Is Microsoft Defender for Business enough for Essential Eight Maturity Level 2?
Generally yes at Maturity Level 1, generally no on its own at Maturity Level 2. Defender for Business, included in Microsoft 365 Business Premium, covers the endpoint protection ML1 needs. ML2's event-logging, analysis and evidence requirements usually call for Microsoft Defender for Endpoint Plan 2, added through the Microsoft Defender Suite for Business Premium, because Defender for Business alone does not carry the extended device data retention and hunting capability an ML2 assessment expects.
What Defender for Business covers
Defender for Business, included in Business Premium at no extra cost, delivers next-generation antivirus, endpoint detection and response, attack surface reduction, automated investigation and remediation, and vulnerability management, aimed at small and mid-sized businesses without a dedicated security team. That is a reasonable match for Maturity Level 1's application control, patching and logging expectations. It is not built for the deeper log retention and manual threat-hunting an ML2 assessment tends to expect.
What the Microsoft Defender Suite for Business Premium adds
This add-on to Business Premium upgrades four areas at once: Defender for Endpoint Plan 2 (threat hunting, live response, endpoint security for IoT devices and, materially for ML2, six months of device data retention), Defender for Office 365 Plan 2 (automated investigation and response, attack simulation training, threat trackers and advanced hunting), Defender for Cloud Apps (shadow IT discovery and app governance) and Defender for Identity (identity threat detection and response). The six months of retention is the detail that matters most for ML2's event-logging and incident-analysis controls, which ask for logs to actually be there when an assessor or an incident responder needs them.
The mixed-licensing rule most providers get wrong
Microsoft Defender for Business does not support mixed licensing. If a tenant has some users on Defender for Business (via Business Premium) and others on Defender for Endpoint Plan 2 (via Microsoft 365 E5 Security or a standalone licence), every user in the tenant defaults to the Defender for Business experience, not the Plan 2 experience for the licensed users. Licensing a subset of users for Plan 2 and assuming they get the upgraded features is the single most common mistake we see in ML2 uplift plans. To actually get the Defender for Endpoint Plan 2 experience, every user in the tenant must be licensed for it, and Microsoft Support must be contacted to request the tenant-level switch. Partial licensing silently does nothing.
Servers are a separate decision
Defender for Business supports Windows and Linux servers only through an additional per-server-instance licence, capped at 60 servers per subscription. Businesses running more than 60 server instances, or needing the deeper capability of the full Defender for Endpoint feature set on servers, license Microsoft Defender for Endpoint for Servers instead. Either way, servers are not covered by a workstation-focused Business Premium or Defender for Business licence by default, and an ML2 gap assessment should check this explicitly.
Does ASD Essentials change the licensing picture?
Not for ML2 today, and where it points, it points the same way. ASD's Essentials for cloud chapter, launched on 15 October 2026, asks organisations to "Enable provider audit logging at sufficient tiers and retention, and forward security-relevant logs and configuration changes to a central capability", which is the same retention argument ML2 makes for Defender for Endpoint Plan 2. It also calls for time-bound privilege grants before privileged actions. In Microsoft's stack that is Privileged Identity Management, which Microsoft Learn's Entra ID Governance licensing fundamentals lists under Entra ID P2, Entra ID Governance and the Entra Suite, not under the Entra ID P1 included in Business Premium. See does ASD Essentials for cloud apply to a Microsoft 365 Business Premium business?
How Blue Arc IT Solutions approaches it
Our default is Defender for Business at Maturity Level 1, and the Microsoft Defender Suite for Business Premium at Maturity Level 2, delivered as part of our ML2 Uplift Program so the licensing switch, log retention and evidence are handled correctly the first time rather than discovered as a gap during an assessment. See our guides to what Essential Eight Maturity Level 1 involves and what Essential Eight Maturity Level 2 involves, our Microsoft 365 Business Premium guide, or get in touch.
For the authoritative detail, see Microsoft's Microsoft Defender Suite for Business Premium documentation and the Defender for Business FAQ.
Last reviewed: 19 October 2026 for the ASD Essentials section, against ASD's Essentials for cloud chapter and Microsoft Learn's Entra ID Governance licensing fundamentals (updated 29 July 2026). Defender licensing facts last verified 11 August 2026, against Microsoft Learn documentation.
Frequently asked questions
Can we just add Defender for Endpoint Plan 2 licences to some users?
No. Microsoft Defender for Business does not support mixed licensing. A tenant with any users on Defender for Business and others on Defender for Endpoint Plan 2 defaults every user to the Defender for Business experience until every user is licensed for Plan 2 and Microsoft Support is contacted to switch the tenant.
Does Microsoft 365 Business Premium include enough Defender for ML2?
Business Premium's included Defender for Business is generally sufficient for Maturity Level 1. For Maturity Level 2's event-logging, retention and analysis requirements, most businesses need to add the Microsoft Defender Suite for Business Premium, which upgrades to Defender for Endpoint Plan 2, Defender for Office 365 Plan 2 and Defender for Cloud Apps.
Does Defender for Business cover servers?
Only with an additional per-server licence, and only up to 60 servers per subscription. Beyond that cap, or for advanced server protection, Microsoft Defender for Endpoint for Servers is the licence required.