Microsoft is taking steps to bring the best cybersecurity features to more businesses. One of their flagship products for enterprise cybersecurity, Defender for Endpoint, is being split into two separate options. This will allow the software to have a broader appeal, and further its reach. In order to decide which is best for your business, you’ll need to understand the reason for the split and how the two options compare.
Why Are They Splitting?
In its original form, Defender for Endpoint was a complete solution for the most demanding cybersecurity needs at large enterprises. This made the project a less attractive option for smaller companies who didn’t need all the features and couldn’t justify the price. Indeed, by splitting the product into a smaller subset of features, now known as Plan 1, Microsoft brings it to more organizations. Going forward, the full-featured version of Defender for Endpoint will be referred to as Plan 2.
Defender for Endpoint Plan 1 and Plan 2 Pricing Comparison
Both plans of Defender for Endpoint are available as either a standalone offering or as a built-in feature of Microsoft 365. Before the split, businesses needed to purchase the more expensive E5 plan of Microsoft 365 to receive Defender for Endpoint as a built-in feature. Plan 2 of the product will remain a free offering for those who have purchased E5. However, the reduced cost of Plan 1 allows that option to be included as part of EC3.
Companies who don’t want or need all that Microsoft 365 has to offer can opt to purchase Defender for Endpoint as a standalone product. Purchased that way, the product costs $3 per user for Plan 1 and $5.20 per user for Plan 2.
Defender for Endpoint Plan 1 and Plan 2 Feature Comparison
The lower price afforded by the reduced feature set of Plan 1 means that Defender for Endpoint will now be an option for more businesses. But what exactly has been removed, and what remains? Let’s take a look at the features that remain in Plan 1 and those that remain unique to Plan 2.
Included in Plan 1
Defender for Endpoint plan 1 contains the following subset of Defender for Endpoint’s full feature set:
Attack Surface Reduction Rules
Certain software behaviors are used most often in risky code. While there are usually legitimate uses as well, these behaviors show up most commonly in malware. By preventing these behaviors from running, Defender for Endpoint reduces the number of surfaces your systems can be attacked by.
Ransomware Mitigation
Malicious code often takes over important files and refuses to grant you access to them unless you pay a ransom. Defender for Endpoint can control which processes can access important folders, so ransomware never gets the access needed to hold your data hostage.
Device Control
If you’ve watched any spy movies, you’ve likely seen a character insert a USB drive into a computer to insert malicious code. This is a real threat. Indeed, Defender for Endpoint helps you prevent it by limiting the access that unauthorized peripherals have.
Web Protection
There are two threats that unlimited access to the internet allows for. First, and most importantly, there are a number of phishing sites, exploit sites, and other malicious websites in the wild. Defender for Endpoint automatically blocks access to known security threats. Secondly, you can block access to other risky sites by category, such as adult content, sites that may open your organization to legal liability, or leisure sites that may reduce workforce productivity.
Network Protection
Web protection provides extensive support to protect your organization’s internet-enabled applications from accessing malicious web content. However, it only works on certain web-enabled applications, such as Microsoft Edge. Network protection extends the capability of web protection to the operating system level, preventing applications that secretly access the internet from harming your machine.
Network Firewall
The network firewall allows you to take more custom control over what traffic is allowed to and from your network. With a set of rules that you create, you can, then, reduce the risk of network security threats and safeguard sensitive data.
Application Control
Malicious applications are a major threat vector for cyberattacks. With application control, Defender for Endpoint can limit the applications that are allowed to run on your system. It can also work on a variety of rules, including the presence of codesigning certificates, application reputation, launching process, and more.
Included in Plan 2
Defender for Endpoint Plan 2 includes everything in Plan 1, as well as the following features:
Endpoint Detection and Response
Defender for Endpoint brings in advanced threat protection by detecting, investigating, and responding to endpoint threats that have made it past the first level of security checks. With a query-based tool, you can, indeed, proactively find breaches and create custom automatic detections.
Automated Investigation and Remediation
Alerting a human to potential threats so they can respond is a good first step, but still allows threats to persist until manual intervention can occur. Defender for Endpoint’s automated investigation and remediation shut down threats within minutes.
Threat and Vulnerability Management
In a large organization, the responsibilities of threat detection and remediation can be spread across several teams. With threat and vulnerability management, coordination between the various teams enhances in much the same way that project management tools enhance productivity in other areas. This then reduces the time needed to respond to threats.
Threat Analytics
Big data has enabled advanced algorithms to make our lives easier in many ways, but detecting patterns that humans can’t and automatically responding to them. The advanced threat analytics Defender for Endpoint captures provides the data Defender needs to identify threats and generate alerts faster.
Microsoft Threat Experts
Microsoft’s team of threat experts is at your disposal with Defender for Endpoint Plan 2. You can engage with a security expert from within the Defender Security Center to get timely and accurate answers. In addition, you receive managed threat monitoring and analysis for quicker alerts to security threats that make it past the other defenses.
Integrations
Defender for Endpoint Plan 2 integrates with the applications your organization uses on a daily basis, including:
- Azure Defender
- Azure Sentinel
- Microsoft Cloud App Security
- Intune
- Microsoft Defender for Identity
- Microsoft Defender for Office
- Lastly, Skype for Business
Learn More About Defender for Endpoint
Agile IT is a Microsoft Gold Partner with 16 Gold competencies including Security and Windows management, and seventeen years of experience in licensing, migrating, and managing Microsoft Cloud Environments. Thus, to find out more about how you can reduce license costs while expanding and simplifying security, schedule a consultation with a cloud advisor today to schedule a consultation with a cloud advisor today.
Published on: .
