Hi @milo last , Defender for Endpoint and Defender for Servers both provide endpoint protection, but they have different features and capabilities. Defender for Endpoint is a cloud-based solution that provides advanced endpoint protection, including endpoint detection and response (EDR) capabilities. It requires an internet connection to function properly. On the other hand, Defender for Servers is an on-premises solution that provides endpoint protection for servers. It does not require an internet connection to function properly.

If your servers have no connectivity to the internet, Defender for Servers would be the better choice for you. It provides endpoint protection for servers without requiring an internet connection. However, if you have some servers that can connect using a proxy, you can use Defender for Endpoint for those servers.

It's important to note that if you choose Defender for Servers, you will not have access to the advanced EDR capabilities provided by Defender for Endpoint. However, Defender for Servers does provide basic endpoint protection for servers, including antivirus and antimalware protection.

If you have servers with no internet connectivity, Defender for Servers would be the better choice for you. If you have some servers that can connect using a proxy, you can use Defender for Endpoint for those servers.

Please let me know if you have any questions and I can help you further.

If this answer helps you please mark "Accept Answer" so other users can reference it.

Thank you,

James

🌐
Xcitium
xcitium.com › is-microsoft-defender-is-edr
Is Microsoft Defender is EDR? | Microsoft End Point Defender
Even it lets identify and prevent a file-less attack. ... Microsoft Defender for Endpoint is an EDR because it lets your team detect, investigate and respond to threats all across your endpoints.
🌐
Reddit
reddit.com › r/defenderatp › microsoft defender for endpoint vs. windows defender - differences from endpoint's perspective
r/DefenderATP on Reddit: Microsoft Defender for Endpoint vs. Windows Defender - differences from Endpoint's perspective
January 10, 2024 -

How does the experience from a device or endpoint's perspective differ between a paid MDE subscription and native/free Windows Defender?

My specific question using an example: If I were sitting down at a Windows 11 machine, is there a CLI command (ideally powershell) that I could run that would tell me if I were on a paid MDE version (and ideally which one P1|P2|etc) vs the native?

My general question is: what GUI or other end user experiences would be different with using a paid MDE version? If I were prepping my end users for a migration from free Windows Defender to paid Microsoft Defender for Business, is there anything I should prep them for (ie, this screen or dialog will look different than what you're used to)?

Top answer
1 of 4
3
Quick and dirty way of checking if your running paid Defender or not would be to look at the running services. Default defender service is called windefend while paid version is called sense. As for which license version i have no idea, id start with running get-mpcomputerstatus and research from there. As for end user experience it should be no different between the two. Perhaps a slightly different looking notification if it flags malware but other than that ¯_(ツ)_/¯
2 of 4
3
From an end user perspective nothing changes really - you will be able to restrict access to certain modules of the Windows security GUI with Intune but this has nothing to do with using Defender. The main differences between free/paid Defender summed up is feature set, granularity, control and centralised management and alerting. You are doing absolutely the right thing by deploying Defender for Business to your organisation - It is a fantastic product and considerably better than the MDE features included in M365 E3 license (you don’t get any of the Defender Vulnerability Management features or EDR) and certainly better than the free version. Deployment is a piece of cake if you are using Intune - if you open the Defender portal and select devices or Settings >> Endpoints it will start the Defender for Business wizard, my only advice here is when asked choose ‘manage your policies with Intune’ as its easier to work with in the long run. If you want any advice on deployment let me know.
Videos
03:01
🌐 YouTube
EDR in block mode | Microsoft Defender for Endpoint - YouTube
November 4, 2022
05:24
🌐 YouTube
Plan 1 vs Plan 2 - Microsoft Defender for Endpoint | EDR NGAV - ...
May 23, 2022
12:24
🌐 YouTube
Crowdstrike vs Microsoft Defender for Endpoint ATP | Top EDR |SOC ...
May 2, 2021
11:46
🌐 YouTube
CrowdStrike vs. Microsoft Defender for Endpoint Comparison - YouTube
March 28, 2025
37:05
🌐 YouTube
Secure Your Devices with Defender for Endpoint - Part 1 - YouTube
November 1, 2024
7.99K
13:56
🌐 YouTube
Microsoft Defender for Endpoint: The Simplified Way! - YouTube
June 9, 2023
45.2K
View all
View all
🌐
Microsoft Learn
learn.microsoft.com › en-us › answers › questions › 1659264 › choosing-between-defender-for-endpoint-and-defende
Choosing between Defender for Endpoint and Defender for Server for servers with no internet connectivity - Microsoft Q&A
Top answer
1 of 1
3

Hi @milo last , Defender for Endpoint and Defender for Servers both provide endpoint protection, but they have different features and capabilities. Defender for Endpoint is a cloud-based solution that provides advanced endpoint protection, including endpoint detection and response (EDR) capabilities. It requires an internet connection to function properly. On the other hand, Defender for Servers is an on-premises solution that provides endpoint protection for servers. It does not require an internet connection to function properly.

If your servers have no connectivity to the internet, Defender for Servers would be the better choice for you. It provides endpoint protection for servers without requiring an internet connection. However, if you have some servers that can connect using a proxy, you can use Defender for Endpoint for those servers.

It's important to note that if you choose Defender for Servers, you will not have access to the advanced EDR capabilities provided by Defender for Endpoint. However, Defender for Servers does provide basic endpoint protection for servers, including antivirus and antimalware protection.

If you have servers with no internet connectivity, Defender for Servers would be the better choice for you. If you have some servers that can connect using a proxy, you can use Defender for Endpoint for those servers.

Please let me know if you have any questions and I can help you further.

If this answer helps you please mark "Accept Answer" so other users can reference it.

Thank you,

James

🌐
Reddit
reddit.com › r/msp › av+edr/mdr vs microsoft defender vs others options
r/msp on Reddit: AV+EDR/MDR vs Microsoft Defender vs others options
May 10, 2025 -

Hello community!

Lately, I've noticed a lot of discussions and cases on Reddit and elsewhere about bypassing EDR and Antivirus solutions. There are reports of servers being encrypted despite the presence of XDR/MDR functions from manufacturers, etc. This raises several questions for me, especially about moving all security stacks to Microsoft 365, particularly for clients with a Business Premium subscription. I'm having trouble forming a clear opinion on this.

On one hand, it seems like putting all your eggs in one basket, right? On the other hand, solutions combining AV+EDR with a service like BlackPoint seem more robust to me. Or maybe it would be wiser to have one provider for AV, another for EDR, and yet another for MDR? I also have questions about integrating an MDR solution within the same solution as AV and EDR.

I'm not sure if there's already a thread on this topic; if there is, I'd appreciate the link! What do you think?

Thanks for your insights!

Top answer
1 of 5
10
I like to spread and hand off. We use Huntress for MDR and AV, and ITDR. Our EDR and AV end up being separate vendors (Cause Huntress wraps around Window Defender), but for clients with a premium license in MS, we can still leverage WDE through Huntress. Usre, ITDR is also Huntress, but it's concise enough that I don't feel like I'm lacking diversity. Get a managed provider is def a smart idea for many MSPs. We dont have a lot of people who can monitor and respond, and if our full staff did have a strong ability to do this, our client base would probably be too much noise for us to stay on top of. Going the Huntress or Blackpoint route is great as it gives us a full SOC. Some spread is nice, but it think getting a provider with a SOC is not too much of one basket. I would advise against going full fortinet with Firewall, ap, switches, edr, etcs... I don't think you NEED a separate edr, av, itdr, and soc provider. Just something that can leverage current tools seems like enough spread.
2 of 5
4
So we do a layered approach for this exact reason: S1 Complete, Huntress, ThreatLocker, and lastly Bluemira SIEM+
🌐
CrowdStrike
crowdstrike.com › en-us › blog › crowdstrike-vs-microsoft-defender-for-endpoint
CrowdStrike vs. Microsoft Defender for Endpoint: Comparing EDR Tools
September 23, 2024 - If/when the parent company falls behind and keeps older, unsupported infrastructure in place, it will be forced to either upgrade the infrastructure or live with Microsoft’s limited security support of the last patch date. When all calculations were complete, Defender required more frequent infrastructure investments than CrowdStrike.
🌐
E-N Computers
encomputers.com › home › can microsoft defender replace your edr solution?
Can Microsoft Defender replace your EDR solution? - E-N Computers
January 22, 2025 - Yes, Defender can replace a third-party EDR solution for many businesses, and in most cases, we think its the better choice. This is especially true if you are already using Microsoft 365 or need to meet cybersecurity compliance requirements.
🌐
Microsoft Learn
learn.microsoft.com › en-us › answers › questions › 1191313 › difference-between-microsoft-endpoint-protection-a
Difference between Microsoft Endpoint Protection and Microsoft Defender Antivirus - Microsoft Q&A
Essentially Windows Defender is the Anti-virus program and other components together with Windows Defender is called Windows Security.
🌐
Reddit
reddit.com › r/cybersecurity › both windows defender + edr on endpoints, worth it?
r/cybersecurity on Reddit: Both Windows Defender + EDR on endpoints, worth it?
May 25, 2022 -

Hey guys!

A pen testing firm has given the recommendations of deploying both Windows Defender AND the EDR on all endpoints for maximum protection.

Im somewhat skeptical of this (mostly for compatibility and performance-related issues) and i'd like to hear the community opinion here.

Are you guys deploying both products on your endpoints? If so, how did it go?

EDIT : I meant the built-in comes with every OS install Windows Defender not the defender package. It would be built-in + something like Crowdstrike or Sentinel One.

Top answer
1 of 11
4
If your talking windows systems then defender is already there, the EDR piece talks to the built on defender piece. On Linux it seems to be fine with the MDE installer, it can slow down performance on build machines so we use a separate EDR solution that is more light weight however that is at the cost of fully logging what is happening on the system. Overall I haven’t found Defender EDR to be cumbersome at all from a performance perspective on 90% of our environment. It obviously depends on your policies for how regularly you scan and the cap on CPU resources as well as time of day. Things you naturally will need to work on with any EDR and virus scanning solutions.
2 of 11
4
When you say this, do you mean like Sentinel One or Crowdstrike on top of defender or Defender plan II which includes EDR? If you've got e3 and just regular defender, then yeah, I'd add EDR. Whether you step up to plan 2 or get a sentinel one or cylance or something is a decision you have to make unique to your requirements and environment. In a lot of orgs, this could be a million dollar decision, or even more if you get breached. So it's important to get all your requirements, including endpoint performance and do a bakeoff between potential solutions in your environment.
Find elsewhere
🌐
Reddit
reddit.com › r/defenderatp › question about edr
r/DefenderATP on Reddit: Question about EDR
March 9, 2023 -

I think I'm having a misunderstanding about EDR on Defender.

If I take an out-of-the-box Windows 10 computer without anything applied to it, it won't be EDR correct ?Now If I onboard the computer on Defender with appropriate license, will it have EDR ? How ?

Is it a functionality that gets enabled on the computer (and if so, how do I check ?) or is it just a setting that get switched on the Defender console that reports to the computer and tells it to do some action (meaning that even the default Defender would be able to do it without any extra installation)

The only documentation I find is about EDR in block mode...

EDIT 1 :
Closed.
tl;dr :
There is no visual way to identify the differences between a default Defender and "EDR" Defender for Endpoint other than checking inside Services the "Sense" service or run CMD / Pwsh commands.

Top answer
1 of 4
3
EDR (Endpoint Detection and Response) is a category name for tools, rather than a specific toggle/action in Defender for Endpoint. Out of the box workstation will likely have nothing. Yes. Once you turn on “Defender”, which i presume is Defender AV, you’ll have antivirus rather than EDR. Defender will have some base options enabled and will function, but further config is needed for optimisation and added features. Where it becomes “EDR” is when you combine Defender AV and Defender ATP (old name for the cloud component). You need to onboard and enable ATP (Service name : Microsoft Defender Advanced Threat Protection). The EDR component is really about having an agent that collects data and delivers it to a monitored system where operations staff can respond based off of this data, which is what ATP does when reporting back to the M365 Defender Portal.
2 of 4
2
I was confused about EDR in block mode as well. My new understanding is: The EDR functions of Defender for Endpoint require settings like Cloud-delivered protection and real-time protection on. With these base settings then Defender with cloud-based EDR is automatically enabled. There isn't a requirement to enable the setting called 'EDR in block mode'. No matter how deep I dug into docs and forums I could not find anywhere saying it was needed to enable this when you are using standalone Defender for endpoint The settings called 'EDR in block mode' or passive mode ONLY refer to the scenario where you have a 3rd party AV in use. What it means is that the Defender EDR features would be working alongside the 3rd party AV, and either Defender would just report on what it's EDR features find (passive) or would take action on things it finds (block/active). Now what does that mean for us that have full standalone Defender? Well basically it means that enabling the setting 'EDR in block mode' will do nothing, as far as I could ascertain. But it is an item worth points in secure score so you might be tempted to set it for the points. I decided at the time I had other priorities so didn't bother making the change
🌐
Xcitium
xcitium.com › defender-edr
What is Defender EDR? | Defender for Endpoint Features
Your organization's threat hunters make the most of the threat intelligence tools of Defender EDR. Criminals keep changing tactics, techniques, and procedures (TTPs), thereby bypassing the legacy security system and traditional anti-malware programs. However, when you employ threat intelligence given by Microsoft partners, it is easy to identify TTPs.
🌐
Microsoft Learn
learn.microsoft.com › en-us › defender-endpoint › edr-block-mode-faqs
Endpoint detection and response (EDR) in block mode frequently asked questions (FAQ) - Microsoft Defender for Endpoint | Microsoft Learn
EDR in block mode works just like Microsoft Defender Antivirus in passive mode, except that EDR in block mode also blocks and remediates malicious artifacts or behaviors that are detected.
🌐
Reddit
reddit.com › r/microsoft › microsoft defender for endpoint plan 1 vs microsoft defender for endpoint plan 2
r/microsoft on Reddit: Microsoft Defender for Endpoint Plan 1 vs Microsoft Defender for Endpoint Plan 2
February 5, 2025 -

Got about 400 users that need an endpoint protection plan...Wondering if it is worth paying the difference on Microsoft Defender for Endpoint Plan 1 and get Microsoft Defender for Endpoint Plan 2.... Getting hassled by auditors, I guess reports from sccm on the Microsoft defender that is shipped with windows doesn't cut it any more.

What is the experience out here? Do you have an opinion on either of them, better yet, maybe both? I would like to hear it.

Top answer
1 of 1
6
Looking at this article Defender for Endpoint P1 only had a subset of the Defender for Business features. https://learn.microsoft.com/en-us/defender-business/mdb-faq#what-are-the-differences-between-defender-for-business-and-defender-for-endpoint-plans-1-and-2 If you need an EDR tool, vulnerability management and threat hunting tools, then I would say you need P2.
🌐
Microsoft
microsoft.com › en-us › security › business › security-101 › what-is-edr-endpoint-detection-response
What Is EDR? Endpoint Detection and Response | Microsoft Security
Microsoft Defender for Endpoint is an enterprise EDR designed to help organizations prevent, detect, investigate, and respond to advanced threats.
🌐
PeerSpot
peerspot.com › products › comparisons › microsoft-defender-for-endpoint_vs_open-edr
Compare Microsoft Defender for Endpoint vs Open EDR
Microsoft is ranked #2 with an average rating of 8.3, while Xcitium is ranked #38 with an average rating of 8.0. Microsoft holds a 8.8% mindshare in EDR, compared to Xcitium’s 1.1% mindshare. Additionally, 95% of Microsoft users are willing to recommend the solution, compared to 100% of Xcitium users who would recommend it. ... Microsoft Defender for Endp...
🌐
Microsoft Learn
learn.microsoft.com › en-us › defender-endpoint › edr-in-block-mode
Endpoint detection and response in block mode - Microsoft Defender for Endpoint | Microsoft Learn
Features like network protection and attack surface reduction rules and indicators (file hash, ip address, URL, and certificates) are only available when Microsoft Defender Antivirus is running in active mode. It is expected that your non-Microsoft antivirus solution includes these capabilities. EDR in block mode works behind the scenes to remediate malicious artifacts that were detected by EDR capabilities.
🌐
Reddit
reddit.com › r/asknetsec › what do you think microsoft defender for endpoint?
r/AskNetsec on Reddit: What do you think Microsoft Defender for Endpoint?
March 11, 2023 -

Hi there!

  1. Have you used Microsoft Defender for Endpoint? What has been your experience with it?

  2. In your opinion, what are the benefits of using Microsoft Defender for Endpoint over other endpoint protection solutions?

  3. What are the potential drawbacks or limitations of using Microsoft Defender for Endpoint?

  4. How effective do you think Microsoft Defender for Endpoint is at detecting and mitigating threats?

  5. How does Microsoft Defender for Endpoint compare to other endpoint protection solutions in terms of ease of use and manageability?

Also, I'm not very well familiar with Microsoft licenses and products, but I'm not sure I understand what is Microsoft Defender for Endpoint.

It is an additional sensor/add-on that upgrade default Microsoft Defender Antivirus or is it a separate, self-contained product?

We have around 6000 endpoints (Windows 30%, Linux 69% and MacOS 1%).

How much would it cost and are there any discounts? Who has dealt with this?

Top answer
1 of 11
25
Currently work at a company that is 95% Windows. Defender for Endpoint has been surprisingly good at detecting threats on Windows. Seen lots of false positives on our Linux systems though. Their UI has its positives and negatives. The timeline doesnt show everything their Advanced Hunting logs show and vice versa. But their investigation UI is crap compared to Crowdstrike and Sentinel One. If you see a suspicious process in Defender, you cant find out network connections and files dropped by the process easily in the UI. You have to go to the Advanced Hunting logs. Their alert/incident views are okay, but not as useful as Crowdstrike's. It also seems to require other Microsoft solutions like SCCM or Intune to deploy, which isnt the case for Crowdstrike. If you're using the rest of the Microsoft infrastructure for e-mail, identity, etc then Defender makes a lot of sense. If not, then its adequate but not best in class, like most of Microsoft's products. I'd look around in your case since you're 70% Linux/Mac.
2 of 11
9
I work in a place that just cut 6k+ windows workstations over to it and an additional 7k+ servers. We manage workstations with Intunes and policy management there is pretty simple. For servers we use MECM as tenant attached and all policy is done in Intunes via MECM Server Collections. For detecting threats, I think it’s pretty great but I’m in a full Defender XDR shop. So email, endpoint, MCAS, Identity, Cloud, etc. everything except IoT. My biggest drawback right now is towards servers. Sometimes it feels that defender isn’t honoring the path exclusions I give it and then MsSense is locking up our files and those files exclusions are managed by the Defender product team. Not even support has access to it. Neither do the admins of the tenant which is BS. We onboarded all of our windows servers using Azure ARC with defender for cloud servers P1. This will auto install the MDE agent for you. The sticker price is $5/server/month but with our E5 agreement, we got it at $2.50. But again, we are all defender xdr and sentinel siem. For detecting threats, I was reviewing a pentest recommendations and thought it was kinda BS because of the previous EPP we had (Cb). So I proved to some people at work that the remediation doesn’t matter now. I copy/pasted malicious powershell into my notepad and defender immediately quarantined the file. It wasn’t even saved yet. That was pretty cool to demonstrate. There are a lot of bells and whistles to it so I would say make sure you understand all of it. And speak to your msft reps to speak with a product owner. Not the sales specialist. The product owners will give you the real meat and potatoes of the solution and the sales folks are contoso demo monkies. For Linux servers, use Ansible to manage the policies via the managed.json file. Also for licensing, I think it’s just P1 or P2 through defender for cloud. This is where combining Azure ARC + Defender for Cloud
🌐
Gartner
gartner.com › reviews › market › endpoint-protection-platforms › compare › product › acronis-endpoint-detection-and-response-edr-vs-microsoft-defender-for-endpoint
Acronis Endpoint Detection and Response (EDR) vs Microsoft Defender for Endpoint 2025 | Gartner Peer Insights
Based on verified reviews from ... (EDR) has a rating of 4.9 stars with 13 reviews. Microsoft Defender for Endpoint has a rating of 4.4 stars with 1889 reviews....
🌐
Microsoft Learn
learn.microsoft.com › en-us › azure › defender-for-cloud › integration-defender-for-endpoint
Defender for Endpoint integration in Defender for Cloud - Microsoft Defender for Cloud | Microsoft Learn
Endpoint detection and response (EDR): EDR detects, investigates, and responds to advanced threats, including advanced threat hunting, and automatic investigation and remediation capabilities.
🌐
Guardz
guardz.com › home › blog › is defender for endpoint an edr?
Is Defender for Endpoint an EDR? | Guardz.com
March 25, 2025 - Microsoft Defender for Endpoint is an advanced security solution that helps organizations protect their devices and networks from sophisticated cyber threats. With the increasing number of endpoints and the evolving threats within cybersecurity, having a comprehensive endpoint detection and response (EDR...
🌐
Microsoft
microsoft.com › en-us › security › business › security-101 › edr-vs-xdr
EDR vs. XDR: What Is the Difference? | Microsoft Security
With EDR, security teams can monitor endpoints in real time, analyze data, and develop a detailed understanding of each individual device. Depending on the risk profile, security needs, and existing digital infrastructure of your business, XDR systems, like Microsoft Defender XDR, may be a better fit.