Microsoft Defender for Endpoint licenses include protection for up to 5 devices per user license. This does not include servers, which must be licensed separately.

Microsoft Defender for Office 365 provides comprehensive protection against email-based threats, as well as security for your collaboration tools including Microsoft Teams, SharePoint, and OneDrive.

Microsoft 365 E5 is a comprehensive enterprise subscription that combines productivity, identity, device, and security capabilities in one license. In addition to Microsoft Security, it includes Microsoft 365 Apps, Exchange, SharePoint, Teams, advanced compliance, and identity protection.

Microsoft Defender Suite is a security focused on threat protection and detection and response across endpoints, identities, email, and SaaS apps. It delivers Microsoft Defender capabilities without the productivity or compliance services included in Microsoft 365 E5.

Microsoft Defender XDR is not a standalone offering. XDR capabilities are included with eligible Microsoft plans and supported Defender products; for standalone offerings, Defender for Endpoint Plan 2 and Defender for Office 365 Plan 2 are required, and XDR capabilities are automatically enabled when multiple Defender workloads are in use.

Automatic attack disruption autonomously contains sophisticated attacks while they’re still in progress. It is a core capability built into the individual Defender solutions. The more solutions an organization has deployed, the more disruption scenarios are unlocked. Autonomic attack disruption is included with Defender for Endpoint Plan 2, Defender for Cloud Apps, Defender for Identity, Defender for Office 365 Plan 2 and suites that include these products. Microsoft 365 E5/A5, Microsoft Defender Suite, EMS E5/A5.