Microsoft Defender for Business — what it does and how it compares to Windows Defender

← All articles

Microsoft Defender for Business is an endpoint security platform included in Microsoft 365 Business Premium (and available as a standalone product). It's significantly more capable than the standard Windows Defender antivirus that comes with Windows — but most Business Premium tenants never configure it.

What's the difference between Windows Defender and Defender for Business?

Windows Defender (now Microsoft Defender Antivirus) is the built-in antivirus on every Windows 10/11 device. It provides basic real-time protection, malware scanning, and basic ransomware protection.

Defender for Business adds a full EDR (Endpoint Detection and Response) layer on top:

• Threat and Vulnerability Management — continuously scans devices for software vulnerabilities, misconfigurations, and missing patches
• Attack Surface Reduction — rules that block specific behaviours commonly used in attacks (macro execution, credential dumping, lateral movement)
• Endpoint Detection and Response (EDR) — detects advanced attacks that get past antivirus, with detailed timelines of what happened
• Automated investigation and remediation — automatically investigates alerts and, where confident, takes remediation action
• Centralised management — manage security across all devices from a single dashboard

How to enable Defender for Business

1. Go to security.microsoft.com (Microsoft 365 Defender)
2. Navigate to Settings → Endpoints → Onboarding
3. Download the onboarding package for your deployment method (Group Policy, Intune, local script)
4. Deploy to devices
5. Configure Attack Surface Reduction rules (start with "Audit" mode, then switch to "Block")

If you're already using Intune, you can deploy Defender for Business configuration profiles directly from the Intune admin centre.

What about Macs?

Defender for Business supports macOS as well as Windows. The onboarding process is slightly different — use the Intune MDM profile deployment or manual onboarding via script. Once onboarded, Mac devices appear alongside Windows devices in the Defender portal.

Key settings to configure after onboarding

• Enable tamper protection (prevents malware from disabling Defender)
• Configure Attack Surface Reduction rules
• Set up email notifications for high-severity alerts
• Review Threat and Vulnerability Management findings weekly

How to check if Defender for Business is set up

M365Clarity checks whether Defender for Business is licensed and whether devices have been onboarded, as part of its standard tenant scan. If you're on Business Premium and haven't set it up, it'll flag it as a gap worth addressing.

Related articles