What Does Microsoft Defender for Business Actually Protect?
Microsoft Defender for Business provides endpoint detection and response for Windows and macOS devices, with lighter protection for iOS and Android. On Windows - where the threat surface is highest for most Australian SMBs - it delivers real-time antivirus, behavioural analysis, automated investigation and remediation, and attack surface reduction rules. It does not protect your email (that is Defender for Office 365), your network infrastructure, your cloud applications, or your on-premises servers. For a business whose primary endpoint risk is ransomware and phishing-delivered malware on Windows devices, it covers the most important ground.
What Defender for Business protects
- 01
Windows devices
Defender for Business provides full endpoint detection and response (EDR) for Windows 10 and Windows 11 devices. This includes real-time antivirus and antimalware protection, behavioural analysis that detects suspicious activity patterns (not just known malware signatures), automated investigation when suspicious activity is detected, automated remediation to isolate or remove threats without manual intervention, and attack surface reduction rules that block common attack vectors like Office macro execution and credential theft attempts.
- 02
macOS devices
Defender for Business supports macOS through the Defender for Endpoint macOS client. Capabilities include real-time protection, EDR, and network protection. The feature set is broadly comparable to Windows, though some Windows-specific controls (like attack surface reduction rules tied to Windows behaviours) do not apply. macOS onboarding requires additional configuration steps compared to Windows.
- 03
iOS devices
On iOS, Defender for Business provides web protection (blocking access to known malicious URLs), jailbreak detection, and vulnerability assessment. Full EDR comparable to desktop platforms is not available on iOS due to Apple's platform restrictions on background processes. Deployment is through Microsoft Intune.
- 04
Android devices
Android support includes web protection, network protection, phishing detection, and malware scanning. Android devices can be enrolled as managed devices through Intune with Defender deployed as a required application. Similar to iOS, the level of protection is less comprehensive than Windows/macOS EDR due to platform differences.
Key capabilities in detail
- Endpoint detection and response (EDR): continuous monitoring of device activity. When a threat is detected, Defender records the attack chain - what ran, what it accessed, what it changed - providing the forensic information needed to understand scope and contain the incident.
- Automated investigation and remediation: when Defender detects suspicious activity, it automatically investigates the scope of the potential incident and, where confidence is high, remediates without requiring manual action. For SMBs without a security operations team, this automation is the feature that makes Defender genuinely practical.
- Threat and vulnerability management: Defender continuously assesses devices for known vulnerabilities in installed software and operating systems, missing patches, and security misconfigurations. The Microsoft 365 Defender portal shows a risk score and prioritised remediation recommendations.
- Attack surface reduction rules: a set of configurable policies that block behaviours commonly used in attacks - blocking Office applications from spawning child processes, blocking credential theft from the Windows Local Security Authority, blocking executable content from email attachments.
- Network protection: blocks outbound connections to known malicious domains and IP addresses from the device.
- Device isolation: when an incident is confirmed, Defender can isolate a device from the network while maintaining connectivity to the Defender management console, containing the incident while investigation continues.
What Defender for Business does not protect
Defender for Business is an endpoint security product. It protects the devices it is deployed on. It does not protect everything in your environment:
Defender for Business scope and limitations
| Area | Defender for Business coverage | Alternative |
|---|---|---|
| Windows devices | Full EDR | Included |
| macOS devices | Full EDR | Included - requires onboarding |
| iOS devices | Web protection, jailbreak detection | Limited by Apple platform |
| Android devices | Web and network protection, malware scanning | Better than iOS but less than desktop |
| Email threats | Not covered | Defender for Office 365 (included in Business Premium) |
| Cloud application monitoring | Not covered | Defender for Cloud Apps (E5 only) |
| Network infrastructure (routers, switches, firewalls) | Not covered | Separate network security appliance |
| On-premises servers not enrolled in Defender | Not covered | Defender for Servers (Azure add-on) |
| Identity attacks (Active Directory) | Not covered | Defender for Identity (separate product) |
| Third-party SaaS applications | Not covered | Defender for Cloud Apps or third-party CASB |
Defender for Business vs third-party endpoint products
The most common alternatives to Defender for Business for Australian SMBs are CrowdStrike Falcon Go, SentinelOne Singularity, and Sophos Intercept X. All provide EDR capabilities broadly comparable to Defender for Business.
The case for Defender for Business over third-party alternatives in a Business Premium environment is primarily about integration and cost. Defender for Business is included in Business Premium at no additional cost. Its alerts flow directly into the Microsoft 365 Defender portal alongside email security alerts from Defender for Office 365. It integrates natively with Intune for deployment and policy management. There is no additional agent to deploy, no separate vendor relationship, and no separate console to monitor.
Third-party products may offer advantages in specific areas: more granular threat hunting capabilities, cross-platform support for Linux or older Windows versions, or specific compliance certifications required by certain industries. For most Australian SMBs on Business Premium, Defender for Business is the right starting point - and the right ongoing choice if the environment is well-configured.
Defender for Business deployed and configured is substantially more effective than Defender for Business installed but not configured. Key configuration steps: onboarding all devices (not just Windows), enabling attack surface reduction rules, configuring network protection, reviewing and acting on the threat and vulnerability management recommendations. Many businesses have Defender for Business present on devices but running with default-only settings.
Sources & accuracy
Last reviewed: 5 October 2026 · Microsoft product capabilities, licensing and configuration options change regularly. Verify current details at learn.microsoft.com.
Next step
Cloud Security Baseline
The Cloud Security Baseline deploys and configures Microsoft Defender for Business across your environment - device onboarding, attack surface reduction rules, network protection, and integration with your Intune and Conditional Access configuration.
Learn more