specification: API Commons Plans
specificationVersion: '0.1'
schema: https://raw.githubusercontent.com/api-evangelist/interface-research/main/schema/api-commons.yml#/$defs/Plans
provider: Microsoft Defender
providerId: microsoft-defender
created: '2026-05-04'
# Provenance stamped 2026-08-11: this artifact was written by the API Evangelist
# bulk sweep dated 2026-05-04, not harvested from the provider. See roadmap#35.
method: generated
modified: '2026-05-05'
reconciled: true
tags:
  - Security
  - Endpoint Protection
  - XDR
  - Cloud Security
  - Identity Protection
  - Microsoft
description: Microsoft Defender is a portfolio of security products with two distinct pricing
  models. Endpoint / XDR / Identity products (Defender for Endpoint Plan 1/2, Defender for
  Identity, Defender for Office 365, Defender for Cloud Apps, Defender XDR) are licensed
  per-user-per-month, often bundled into Microsoft 365 E5 / E5 Security / E5 Mobility +
  Security. Defender for Cloud (CSPM/CWP) is consumption-priced per resource per hour with
  Plan 1 (CSPM) free tier and Plan 2 (Defender Plans) per-resource hourly meters. Defender
  for Business (SMB SKU) is $3/user/month or bundled with M365 Business Premium.
sources:
  - https://www.microsoft.com/security/business/microsoft-defender
  - https://azure.microsoft.com/pricing/details/defender-for-cloud/
  - https://learn.microsoft.com/en-us/defender-for-cloud/concept-cloud-security-posture-management
  - https://learn.microsoft.com/en-us/defender-business/
plans:
  - id: microsoft-defender-for-endpoint-p1
    name: Defender for Endpoint Plan 1
    type: subscription
    description: Core endpoint security — next-gen AV, attack surface reduction, application
      control, web/network protection, manual response.
    entries:
      - label: Per user per month
        name: mde_p1_seat
        type: subscription
        metric: user-month
        limit: -1
        timeFrame: month
        geo: global
        unit: 1
        price: '$3.00 per user per month'
        userMultiplied: true
    elements:
      - name: Next-gen antimalware
      - name: Attack surface reduction
      - name: Centralized management
  - id: microsoft-defender-for-endpoint-p2
    name: Defender for Endpoint Plan 2
    type: subscription
    description: Adds EDR, threat & vulnerability management, automated investigation,
      Microsoft Threat Experts, sandbox, and advanced hunting.
    entries:
      - label: Per user per month
        name: mde_p2_seat
        type: subscription
        metric: user-month
        limit: -1
        timeFrame: month
        geo: global
        unit: 1
        price: '$5.20 per user per month'
        userMultiplied: true
    elements:
      - name: EDR with behavioral detection
      - name: Threat & vulnerability management
      - name: Automated investigation & response
      - name: Microsoft Threat Experts
  - id: microsoft-defender-for-business
    name: Defender for Business (SMB)
    type: subscription
    description: SMB-targeted endpoint protection (≤300 users). Standalone or included with
      M365 Business Premium.
    entries:
      - label: Per user per month
        name: mdb_seat
        type: subscription
        metric: user-month
        limit: 300
        timeFrame: month
        geo: global
        unit: 1
        price: '$3.00 per user per month'
        userMultiplied: true
    elements:
      - name: SMB-grade endpoint security
      - name: Up to 300 users
      - name: Bundled in M365 Business Premium
  - id: microsoft-defender-for-office-365-p1
    name: Defender for Office 365 Plan 1
    type: subscription
    description: Email security — Safe Attachments, Safe Links, anti-phishing.
    entries:
      - label: Per user per month
        name: mdo_p1_seat
        type: subscription
        metric: user-month
        limit: -1
        timeFrame: month
        geo: global
        unit: 1
        price: '$2.00 per user per month'
        userMultiplied: true
    elements:
      - name: Safe Attachments
      - name: Safe Links
      - name: Anti-phishing
  - id: microsoft-defender-for-office-365-p2
    name: Defender for Office 365 Plan 2
    type: subscription
    description: Adds Threat Explorer, Threat Trackers, Attack Simulator, and automated
      investigation/response for email.
    entries:
      - label: Per user per month
        name: mdo_p2_seat
        type: subscription
        metric: user-month
        limit: -1
        timeFrame: month
        geo: global
        unit: 1
        price: '$5.00 per user per month'
        userMultiplied: true
    elements:
      - name: Threat Explorer & hunting
      - name: Attack Simulator
      - name: Automated investigation & response
  - id: microsoft-defender-for-identity
    name: Defender for Identity
    type: subscription
    description: On-premises Active Directory threat detection.
    entries:
      - label: Per user per month
        name: mdi_seat
        type: subscription
        metric: user-month
        limit: -1
        timeFrame: month
        geo: global
        unit: 1
        price: '$5.50 per user per month'
        userMultiplied: true
    elements:
      - name: AD threat detection
      - name: Lateral movement path analytics
  - id: microsoft-defender-for-cloud-apps
    name: Defender for Cloud Apps (CASB)
    type: subscription
    description: Cloud Access Security Broker; SaaS app discovery and governance.
    entries:
      - label: Per user per month
        name: mdca_seat
        type: subscription
        metric: user-month
        limit: -1
        timeFrame: month
        geo: global
        unit: 1
        price: '$3.50 per user per month'
        userMultiplied: true
    elements:
      - name: SaaS app discovery
      - name: Conditional access app control
      - name: Information protection
  - id: microsoft-defender-for-cloud-cspm-free
    name: Defender for Cloud — Foundational CSPM (Free)
    type: freemium
    description: Free baseline cloud security posture management for Azure subscriptions.
      Includes secure-score, recommendations, and asset inventory.
    entries:
      - label: Free CSPM
        name: cspm_free
        type: quota
        metric: subscription
        limit: -1
        timeFrame: month
        geo: global
        unit: 1
        price: '0.00'
        userMultiplied: false
    elements:
      - name: Secure score
      - name: Asset inventory
      - name: Compliance dashboard (limited)
  - id: microsoft-defender-for-cloud-cspm-defender
    name: Defender for Cloud — Defender CSPM (Plan 2)
    type: usage-based
    description: Premium CSPM with attack-path analysis, agentless vulnerability scanning,
      data-aware security posture, governance, regulatory compliance.
    entries:
      - label: Per billable resource per month
        name: defender_cspm_resource
        type: metered
        metric: resource-month
        limit: -1
        timeFrame: month
        geo: global
        unit: 1
        price: '$5 per billable resource per month (e.g., VM, DB, container registry)'
        userMultiplied: false
    elements:
      - name: Attack path analysis
      - name: Agentless scanning
      - name: Cloud security graph
  - id: microsoft-defender-for-servers-p1
    name: Defender for Servers Plan 1
    type: usage-based
    description: Server endpoint protection on Azure / AWS / GCP / on-prem (via Arc).
    entries:
      - label: Per server per hour
        name: defender_servers_p1
        type: metered
        metric: server-hour
        limit: -1
        timeFrame: usage
        geo: global
        unit: 1
        price: '$0.0103 per server per hour (~$5/server/month)'
        userMultiplied: false
    elements:
      - name: Microsoft Defender for Endpoint included
      - name: License flexibility (server-by-server)
  - id: microsoft-defender-for-servers-p2
    name: Defender for Servers Plan 2
    type: usage-based
    description: Adds vulnerability assessment (Qualys/Defender VM), file integrity
      monitoring, just-in-time VM access, adaptive application controls, network hardening.
    entries:
      - label: Per server per hour
        name: defender_servers_p2
        type: metered
        metric: server-hour
        limit: -1
        timeFrame: usage
        geo: global
        unit: 1
        price: '$0.0205 per server per hour (~$15/server/month)'
        userMultiplied: false
    elements:
      - name: Vulnerability assessment
      - name: File integrity monitoring
      - name: Just-in-time VM access
      - name: Adaptive app controls
  - id: microsoft-defender-for-storage
    name: Defender for Storage
    type: usage-based
    description: Threat detection on Azure Storage (malware scanning, anomalous access).
    entries:
      - label: Per storage account per month
        name: defender_storage_account
        type: metered
        metric: account-month
        limit: -1
        timeFrame: month
        geo: global
        unit: 1
        price: '$10 per storage account per month + $0.15 per 1K transactions; $0.15 per GB
          malware-scanned (first 5K transactions/month free)'
        userMultiplied: false
    elements:
      - name: Malware scanning on upload
      - name: Anomaly detection
  - id: microsoft-defender-for-databases
    name: Defender for Databases
    type: usage-based
    description: SQL / Cosmos DB / Open-source DBs threat protection.
    entries:
      - label: Defender for Azure SQL — per server per hour
        name: defender_sql_server
        type: metered
        metric: server-hour
        limit: -1
        timeFrame: usage
        geo: global
        unit: 1
        price: '$0.02 per vCore per hour (Azure SQL DB / MI / VMs)'
        userMultiplied: false
      - label: Defender for Cosmos DB
        name: defender_cosmos
        type: metered
        metric: 100-RU-hour
        limit: -1
        timeFrame: usage
        geo: global
        unit: 1
        price: '$0.0095 per 100 RU/s per hour'
        userMultiplied: false
    elements:
      - name: SQL injection detection
      - name: Anomaly detection
  - id: microsoft-defender-for-containers
    name: Defender for Containers
    type: usage-based
    description: Kubernetes / container security across AKS, EKS, GKE, on-prem.
    entries:
      - label: Per vCore per hour
        name: defender_containers_vcore
        type: metered
        metric: vcore-hour
        limit: -1
        timeFrame: usage
        geo: global
        unit: 1
        price: '$0.0095 per vCore per hour (~$7/vCore/month)'
        userMultiplied: false
    elements:
      - name: Image vulnerability scanning
      - name: Runtime threat detection
      - name: Kubernetes hardening
  - id: microsoft-defender-xdr
    name: Microsoft Defender XDR (formerly Microsoft 365 Defender)
    type: subscription
    description: Unified XDR portal — included at no extra cost when you license any of the
      underlying Defender E5 components.
    entries:
      - label: Bundled with constituent SKUs
        name: defender_xdr_bundled
        type: subscription
        metric: user-month
        limit: -1
        timeFrame: month
        geo: global
        unit: 1
        price: included with E5 / E5 Security or constituent Defender SKUs
        userMultiplied: true
    elements:
      - name: Cross-domain correlation
      - name: Unified incidents
      - name: Advanced hunting
  - id: microsoft-defender-bundles
    name: M365 E5 Security Bundle
    type: subscription
    description: Microsoft 365 E5 Security add-on bundles Defender for Endpoint P2, Defender
      for Identity, Defender for Office 365 P2, and Defender for Cloud Apps.
    entries:
      - label: Per user per month
        name: e5_security_bundle
        type: subscription
        metric: user-month
        limit: -1
        timeFrame: month
        geo: global
        unit: 1
        price: '$12.00 per user per month'
        userMultiplied: true
    elements:
      - name: Defender for Endpoint P2
      - name: Defender for Identity
      - name: Defender for Office 365 P2
      - name: Defender for Cloud Apps
  - id: microsoft-defender-enterprise
    name: Enterprise Agreement / Volume Licensing
    type: enterprise
    description: Negotiated rates via EA / MCA / CSP. Often bundled with M365 E5 ELA.
    entries:
      - label: Negotiated rate
        name: ea_negotiated
        type: subscription
        metric: contract
        limit: -1
        timeFrame: month
        geo: global
        unit: 1
        price: custom
        userMultiplied: false
    elements:
      - name: Volume discount
      - name: M365 E5 ELA bundling
      - name: Dedicated technical account management
maintainers:
  - FN: Kin Lane
    email: kin@apievangelist.com
    url: https://www.microsoft.com/security/business/microsoft-defender
x-canonical:
  generated: '2026-10-08'
  vocabulary: all/0-working/economics/plans-canonical.yml
  models:
  - free
  - metered
  - subscription
  units:
  - compute
  - negotiated
  - period
  - seat
  plans:
  - name: Defender for Endpoint Plan 1
    access: other
    model: subscription
    model_how: stated
    units:
    - seat
    periods:
    - month
  - name: Defender for Endpoint Plan 2
    access: other
    model: subscription
    model_how: stated
    units:
    - seat
    periods:
    - month
  - name: Defender for Business (SMB)
    access: other
    model: subscription
    model_how: stated
    units:
    - seat
    periods:
    - month
  - name: Defender for Office 365 Plan 1
    access: other
    model: subscription
    model_how: stated
    units:
    - seat
    periods:
    - month
  - name: Defender for Office 365 Plan 2
    access: other
    model: subscription
    model_how: stated
    units:
    - seat
    periods:
    - month
  - name: Defender for Identity
    access: other
    model: subscription
    model_how: stated
    units:
    - seat
    periods:
    - month
  - name: Defender for Cloud Apps (CASB)
    access: other
    model: subscription
    model_how: stated
    units:
    - seat
    periods:
    - month
  - name: Defender for Cloud — Foundational CSPM (Free)
    access: freemium
    model: free
    model_how: derived
    units:
    - period
    periods:
    - month
  - name: Defender for Cloud — Defender CSPM (Plan 2)
    access: other
    model: metered
    model_how: stated
    units:
    - other
    periods:
    - month
  - name: Defender for Servers Plan 1
    access: other
    model: metered
    model_how: stated
    units:
    - compute
    periods:
    - per-use
  - name: Defender for Servers Plan 2
    access: other
    model: metered
    model_how: stated
    units:
    - compute
    periods:
    - per-use
  - name: Defender for Storage
    access: other
    model: metered
    model_how: stated
    units:
    - other
    periods:
    - month
  - name: Defender for Databases
    access: other
    model: metered
    model_how: stated
    units:
    - compute
    periods:
    - per-use
  - name: Defender for Containers
    access: other
    model: metered
    model_how: stated
    units:
    - compute
    periods:
    - per-use
  - name: Microsoft Defender XDR (formerly Microsoft 365 Defender)
    access: other
    model: subscription
    model_how: stated
    units:
    - seat
    periods:
    - month
  - name: M365 E5 Security Bundle
    access: other
    model: subscription
    model_how: stated
    units:
    - seat
    periods:
    - month
  - name: Enterprise Agreement / Volume Licensing
    access: enterprise
    model: subscription
    model_how: derived
    units:
    - negotiated
    periods:
    - month