Is Microsoft Defender for Business enough for Essential Eight Maturity Level 2?

Generally yes at Maturity Level 1, generally no on its own at Maturity Level 2. Defender for Business, included in Microsoft 365 Business Premium, covers the endpoint protection ML1 needs. ML2's event-logging, analysis and evidence requirements usually call for Microsoft Defender for Endpoint Plan 2, added through the Microsoft Defender Suite for Business Premium, because Defender for Business alone does not carry the extended device data retention and hunting capability an ML2 assessment expects.

What Defender for Business covers

Defender for Business, included in Business Premium at no extra cost, delivers next-generation antivirus, endpoint detection and response, attack surface reduction, automated investigation and remediation, and vulnerability management, aimed at small and mid-sized businesses without a dedicated security team. That is a reasonable match for Maturity Level 1's application control, patching and logging expectations. It is not built for the deeper log retention and manual threat-hunting an ML2 assessment tends to expect.

What the Microsoft Defender Suite for Business Premium adds

This add-on to Business Premium upgrades four areas at once: Defender for Endpoint Plan 2 (threat hunting, live response, endpoint security for IoT devices and, materially for ML2, six months of device data retention), Defender for Office 365 Plan 2 (automated investigation and response, attack simulation training, threat trackers and advanced hunting), Defender for Cloud Apps (shadow IT discovery and app governance) and Defender for Identity (identity threat detection and response). The six months of retention is the detail that matters most for ML2's event-logging and incident-analysis controls, which ask for logs to actually be there when an assessor or an incident responder needs them.

The mixed-licensing rule most providers get wrong

Microsoft Defender for Business does not support mixed licensing. If a tenant has some users on Defender for Business (via Business Premium) and others on Defender for Endpoint Plan 2 (via Microsoft 365 E5 Security or a standalone licence), every user in the tenant defaults to the Defender for Business experience, not the Plan 2 experience for the licensed users. Licensing a subset of users for Plan 2 and assuming they get the upgraded features is the single most common mistake we see in ML2 uplift plans. To actually get the Defender for Endpoint Plan 2 experience, every user in the tenant must be licensed for it, and Microsoft Support must be contacted to request the tenant-level switch. Partial licensing silently does nothing.

Servers are a separate decision

Defender for Business supports Windows and Linux servers only through an additional per-server-instance licence, capped at 60 servers per subscription. Businesses running more than 60 server instances, or needing the deeper capability of the full Defender for Endpoint feature set on servers, license Microsoft Defender for Endpoint for Servers instead. Either way, servers are not covered by a workstation-focused Business Premium or Defender for Business licence by default, and an ML2 gap assessment should check this explicitly.

How Blue Arc IT Solutions approaches it

Our default is Defender for Business at Maturity Level 1, and the Microsoft Defender Suite for Business Premium at Maturity Level 2, delivered as part of our ML2 Uplift Programme so the licensing switch, log retention and evidence are handled correctly the first time rather than discovered as a gap during an assessment. See our guides to what Essential Eight Maturity Level 1 involves and what Essential Eight Maturity Level 2 involves, our Microsoft 365 Business Premium guide, or get in touch.

For the authoritative detail, see Microsoft's Microsoft Defender Suite for Business Premium documentation and the Defender for Business FAQ.

Last reviewed: 11 August 2026, against Microsoft Learn documentation.

Frequently asked questions

Can we just add Defender for Endpoint Plan 2 licences to some users?

No. Microsoft Defender for Business does not support mixed licensing. A tenant with any users on Defender for Business and others on Defender for Endpoint Plan 2 defaults every user to the Defender for Business experience until every user is licensed for Plan 2 and Microsoft Support is contacted to switch the tenant.

Does Microsoft 365 Business Premium include enough Defender for ML2?

Business Premium's included Defender for Business is generally sufficient for Maturity Level 1. For Maturity Level 2's event-logging, retention and analysis requirements, most businesses need to add the Microsoft Defender Suite for Business Premium, which upgrades to Defender for Endpoint Plan 2, Defender for Office 365 Plan 2 and Defender for Cloud Apps.

Does Defender for Business cover servers?

Only with an additional per-server licence, and only up to 60 servers per subscription. Beyond that cap, or for advanced server protection, Microsoft Defender for Endpoint for Servers is the licence required.