It provides solid baseline protection, integrates natively with your existing stack, and adds no incremental cost if you're on Business Premium.
Why Not
If you operate in a high-risk sector or face sophisticated adversaries, Defender alone may not be sufficient. Many security teams layer CrowdStrike or SentinelOne on top of Defender for enhanced detection.
Pros & Cons
Pros
- Included in M365 Business Premium — excellent value
- Tight integration with Intune, Entra ID, and Sentinel
- Automatic attack disruption (ransomware containment)
- No additional agent required on Windows devices
- Microsoft Secure Score gives actionable security posture metrics
Cons
- Detection capabilities trail CrowdStrike and SentinelOne for sophisticated threats
- Alert noise can be high without tuning
- Portal (Defender XDR) has a steep learning curve
- macOS/Linux coverage is less mature than Windows
- Requires Plan 2 for full EDR features (often needs E5 licensing)
How to Get the Most Out of It
- Enable Attack Surface Reduction (ASR) rules progressively — start in audit mode to avoid breaking workflows
- Use Threat and Vulnerability Management (TVM) to prioritise patching by actual exploitability
- Configure automated investigation and remediation to reduce analyst workload on routine alerts
- Integrate with Microsoft Sentinel for SIEM correlation across your entire M365 estate
- Use Defender for Business (SMB-optimised) if you're under 300 seats for a simpler management experience
AI: What's New
Claude AI# What's New in Microsoft Defender for Endpoint
• **Enhanced detection and hunting capabilities** – You now have privileged token context telemetry and RPC activity monitoring available in Advanced Hunting, plus custom data collection options. This means better visibility into lateral movement and token theft tactics without requiring manual log parsing.
• **Operational flexibility improvements** – Linux environments can now run scheduled antivirus scans (matching Windows functionality), and selective response actions let you apply stricter containment policies to high-value assets while avoiding overkill on less critical endpoints.
• **Proactive threat prevention** – Predictive shielding is actively stopping ransomware before execution, and new Secure Boot status assessments give you better firmware security visibility—reducing your reactive incident response workload.
Latest News
All →Security teams rely on scheduled scans to ensure consistent coverage across devices, detect dormant or missed threats, and meet compliance requirements. However, managing scans on Linux has traditionally required custom scripts and cron-based setups, which can be hard to scale and maintain. That’s w…
In today’s threat landscape, internet exposure, i.e. devices that allow inbound connectivity from the public internet, continues to be a major vector for initial access and compromise. Devices that are exposed to the public internet can significantly increase an organization’s attack surface, making…
Remote procedure call (RPC) is a protocol commonly abused by attackers that allows functions implemented in a separate process, and potentially on a remote machine, to be called as if they were local. Many core Windows and Active Directory capabilities are built on or make use of RPC, which makes it…
At Ignite in November, we announced that Microsoft Defender is now the only endpoint protection solution that allows data-hungry security teams to meet specific telemetry needs by optimizing their data collection right within the Defender portal, without the need to rely on fragmented and siloed sol…
Modern ransomware attacks are increasingly designed to blend in with normal IT operations, using trusted administrative tools to quietly weaken defenses and distribute malicious payloads at scale. In a recent real‑world incident, a human‑operated ransomware actor attempted to do exactly that by abus…
Deploying Microsoft Defender on high-value assets (HVAs) such as domain controllers, ADFS servers, and other Tier-0 systems, requires a thoughtful approach to balance strong protection with operational stability. Given the powerful response capabilities available, organizations often seek greater co…
Understanding the Secure Boot certificate challenge Secure Boot is a foundational security feature that validates the integrity of your device's boot process, ensuring only trusted software can run during system startup. This protection has been quietly defending enterprise devices since 2012, but t…