Microsoft Defender
Endpoint security
Proactively defend and disrupt across all of your devices.
Discover what's coming to Microsoft Ignite, Nov 17-20, 2026.
OVERVIEW
Disrupt ransomware on any platform
- Automatically stop and defend during active attacks to stop adversaries from pivoting to your highest-value assets.
- Minimize vulnerabilities and keep threats out with a clear view of your entire attack surface, adversaries, and attack paths, along with best-practice prevention guidance.
- Industry-leading, comprehensive endpoint protection trusted more than any other solution to prevent, disrupt, and block the most sophisticated threats.
CAPABILITIES
Prevent, contain, and block threats
Attack disruption
Stop attackers in their tracks and proactively block their next moves during an active attack with groundbreaking autonomous protection capabilities.
Vulnerability management
Defender provides a single view of your entire attack surface, adversaries, and attack paths, and delivers tailored recommendations based on global threat intelligence, real-time data and visibility your estate.
Simplified endpoint management
Microsoft Defender is easy to deploy, manage, and customize for specific needs, so teams can move faster and focus on protection.
Microsoft Threat Intelligence
Defender transforms the world's most extensive security signals into actionable, AI-driven defense. Surface threat intelligence instantly across alerts, investigations, hunting, and dashboards from over 100 trillion signals per day.
Flexible enterprise controls
Balance protection and productivity with granular controls for settings, policies, web and network access, detections, and automated workflows.
Custom data collection
Defender is the only endpoint solution that allows security teams to meet specific telemetry needs by optimizing their data collection right within the portal, without needing to rely on fragmented solutions.
Simplified endpoint management
Streamline security and IT collaboration using unified endpoint management to prevent confusion, misconfigurations, and potential security gaps.
BENEFITS
Disrupt ransomware with industry-leading, AI-powered endpoint security
Gain comprehensive protection across all devices and platforms for unmatched, cross-domain visibility across your organization.
30
seconds average time to disrupt ransomware
110,000
incidents disrupted per month
2.7M
devices saved from an attack in the last six months
Pricing
Explore Microsoft Defender Suite
Get endpoint security capabilities as part of the Defender Suite, along with email and collaboration, identity, and SaaS protection for comprehensive threat protection.
Microsoft Defender Suite
USD$12.00
user/month, paid yearly
(Annual subscription—auto renews)
Requires: Microsoft 365 E3; or Office 365 E3 and Enterprise Mobility + Security E3.
Requires: Microsoft 365 E3; or Office 365 E3 and Enterprise Mobility + Security E3.
Price does not include tax.
(Annual subscription—auto renews)
Requires: Microsoft 365 E3; or Office 365 E3 and Enterprise Mobility + Security E3.
Requires: Microsoft 365 E3; or Office 365 E3 and Enterprise Mobility + Security E3.
Price does not include tax.
This product is not available in your market.
Provides end-to-end threat protection and helps security teams investigate and respond faster.
Features:
Features:
- Email and collaboration security
- Endpoint security
- Identity security
- SaaS security
- Extended detection and response (XDR)
Looking for small business? Explore the Defender Suite for small or mid-sized businesses.
RELATED PRODUCTS
Our products work better together
Help secure every facet of your business with comprehensive security solutions.
Industry recognition
Microsoft is recognized as an Endpoint Protection Leader
- Microsoft was named a Leader in the 2026 Gartner® Magic Quadrant™ for Endpoint Protection Platforms.2
- Microsoft was named a leader in the 2026 IDC MarketScape for Worldwide Modern Endpoint Security for Enterprises.
- Microsoft is named a Leader in the Forrester Extended Detection and Response Platforms Wave™ 2026.
CUSTOMER STORIES
See how customers are securing endpoints
RESOURCES
Dive into Defender
Resource Library
Cybersecurity and AI news
Discover the latest trends and best practices in cyberthreat protection and AI for cybersecurity.
Frequently asked questions
- Microsoft Defender provides comprehensive, cloud-native endpoint security that delivers visibility and AI-powered cyberthreat protection to help stop cyberattacks across Windows, macOS, Linux, Android, iOS, and IoT devices. Built on broad cyberthreat and human intelligence insights, Defender can seamlessly evolve your security with XDR-level alert correlation to automatically disrupt sophisticated cyberthreats such as ransomware. Microsoft Defender provides visibility into devices in your environment and offers exposure management to help you better understand your cyberattack surface. It delivers attack disruption, vulnerability management, endpoint detection and response, antivirus protection, investigation, and advanced hunting in a single platform. With Microsoft Defender, customers can discover and secure endpoint devices across a multiplatform enterprise.
- Yes, Defender endpoint security is fully integrated into the Microsoft Defender portal, the broadest native security platform in the industry that uniquely delivers an end-to-end view of an attack, with no extra integration required. Many security solutions provide strong protection within individual domains, but operate in silos. Microsoft Defender is built to work across your entire environment—connecting signals from endpoints, identity, email, apps, and cloud. This enables earlier threat prevention, coordinated attack disruption across domains, and continuous improvement of your security posture—reducing reliance on manual response and disconnected tools.
- Yes, Microsoft Defender provides cross-platform endpoint security across Windows, Linux, macOS, iOS, Android, and IoT devices. New features or capabilities are typically provided on operating systems that haven’t yet reached the end of their support lifecycle. In line with industry best practices, Microsoft recommends installing the latest available security patches for any operating system.
- No. Security analysts manage endpoint security from the Microsoft Defender portal, a single console for comprehensive endpoint protection, including vulnerability management, attack disruption, advanced hunting, and detection and response capabilities. For customers wanting to operate their security and IT teams in tandem, Microsoft Defender provides a consistent, single source of truth, mirrored in Intune, for managing endpoint security settings across Windows, macOS, and Linux.
- As part of its comprehensive endpoint security capabilities, Microsoft Defender includes Microsoft Defender Antivirus, next-generation protection that reinforces the security perimeter of your network. It detects and blocks known and evolving cyberthreats in real time across Linux, macOS, Windows, and Android devices. Microsoft Defender Antivirus includes:
• Real-time antivirus protection with always-on scanning that uses file and process-behavior monitoring and other heuristics. It also detects and blocks apps that are deemed unsafe but might not be detected as malware.
• Cloud-delivered protection with near-instant detection and blocking of new and emerging cyberthreats.
Microsoft Defender has consistently demonstrated top-tier protection in independent AV testing. It was an AV-Test “Top Product” throughout 2024 and into 2025, and received multiple awards from AV-Comparatives for its effectiveness in both enterprise and consumer scenarios. In addition, Defender has maintained a triple AAA rating in SE Labs quarterly testing. - Microsoft has long invested in safe deployment practices and established a robust model for delivering endpoint security updates to customers. In addition, customers have full control over how updates are delivered and how controls are applied to their device estate. This model of shared control helps ensure security and resiliency.
Get started
Protect everything
Make your future more secure. Explore your security options today.
- [1]A Microsoft 365 Family or Personal subscription is required. Note that Microsoft Defender is not available in certain Microsoft 365 Personal or Family regions.
- [2]Gartner, Magic Quadrant for Endpoint Protection Platforms, Evgeny Mirolyubov, Deepak Mishra, Franz Hinner. July 14, 2025.
Gartner is a registered trademark and service mark and Magic Quadrant is a registered trademark of Gartner, Inc. and/or its affiliates in the U.S. and internationally and are used herein with permission. All rights reserved..
This graphic was published by Gartner, Inc. as part of a larger research document and should be evaluated in the context of the entire document. The Gartner document is available upon request from.
Gartner does not endorse any vendor, product or service depicted in its research publications, and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner research publications consist of the opinions of Gartner’s research organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose. - [3]The Forrester Wave™: Extended Detection And Response Platforms, Forrester Research, Inc., June 2, 2024.
Forrester does not endorse any company, product, brand, or service included in its research publications and does not advise any person to select the products or services of any company or brand based on the ratings included in such publications. Information is based on the best available resources. Opinions reflect judgment at the time and are subject to change. For more information, read about Forrester’s objectivity here.
Follow Microsoft Security