Comparing Defender for Endpoint P1 & P2 with Defender Servers P1 & P2

Question

Comparing Defender for Endpoint P1 & P2 with Defender Servers P1 & P2

Paddy Kiconco 0

I have a customer who has an M365 E5 which consists of MDE P2. They have onboarded their servers (Windows & Linux) to MDE P2. Would this customer need Defender for Servers P1 or P2 under the Defender CSPM?

Rukmini 30,615 Reputation points Microsoft External Staff Moderator

2026-02-18T13:26:39.2266667+00:00

Hello Paddy Kiconco,

Yes, the customer still needs Defender for Servers Plan 1. Even though they have Microsoft 365 E5, which includes Microsoft Defender for Endpoint P2, and have onboarded their servers, M365 E5 does not license servers and only covers user devices. To properly license Windows and Linux servers, they must enable Defender for Servers Plan 1 under Microsoft Defender for Cloud.

Plan 1 is sufficient if they only need endpoint detection & response (EDR), threat protection, and integration with Defender for Endpoint. They would only need Plan 2 if they require advanced features such as vulnerability assessment, file integrity monitoring (FIM), or enhanced cloud security posture management (CSPM) capabilities.
Rukmini 30,615 Reputation points Microsoft External Staff Moderator

2026-02-23T09:45:57.6566667+00:00

Hello Paddy Kiconco, Following up to see if the above provided information was helpful. If you have any further queries do let us know.

2 answers

Your answer

Rukmini 30,615 Reputation points Microsoft External Staff Moderator

2026-02-18T13:26:39.2266667+00:00

Hello Paddy Kiconco,

Yes, the customer still needs Defender for Servers Plan 1. Even though they have Microsoft 365 E5, which includes Microsoft Defender for Endpoint P2, and have onboarded their servers, M365 E5 does not license servers and only covers user devices. To properly license Windows and Linux servers, they must enable Defender for Servers Plan 1 under Microsoft Defender for Cloud.

Plan 1 is sufficient if they only need endpoint detection & response (EDR), threat protection, and integration with Defender for Endpoint. They would only need Plan 2 if they require advanced features such as vulnerability assessment, file integrity monitoring (FIM), or enhanced cloud security posture management (CSPM) capabilities.
Rukmini 30,615 Reputation points Microsoft External Staff Moderator

2026-02-23T09:45:57.6566667+00:00

Hello Paddy Kiconco, Following up to see if the above provided information was helpful. If you have any further queries do let us know.

Answer 1

Hello @Paddy Kiconco,

Microsoft Defender for Servers comes in two plans: Plan 1 (P1) and Plan 2 (P2).

Plan 1 offers basic protection, while Plan 2 includes advanced features such as threat detection and response capabilities. Since your customer has onboarded their servers to MDE P2, they would benefit from the additional features offered by Defender for Servers Plan 2 (P2) to ensure comprehensive security across their server environments.

This is particularly important as the Defender for Servers integrates with Microsoft Defender for Endpoint to provide enhanced threat protection features.

Available plans

If this answers your query, do click Accept Answer and Up-Vote for the same. And, if you have any further query do let us know.

Answer 2

Given that the customer has an M365 E5 subscription which includes Microsoft Defender for Endpoint Plan 2 (MDE P2), they have comprehensive endpoint protection capabilities. However, to protect their servers (Windows & Linux) under the Defender Cloud Security Posture Management (CSPM), they would still need to consider Microsoft Defender for Servers.

Defender for Servers offers two plans:

Defender for Servers Plan 1 (P1) focuses on EDR capabilities provided by the Defender for Endpoint integration.
Defender for Servers Plan 2 (P2) includes all features of Plan 1 along with additional capabilities.

Since the customer is already using MDE P2, they may benefit from Defender for Servers P1, as it integrates well with their existing setup. However, if they require the additional features provided by Plan 2, such as enhanced security capabilities, they might consider upgrading to Defender for Servers P2.

Ultimately, the choice between P1 and P2 will depend on the specific security needs and compliance requirements of the customer's server environment.

Share via

Comparing Defender for Endpoint P1 & P2 with Defender Servers P1 & P2

2 answers

Your answer