- Defender for Business adds EDR, which spots suspicious behavior, investigates it, and isolates a machine before something spreads.
- Its EDR can replace a standalone third-party antivirus subscription while raising the security bar.
- Defender for Office 365 uses Safe Links, Safe Attachments, and anti-phishing to catch threats before they reach a user.
- Both tools are licensed but not self-configuring, so they must be turned on, tuned past defaults, and monitored.
Plenty of small businesses pay a separate antivirus vendor and a separate email-security tool while sitting on Microsoft 365 Business Premium, which already includes both, at a higher grade than most of what they're buying. Two tools do that work in the plan: Defender for Business and Defender for Office 365.
Defender for Business: more than antivirus
Defender for Business is the endpoint protection in Business Premium, and it goes well past traditional antivirus. The important capability is EDR, endpoint detection and response: the ability to spot suspicious behavior on a device, investigate what happened, and isolate the machine from the network before something spreads. Traditional antivirus blocks known bad files. EDR catches the attack that gets past the first line and contains it.
For most SMBs, this single feature can replace a standalone third-party antivirus subscription, consolidating a bill and raising the bar at the same time.
Defender for Office 365: stopping the email that starts it
The other half is email, where most attacks begin. Defender for Office 365 scans links and attachments before they reach a user:
- Safe Links checks a URL at the moment someone clicks it, not just when the mail arrived, so a link that turns malicious later is still caught.
- Safe Attachments opens attachments in a sandbox to check them before delivery.
- Anti-phishing protection watches for impersonation of your domain and your people.
Email is where the wire-fraud and ransomware attempts come from, so the filtering in Defender for Office 365 is often the highest-value protection in the whole plan. It's also commonly the thing a company is paying a third party for, without realizing it's already included.
Included, not automatic
As with the rest of Business Premium, these are licensed but not self-configuring. Defender has to be turned on, tuned past its defaults, and monitored, because alerts don't help if nobody's watching them. That ongoing tuning and monitoring is a core part of what a managed or co-managed IT partner provides, and it's the difference between owning the tool and being protected by it.
What to do about it
If you're paying a separate antivirus or email-security vendor, the first question is whether you're paying for something Business Premium already gives you. The second is whether the Defender tools you own are actually configured and watched. Both are worth a look.
If you want to find out what you're double-paying for and what's sitting unconfigured, we're glad to run that review. Let's talk it through.