If you’re an IT manager evaluating endpoint detection and response (EDR) solutions, you’re probably looking at products like SentinelOne, CrowdStrike, Carbon Black, BlackBerry Cylance, or Huntress.

Industry buzz, Google searches, security consultants, and sometimes even your cyber insurance provider have likely told you that you need a modern EDR solution to properly secure your company’s endpoints.

You may also be aware that Microsoft offers an EDR platform called Microsoft Defender for Endpoint.

What many IT managers know is that Defender for Endpoint has two versions: Plan 1 and Plan 2. Defender for Endpoint Plan 2 is Microsoft’s top-tier enterprise EDR platform and is designed for very large organizations with tens of thousands — even hundreds of thousands — of users.

But what many IT managers don’t realize is that Microsoft offers another EDR platform that is extremely similar to Defender for Endpoint Plan 2 for organizations with fewer than 300 users.

That product is Microsoft Defender for Business.

Most Companies Are Underutilizing Microsoft 365

Here’s something I see constantly.

After speaking with roughly 300 new prospective clients every year, a pattern shows up again and again.

Most companies are using Microsoft 365 primarily for:

  • Exchange Online email
  • The subscription version of the Office desktop apps

That’s it.

Some organizations are starting to move their file servers into Microsoft 365 using SharePoint and OneDrive, but beyond that the Microsoft 365 platform is largely untouched.

The reality is that most companies are massively underutilizing their Microsoft 365 licenses.

One License Change Away From Enterprise EDR

What many organizations don’t realize is that they are often one license adjustment away from having a modern enterprise-grade endpoint detection and response platform.

Microsoft Defender for Business provides:

  • AI-driven threat detection
  • Machine learning security analysis
  • Cloud-connected endpoint monitoring
  • Automated response capabilities

And it integrates directly with Microsoft 365 and Azure Active Directory Premium.

In other words, it’s a direct competitor to many of the EDR platforms organizations are currently evaluating.

That includes platforms such as:

  • CrowdStrike
  • SentinelOne
  • Carbon Black
  • Palo Alto Cortex
  • Sophos Intercept X
  • FireEye

What Does Microsoft Use?

Here’s a question that’s worth asking.

Do you think Microsoft — a company with around 180,000 employees worldwide — protects its endpoints with CrowdStrike or SentinelOne?

Of course they don’t.

Microsoft protects its own global workforce using Microsoft Defender for Endpoint Plan 2.

This is the same security technology platform that powers Defender for Business, which is designed specifically for smaller organizations.

The Security Platform Many IT Teams Already Own

For companies already using Microsoft 365, Defender for Business is often much closer than they realize.

In many environments, the company is only a license upgrade away from having a fully integrated Microsoft security platform protecting their endpoints.

Instead of managing multiple third-party security vendors, organizations can often leverage the Microsoft security stack that is already part of their existing environment.

And for many companies, that platform is already sitting there — powerful, integrated, and simply waiting to be fully deployed.

Microsoft Defender, Intune, and Entra ID form a powerful integrated security platform when properly configured. If you'd like to see how these systems work together in real-world environments, take a look at our Microsoft 365 security overview here: https://www.xerillion.com/microsoft-365-it-security-modernization/?

-Wayne