Glossary
Microsoft Defender for Business
Also called: Defender for Business, MDB
In one sentence
Microsoft Defender for Business is Microsoft's endpoint security product for organizations of up to 300 users, combining next-generation antivirus with EDR and automated investigation.
Defender for Business brings the core of Microsoft's enterprise product, Defender for Endpoint, to small and mid-sized organizations at a simpler, lower-cost tier. It includes next-generation antivirus, attack surface reduction rules (which block risky behaviors such as Office macros launching programs), EDR with device isolation, and automated investigation and remediation that can clean up many threats on its own.
It's available standalone or included in Microsoft 365 Business Premium, for organizations of up to 300 users, and each user license covers up to five devices — Windows, Mac, iPhone/iPad and Android. Servers need a separate add-on. It's managed in the Microsoft Defender portal and works with Intune for policy deployment.
Why it matters: it gives a small practice or business enterprise-grade protection that many cyber insurers expect (EDR on every endpoint), tied into the same Microsoft account and device management you already use. Because it's part of the same ecosystem, a compromised device can automatically lose access to email and files through Conditional Access.
Defender for Business is a tool, not a person. It still needs someone to review alerts, tune policies and respond to incidents — which is part of a managed security service or MDR.
Example: a staff member at a small accounting firm downloads a “PDF converter” that's actually malware. Defender for Business blocks the malicious behavior, isolates the laptop and opens an incident. The IT team reviews it, confirms nothing spread and restores the laptop to service the same day.
We deploy and manage Defender as part of our security service.
Related terms
- EDR (endpoint detection and response)EDR is security software on each computer that watches for suspicious behavior, records what happens, and lets defenders stop and isolate an attack in progress.
- XDR (extended detection and response)XDR connects security signals from computers, email, sign-ins and cloud apps so an attack can be seen and stopped as one connected incident instead of scattered alerts.
- Microsoft 365 Business PremiumMicrosoft 365 Business Premium is Microsoft's top small-business plan (up to 300 users), combining Office apps, email and Teams with device management and advanced security.
- Microsoft IntuneMicrosoft Intune is Microsoft's cloud service for managing and securing company computers, phones and tablets — settings, apps, updates and encryption — from one place.
- EndpointAny device that connects to your network or data — laptops, desktops, phones, tablets and servers — and is used by a person or runs business software.
- RansomwareRansomware is malicious software that locks or encrypts your files and systems, and often steals copies of your data, so criminals can demand payment to restore access or keep quiet.