Defender for Endpoint P1 vs P2 comes down to one question: do you need endpoint detection and response, with the investigation tooling around it, or is prevention plus a few manual response actions enough? Most comparison pages answer with a feature grid copied from a launch blog, and several get basics wrong, such as claiming Plan 1 cannot isolate a device. This post sets out what each plan includes according to Microsoft Learn today, which licences already carry each plan, how mixed mode works when you own both, and where the gap between them costs money.
The choice is one branch of the wider Microsoft 365 licensing decisions that sit above it, and it moves in step with the Microsoft 365 E3 vs E5 question, because E3 carries Plan 1 and E5 carries Plan 2. I have not run Defender for Endpoint Plan 2 in production; my tenant is a lab with no enrolled devices, so what follows is Microsoft’s own documentation, checked on 31 October 2026, plus where I would expect it to bite.
Defender for Endpoint P1 vs P2 at a glance
Plan 2 is a superset of Plan 1. The Microsoft Defender service description on Microsoft Learn states that Plan 2 includes all the capabilities of Plan 1 and adds endpoint detection and response, automated investigation and remediation, threat and vulnerability management, threat analytics, sandbox deep analysis and Microsoft Threat Experts.
Defender for Business is in the table as well, because it is the plan most small tenants already own without realising it sits between the two. The rows below come from the comparison table in Microsoft Learn’s Defender for Business overview, checked on 31 October 2026.
| Capability | Plan 1 | Plan 2 | Defender for Business |
|---|---|---|---|
| Next-generation protection | Yes | Yes | Yes |
| Attack surface reduction | Yes | Yes | Yes |
| Centralised management and APIs | Yes | Yes | Yes |
| Cross-platform support (Mac, iOS and iPadOS, Android) | Yes | Yes | Yes |
| Endpoint detection and response | No | Yes | Yes (optimised) |
| Automated investigation and remediation | No | Yes | Yes |
| Automatic attack disruption | No | Yes | Yes |
| Threat analytics | No | Yes | Yes (optimised) |
| Vulnerability management, core capabilities | No | Yes | Yes |
| Advanced hunting (30 days) and six months of data retention | No | Yes | No |
| Microsoft Threat Experts | No | Yes | No |
| Monthly security summary reporting | No | Yes | Yes |
| Servers | Extra licence | Extra licence | Extra licence |
Read the table for what it does not say. There is no row where Plan 1 has a tick and Defender for Business does not. The only rows where Plan 2 beats Defender for Business are advanced hunting with longer retention, and Microsoft Threat Experts.
What Plan 1 already gives you
Plan 1 is a prevention product with a portal. The Plan 1 overview on Microsoft Learn lists four capability groups: next-generation protection, manual response actions, attack surface reduction, and centralised configuration through the Microsoft Defender portal with Intune integration. Role-based access control, reporting and the Defender for Endpoint APIs come with it.
The manual response actions are where most comparisons go wrong. Learn lists three for Plan 1:
- Run an antivirus scan on a device.
- Isolate a device, which disconnects it from the network while keeping its connection to Defender for Endpoint.
- Add an indicator to block or allow a file.
Device isolation is in Plan 1. If a reseller is selling Plan 2 on the strength of isolation alone, the argument does not stand up.
The attack surface reduction set is also complete in Plan 1: attack surface reduction rules, controlled folder access for ransomware mitigation, device control for removable media, web protection, network protection, the network firewall and application control. If those rules are the reason for the purchase, the usual reason ASR rules fail to apply is a policy conflict, not the licence.
What Plan 1 does not give you is the detection and investigation layer. It tells you something was blocked. It does not give you the endpoint detection and response data to reconstruct what ran before the block, and it does not investigate or remediate on its own.
What Plan 2 adds, and which parts matter
The Plan 2 additions fall into three groups, and they are worth very different amounts depending on who is reading the alerts.
- Detection and response. Endpoint detection and response, automated investigation and remediation, and automatic attack disruption. Automated investigation is the part that does work without an analyst, which is why it matters most to small teams.
- Hunting and retention. Advanced hunting over 30 days of data and six months of data retention. This only pays if someone writes queries.
- Context. Threat analytics and core vulnerability management. The service description adds that Defender Vulnerability Management premium capabilities are an add-on available only on top of Plan 2 or a suite that contains it, and the per-device Defender for IoT enterprise add-on has Plan 2 as its prerequisite.
One naming wrinkle. The service description still lists Microsoft Threat Experts as a Plan 2 capability, while the current Defender for Endpoint overview on Learn describes Endpoint Attack Notifications. Treat that line on a quote as something to confirm with Microsoft or the reseller, not as a managed service you can rely on.
Which licences already include each plan
Check what is already owned before buying anything. Most tenants already hold one of the three plans through a bundle.
| Licence | Defender endpoint plan |
|---|---|
| Microsoft 365 E3, A3 or G3 | Plan 1 |
| Microsoft 365 E5, A5 or G5 | Plan 2 |
| Windows 10 or Windows 11 Enterprise E5 or A5 | Plan 2 |
| Microsoft Defender Suite (formerly Microsoft 365 E5 Security) | Plan 2 |
| Microsoft 365 Business Premium | Defender for Business |
| Standalone | Plan 1, Plan 2 or Defender for Business |
Business Premium includes Defender for Business, not either Defender for Endpoint plan. Defender for Business is sold for organisations of up to 300 users, which is the same ceiling covered in what the Business Premium 300 user limit actually covers.
Servers are separate. The Plan 1 and Plan 2 user licences cover client devices. The service description says Defender for Endpoint for Servers needs a separate licence for each operating system environment, and Defender for Servers in Defender for Cloud is the other route.
I am not quoting prices. Microsoft publishes them on its Defender pricing page, and what a tenant pays depends on the agreement, the currency and whether the plan arrives inside a bundle.
The newsletter
Get the next licensing fix like this one by email
Subscribe and get the free 8-page Intune troubleshooting field guide (PDF), then new fixes about twice a month. From a Microsoft MVP.
Mixed mode: running both plans in one tenant
A tenant can own both plans and give each to different devices. Microsoft calls this mixed licensing, and Microsoft Learn’s page on Defender for Endpoint subscription settings describes three cases: a mixed tenant, a mixed trial where Plan 2 is on trial for some users, and a phased upgrade from Plan 1 to Plan 2 or from E3 to E5.
The documented process, in order:
- Hold active trial or paid licences for both Plan 1 and Plan 2.
- In the Microsoft Defender portal, open the subscription settings and choose the option to use Plan 1 and Plan 2.
- Tag the devices that should get Plan 1 capabilities with the tag
License MDE P1, either manually or with a dynamic rule. - Track the result in the license usage report.
Learn says nothing changes until devices are tagged. It also says that assigning user licences in the Microsoft 365 admin center does not set the tenant to mixed mode, and that mixed-mode settings apply to client endpoints only.
The failure modes
- Isolation bought twice. Plan 2 justified by device isolation, which Plan 1 already has.
- Licences assigned, mixed mode assumed. User licence assignment in the admin center does not switch the tenant to mixed mode. Until the subscription setting is changed and devices are tagged, nothing is split.
- Registry tags on Plan 1 devices. Learn states that devices tagged
License MDE P1through the registry key method do not receive downgraded functionality. The tag is there and the device still behaves as Plan 2. Use a dynamic rule instead. - Servers counted as users. Plan 1 and Plan 2 user licences do not cover Windows Server or Linux servers, and tagging a server does not change its subscription state.
- Plan 1 added to Business Premium. On the Learn comparison table, Defender for Business already matches or beats Plan 1 on every row. Buying Plan 1 seats for a Business Premium tenant adds nothing the table shows.
- Advanced hunting expected in Defender for Business. The table gives advanced hunting and six months of retention to Plan 2 only.
- Old SKU names on new quotes. Microsoft 365 E5 Security is now Microsoft Defender Suite. Same product family, different line item. Do not buy both.
What I would do differently
I would decide Defender for Endpoint P1 vs P2 by asking who reads the incidents, not by comparing feature lists. If nobody triages alerts, endpoint detection and response produces data that nobody uses, and automated investigation and remediation is the only Plan 2 feature doing work. That is still worth something, but it is a smaller case than the grid suggests.
For an E3 tenant, I would not move everyone at once. I would set mixed mode, put Plan 2 on the devices where a compromise costs most, such as privileged admin workstations and finance devices, tag the rest with a dynamic rule, and see whether the extra alerts lead to action. The phased upgrade is a documented scenario, not a workaround.
If Defender for Office 365, Defender for Identity or Defender for Cloud Apps are also on the list, I would price Microsoft Defender Suite against Plan 2 standalone before buying either. Once more than one of those is wanted, the single-product route usually stops being the cheap route.
For a Business Premium tenant under 300 users, I would use Defender for Business properly before buying anything else. It already carries the automated investigation and endpoint detection that make Plan 2 attractive.
And I would re-read the service description at every renewal. The suite names have changed, and a quote built from last year’s chart is the most common way to pay twice.
Last verified: 31 October 2026.
