Mixing License Tiers of Defender for Endpoint: Dos and Don’ts

• Potential license compliance problems for Defender for Endpoint customers have existed since P1 arrived.
• Microsoft has been aware of the problem but has offered no solutions up to this point.
• A proposed solution, mixed-mode configurations, can partially help, but it is complex and has flaws as designed.

With the arrival of Defender for Endpoint P1 (a simple antimalware offering included in Microsoft 365 E3), Microsoft introduced a new license-compliance problem for customers who do not license their entire organization for either Microsoft 365 E3 or for Microsoft 365 E5. This issue can frequently arise with customers who have not yet adopted Defender for Endpoint P2 across their entire organizations. This compliance problem exists because Defender for Endpoint performs no compliance checking based on the license assigned to each user, which could obligate the organization to license Microsoft 365 E5 for everyone. “Mixed mode” is a Microsoft-proposed fix to the problem for customers who do use Defender for Endpoint P1, but customers will likely find the solution unworkable. For smaller customers or those standardized on one tier or another, mixed mode may work. But the device-driven nature and arbitrary granularity of mixed mode means that most large customers will find the solution challenging at best, and likely not worth pursuing.