How Do I License Microsoft Defender for Endpoint?

• Microsoft Defender for Endpoint offers endpoint detection and response capabilities for Windows and other OSs.
• Good options exist for licensing assigned devices, such as knowledge worker PCs and servers.
• No good option exists for licensing shared devices, and customers may need to ask Microsoft for an exception.

The Microsoft Defender for Endpoint service offers endpoint protection features such as antimalware and endpoint detection and response (EDR) on Windows, macOS, and Linux clients, and Windows Server and Linux servers. More limited capabilities are available on mobile clients such as iOS and Android. The service is licensed depending on the plan chosen, the type of device protected, and how the device is allocated to users. The Defender for Endpoint service can be licensed relatively easily as a part of Microsoft 365 suites for client devices given to knowledge workers and frontline workers. Licensing for servers is more complex, requiring Defender for Servers subscriptions. For shared devices not used by frontline or knowledge workers with appropriate per-user subscriptions, there is no good licensing option today. Defender for Endpoint does not offer license compliance enforcement on desktop and server OSs, which means the customer is responsible for licensing and deploying the software correctly and demonstrating compliance in the event of an audit.