Insights

From Defender ATP to Defender for Endpoint

If you’ve searched for “Microsoft Defender Advanced Threat Protection” or “Windows Defender ATP”, you’re looking for what is now called Microsoft Defender for Endpoint. Microsoft renamed it at its Ignite event in September 2020 as part of a wider rebrand of its security range under the Defender name.

The new name reflects a change in scope. Whereas the product once focused mainly on Windows devices, it now helps secure Windows, macOS, Linux, iOS, Android, and other types of endpoint. The old “ATP” label has been retired, so this guide uses the current name throughout.

Since then, the product has moved into Microsoft Defender XDR, Microsoft’s extended detection and response (XDR) suite. Defender XDR ties endpoint, email, identity, cloud app, and other security signals together, managed from the Microsoft Defender portal at security.microsoft.com.

What does Microsoft Defender for Endpoint do?

Microsoft Defender for Endpoint detects, investigates, and responds to attacks on your devices. It flags suspicious activity, shows you how a threat arrived and what it did, and gives you the tools to contain and remove it, while some responses can run automatically.

To avoid further confusion on product naming, Microsoft Defender Antivirus is the anti-malware engine built into Windows and available as part of Defender for Endpoint protection. Defender for Endpoint is the wider platform, which includes antivirus protection and adds detection, response, vulnerability management, attack surface reduction, and security operations features. The two work together.

Microsoft Learn describes Defender for Endpoint as an enterprise endpoint security platform designed to help organisations “prevent, detect, investigate, and respond to advanced threats on their endpoints”. So, it covers the full attack timeline, rather than just one part of it.

Why plan for a breach?

No security product blocks everything. The modern Zero Trust security model assumes a breach can happen and prepares for it, which should apply whether you have 10 users or 1,000.

Defender for Endpoint supports this model. When something gets through, it can catch it quickly, isolate the device, and limit the damage before the threat spreads. It can also finds weaknesses first, such as missing patches, exposed devices, vulnerable software, or risky settings, and helps you fix them.

How does Defender for Endpoint work?

Defender for Endpoint is cloud-hosted, so there’s no server infrastructure to run. You onboard devices into the service, then endpoint sensors and agents collect security signals from those devices. Microsoft analyses those signals in the cloud and uses them to spot behaviour that could point to an attack.

You can onboard devices through tools you may already use, such as Microsoft Intune, Microsoft Configuration Manager, Group Policy, or scripted deployment methods. Microsoft has also improved its Defender deployment tooling, including a Windows deployment tool that can bundle onboarding packages into the tool’s executable and help manage deployment packages from the Defender portal.

Once a device is onboarded, it starts reporting into the Microsoft Defender portal. From there, your security team can see alerts, incidents, device health, vulnerabilities, software inventory, security recommendations, and response actions.

How does Defender for Endpoint know what a threat looks like?

Microsoft sees a large share of global digital activity, which gives its detection models a lot to learn from. Those signals come from its products, services, customers, partners, and security teams.

Microsoft runs machine learning and AI across this data to learn what normal behaviour looks like and what looks like an attack. When something suspicious appears on a device, the service can show how the threat started, what it is, and what it’s likely to do. You can then take action, or in many cases Defender for Endpoint can act for you.

To demonstrate the scale behind these detection models, Microsoft reports it processes more than 100 trillion security signals daily, while blocking around 4.5 million net new malware file attempts, screening about five billion emails for malware and phishing, and analysing approximately 38 million identity risk detections.

The five main capability areas of Microsoft Defender for Endpoint

Defender for Endpoint’s capabilities are tightly linked, and many share signals with the rest of the Defender suite. Rather than seeing it as a single tool, it’s easier to understand it as five connected areas.

1. Prevent threats

Defender for Endpoint includes next-generation antivirus protection, cloud-delivered protection, network protection, web protection, endpoint firewall controls, device control, and attack surface reduction rules.

Attack surface reduction helps cut the number of ways an attacker can get in. For example, you can block risky behaviours used by malware, apply device controls, manage firewall rules, and reduce exposure from common attack paths. You can also use application control to require applications to be trusted before they run, rather than trusting them by default.

Hardware-based isolation can open untrusted websites and files inside a lightweight container, kept apart from the rest of the device.

“If you can block the technique an attacker relies on, you can often stop the attack even before you’ve identified the specific malware.”

Mark Jones, Head of Cyber Security at Chorus

2. Reduce exposure

Defender for Endpoint helps you find and fix weaknesses before attackers use them. It keeps an inventory of devices and software, spots known vulnerabilities, highlights missing patches, and identifies risky configurations.

“Historically organisations needed to run large network vulnerability scans. Defender for Endpoint gives you that visibility continuously from the endpoints themselves.”

Mark Jones, Head of Cyber Security at Chorus

This capability is delivered through Microsoft Defender Vulnerability Management. Plan 2 includes core vulnerability management capabilities, while premium Defender Vulnerability Management capabilities are available as an add-on.

Microsoft is also bringing vulnerability data into the wider Exposure management experience in the Defender portal. The exact navigation can vary by tenant and preview status. Microsoft is linking vulnerability data, exposure insights, device context, and attack paths more closely.

Recent updates have improved the exposure score model in Defender Vulnerability Management. Microsoft says the newer model uses exploit prediction data, known as EPSS, and asset context such as whether a device is internet-facing or business critical. This helps teams prioritise the fixes that reduce the most risk.

3. Detect and investigate attacks

The core post-breach capability is endpoint detection and response (EDR). It spots attacks close to real time and raises alerts for your security team.

Related alerts are grouped into incidents automatically. For example, alerts linked by the same file, same URL, same user, same device, or a close time window can be joined together. Your team can then investigate one attack story rather than dozens of scattered signals.

The Microsoft Defender portal gives you an event timeline, device history, process tree, affected assets, alert evidence, and recommended next steps. Advanced hunting lets your team query raw event data to search for threats across your estate. You can also write custom detection rules that raise alerts in the Defender portal. Advanced hunting is in Plan 2.

4. Respond and recover

Defender for Endpoint includes automated investigation and response. It can examine alerts, gather evidence, and remediate some threats without waiting for a manual response. That can reduce alert noise and help security teams focus on the incidents that warrant their attention.

“Defender for Endpoint can start investigating suspicious activity before a human analyst has even looked at the alert.”

Mark Jones, Head of Cyber Security at Chorus

Manual response actions are also available from the Defender portal. These include running an antivirus scan, restricting app execution, isolating a device from the network while keeping its link to the Defender service, collecting investigation packages, quarantining files and more.

Automatic attack disruption is now a central part of Microsoft’s security stack. This is a Microsoft Defender XDR capability that uses signals across services, including endpoint, identity, email, collaboration tools, and SaaS apps. When Microsoft Defender XDR has high confidence that an active attack is in progress, it can take response actions through the relevant Defender products to contain compromised assets and limit lateral movement.

For Defender for Endpoint, that can include actions such as automatic device isolation. Microsoft describes this as part of automatic attack disruption, with isolation scoped to the incident, and security operators can release isolation when needed.

5. Connect endpoint security with XDR

Defender for Endpoint is the endpoint part of Microsoft Defender XDR. It shares signals with the email, identity, cloud app, data, and cloud workload parts of the suite, so a threat found on a device can trigger a coordinated response elsewhere.

It also connects to Microsoft Intune, Conditional Access, Microsoft Defender for Cloud, Microsoft Defender for Cloud Apps, Microsoft Defender for Identity, Microsoft Defender for Office 365, Microsoft Defender Vulnerability Management, Microsoft Sentinel, and Microsoft threat intelligence.

Security teams can also use Microsoft Security Copilot to help with investigation and response, depending on licensing and setup.

What's new in Defender for Endpoint in 2026?

Defender for Endpoint changes often, so this guide can’t cover every release, but there are several key 2026 developments:

AI agent discovery and protection

Microsoft has started adding preview capabilities for local AI agent discovery and runtime protection in Defender for Endpoint. This gives security teams more visibility over supported local AI agents running on endpoints, including coding agents, desktop AI assistants, local AI runtimes, and agent platforms.

Microsoft’s July 2026 update also includes AI agent runtime protection updates, including support for Codex CLI and the GitHub Copilot app. This is still an emerging area, but it shows where endpoint security is heading as more AI tools run locally on devices.

Better exposure scoring

The enhanced exposure score in Defender Vulnerability Management is now generally available. Microsoft says the updated model improves risk prioritisation by using exploit prediction data and asset context, such as internet-facing status and criticality.

Automatic device isolation

Microsoft has added automatic device isolation (in preview) as part of automatic attack disruption. Defender for Endpoint can now help isolate compromised devices during an active attack, while keeping the device connected to security services.

Improved deployment tooling

The Defender deployment tool for Windows has been improved. The newer version can bundle the onboarding package into the tool, use package keys, allow expiry dates for deployment packages, and show downloaded packages in the Defender portal.

More precise response controls

Selective Response Actions give organisations more control over how high-impact response actions are applied during onboarding, especially for Tier 0 systems and other high-value assets. This helps teams balance protection with operational stability.

The Microsoft Defender portal

You manage Defender for Endpoint from the Microsoft Defender portal, which replaced the old Defender Security Center. From one place you can see devices and users at risk, active alerts and incidents, automated investigations, reports, device inventory, vulnerabilities, and response actions.

Alerts: When a threat lands on a device, an alert appears in the portal quickly. Each alert carries useful detail, such as the affected device, the user, a severity rating, and how long it’s been open.

Investigation: You can then dig into the alert. The portal describes what happened and suggests next steps. Its event timeline shows how the threat arrived and what it did after.

Remediation: You can respond straight from the portal. Actions include running an antivirus scan, restricting app execution, or isolating a device from the network while keeping its link to the Defender service.

“We can isolate a device from the network and carry on investigating it remotely, which is incredibly useful when you’re trying to contain an incident.”

Mark Jones, Head of Cyber Security at Chorus

For files, you can quarantine an item and see how widespread it is across your estate. You also get a list of every device the threat reached, so you can clean those up too.

Which plan and licence do you need?

Defender for Endpoint is available in several ways, depending on your Microsoft 365 licence, your organisation size, and whether you’re protecting user devices, servers, or both.

Microsoft Defender for Endpoint Plan 1

Plan 1 covers the preventative basics. It includes next-generation anti-malware, attack surface reduction, device control, endpoint firewall, network protection, and related endpoint security controls, all managed from the Defender portal.

Plan 1 is available as a standalone user subscription and is included in Microsoft 365 E3.

Microsoft Defender for Endpoint Plan 2

Plan 2 includes Plan 1 and adds the full endpoint security set: endpoint detection and response, automated investigation and remediation, core vulnerability management, threat analytics, deep file analysis, advanced hunting, and wider security operations features.

Microsoft says Defender for Endpoint Plan 2 is included in Microsoft 365 E5 and Microsoft 365 E7, and in the Microsoft Defender Suite add-on (previously called Microsoft 365 E5 Security). E7 became available in 2026. Plan 2 is also available through other eligible plans.

Microsoft Defender for Business

If you’re a small-to-medium sized enterprise (SME), Microsoft Defender for Business may be the most appropriate starting point. Microsoft describes Defender for Business as an endpoint security solution for small and medium-sized businesses with up to 300 employees. It includes the features of Defender for Endpoint Plan 2 with a few from Plan 2.

It’s included with Microsoft 365 Business Premium and is also available as a standalone option. With many UK SME’s already using Microsoft 365 Business Premium it is worth making sure you are using this capability if you have it. If you use Business Premium and wish to use the full Plan 2 features, Microsoft Defender Suite for Business is a great choice.

Microsoft Defender Suite

Microsoft’s current pricing pages now focus more on Microsoft Defender Suite as the security add-on.. It gives organisations access to Defender for Endpoint Plan 2, as well as the other Defender apps for unified protection, detection, investigation, and response across identities, endpoints, email, and SaaS apps.

Microsoft Defender Suite is available as an add-on for Microsoft 365 E3, or Microsoft Defender Suite for Business is an add-on for Microsoft 365 Business Premium. This add-on was formerly known as Microsoft 365 E5 Security add-on (rebranded in late 2025) and then expanded into an add-on for Business Premium. So if you looked at E5 Security before, this is the same route under a new name. Naming and packaging can change, so check the current Microsoft Product Terms or ask your Microsoft partner before making a licensing decision.

Server licensing

A user licence usually protects up to five devices, but it doesn’t include servers. Servers are licensed separately. Microsoft offers Defender for Endpoint for Servers for Windows and Linux server workloads, with a separate licence required for each server operating system environment.

So if you’re protecting laptops, mobile devices, and servers together, plan for server licences on top of your user licences.

There’s also Microsoft Defender for Cloud. Enable Defender for Servers on a subscription and it can deploy Defender for Endpoint to your servers while providing the required server licensing.

Pricing

Standalone US list prices have often sat around $3 per user per month for Plan 1 and $5.20 for Plan 2. Microsoft pricing can vary by country, agreement, tenant, and packaging, so treat this as a guide only. Check the current Microsoft pricing page or ask your Microsoft partner before purchasing.

If you’re not sure which plan you already hold, ask your IT partner to check your tenant and confirm.

Summary

Microsoft Defender for Endpoint gives you a single platform to prevent, detect, investigate, and respond to attacks on your devices. It combines endpoint protection, EDR, vulnerability management, automated response, and Microsoft threat intelligence, and it connects into the wider Defender XDR suite.

For many UK businesses, the licence you already hold may include some form of Microsoft endpoint protection. The key is knowing whether you have Defender for Endpoint Plan 1, Plan 2, Defender for Business, Microsoft Defender Suite, or another route through Microsoft 365. Checking server licensing separately is also recommended.

How Chorus uses Microsoft Defender for Endpoint

Chorus uses Microsoft Defender for Endpoint as part of our managed security services. In our managed detection and response (MDR) service, endpoint and identity signals are monitored through Microsoft Defender for Endpoint, Microsoft Entra ID, and Microsoft Sentinel. In managed extended detection and response (MXDR), this extends across the wider Microsoft Defender stack, including email, identity, cloud apps, and third-party sources, with alerts triaged by the Chorus Security Operations Centre (SOC).

This helps customers move from endpoint protection alone to managed detection, investigation, response, and threat hunting across their Microsoft security environment.

Defender for Endpoint also plays a part in Chorus’s Microsoft 365 and cyber security consultancy work. There, it sits alongside Microsoft Intune, Defender for Identity, Defender for Office 365, Defender for Cloud Apps, Microsoft Sentinel, and Zero Trust security planning. We use it to improve endpoint visibility, reduce attack surface, and strengthen security posture, helping customers move from traditional endpoint protection to Microsoft-native security operations.

How Chorus can help with Microsoft Defender for Endpoint

If you’re looking to implement Microsoft Defender for Endpoint or enhance it with a 24/7 managed SOC service, Chorus can help.

We’re a Microsoft-focused MSP and MSSP, delivering MDR and MXDR services built on Microsoft Defender XDR, Microsoft Defender for Cloud and Microsoft Sentinel, with Microsoft Defender for Endpoint at the heart of our endpoint security monitoring and response.

Chorus is also a Microsoft security partner, a member of Microsoft Intelligent Security Association (MISA), and a Microsoft Verified MXDR solution provider.