[advisory]Illustrative ranges only. Pricing ranges and examples on this page are illustrative market ranges aggregated from public industry research. They are not quotes, not vendor-specific, and should not be used as a basis for procurement decisions. Always request a direct quote from the vendors you shortlist.
Microsoft Defender XDR is the rare XDR with genuine published per-user list pricing. The catch is that “Defender XDR” is not one SKU; it is a stack of per-user products plus separate server and cloud workload lines, and most enterprises acquire it bundled inside Microsoft 365 E5 rather than buying the parts. Figures below are Microsoft public list prices verified June 2026. The real cost question is rarely the sticker; it is whether you would buy E5 anyway.
The per-user Defender XDR stack
| Component | Per user / month | Covers |
|---|---|---|
| Defender for Endpoint P2 | $5.20 | Endpoint EDR and threat analytics |
| Defender for Office 365 P2 | $5.00 | Email and collaboration threat protection |
| Defender for Identity | $5.50 | Identity-based attack detection |
| Defender for Cloud Apps | $5.00 | SaaS / CASB visibility and control |
| Standalone stack | ~$23.20 | User-facing Defender XDR (servers / cloud extra) |
Microsoft public list prices, June 2026. The same four products are bundled inside Microsoft 365 E5 (~$57 per user per month) and the E5 Security add-on on an E3 base (~$12 per user per month). Server and cloud-workload protection (Defender for Servers, Defender for Cloud) is billed separately. See /sources.
Four worked cost scenarios
Annual cost of the user-facing Defender XDR stack by acquisition route, before server and cloud-workload protection. The standalone column uses $23.20 per user per month.
| Users | Standalone stack / yr | E5 Security add-on / yr | Already on E5 |
|---|---|---|---|
| 250 | $69,600 | $36,000 | $0 incremental |
| 1,000 | $278,400 | $144,000 | $0 incremental |
| 5,000 | $1,392,000 | $720,000 | $0 incremental |
| 25,000 | $6,960,000 | $3,600,000 | $0 incremental |
The “already on E5” column is why Microsoft-stack shops rarely buy a third-party XDR: the licence is sunk. Add Defender for Servers (around $15 per server per month) and Defender for Cloud for non-user assets.
Five optimisations that genuinely cut the Defender bill
- Check what your E3 or E5 already includes. The single most common Defender overspend is buying standalone components a tenant already has bundled. Audit the licensing before adding any Defender SKU.
- Use the E5 Security add-on, not full E5, for security-only needs. At around $12 per user per month on an E3 base it delivers the same Defender XDR stack for roughly half the full-E5 sticker.
- Right-size Defender for Servers plans. Plan 1 covers core server EDR; Plan 2 adds vulnerability management and more. Many estates over-buy Plan 2 where Plan 1 suffices.
- Tune Defender for Cloud resource scope. Defender for Cloud bills per protected resource type. Disabling plans on resource types you do not run avoids silent per-resource charges.
- Negotiate the E5 enterprise agreement. Microsoft EA and CSP pricing moves with commit size; the $57 list is a ceiling, not a floor, for large estates.
Right pick when
- You already license Microsoft 365 E5; Defender XDR is effectively free.
- Your estate is predominantly Windows and Microsoft 365.
- You want identity, email, endpoint, and SaaS detection from one vendor.
- You value tight integration with Entra, Intune, and Sentinel.
Wrong pick when
- Your endpoint estate is heavily macOS, Linux, or mixed and non-Microsoft.
- You are not on E5 and do not want to be; the standalone stack loses its cost edge.
- You want a single agent independent of Microsoft licensing changes.
- You need detection depth in areas Microsoft does not lead and a best-of-breed agent matters more than bundle economics.
// Q&A appendix
Frequently asked questions
01.How much does Microsoft Defender XDR cost per user in 2026?+
Microsoft Defender XDR is unusual in publishing real per-user list prices. Bought standalone, the user-facing stack lists at roughly $23.20 per user per month: Defender for Endpoint Plan 2 at $5.20, Defender for Office 365 Plan 2 at $5.00, Defender for Identity at $5.50, and Defender for Cloud Apps at $5.00. Most enterprises instead get the full stack inside Microsoft 365 E5 at around $57 per user per month, where Defender XDR is bundled with the rest of the E5 productivity and security suite. Server and cloud-workload protection (Defender for Servers, Defender for Cloud) is billed separately on top.
02.Is Defender XDR included in Microsoft 365 E5?+
Yes. Microsoft 365 E5, at around $57 per user per month, bundles Defender for Endpoint Plan 2, Defender for Office 365 Plan 2, Defender for Identity, and Defender for Cloud Apps, which together form the user-facing Defender XDR stack. If you already license E5 for productivity reasons, the marginal cost of Defender XDR is effectively zero, which is why E5 shops rarely shortlist a third-party XDR. The E5 Security add-on (around $12 per user per month on an E3 base) is the cheaper route to the same Defender stack without full E5.
03.Is it cheaper to buy Defender XDR standalone or via E5?+
If you only want the security stack and not E5 productivity, the standalone components at roughly $23.20 per user per month, or the E5 Security add-on on an E3 base at around $12 per user per month, are cheaper than jumping to full E5 at $57. If you would buy E5 anyway for Teams, productivity, and compliance, Defender XDR rides along at no marginal cost. The decision turns on whether you value the rest of E5, not on the security stack alone.
04.Does Defender XDR cover servers and cloud workloads in the per-user price?+
No. The per-user Defender XDR stack covers user endpoints, email, identity, and SaaS apps. Server and cloud-workload protection is Defender for Servers and Defender for Cloud, billed separately, typically per server per month (Defender for Servers Plan 2 lists around $15 per server per month) or per resource. Environments with large server estates or heavy cloud footprints should add these lines, which can materially exceed the user-licence cost.
05.What does Defender XDR cost for a 1,000-user organisation?+
A 1,000-user standalone Defender XDR stack lands near $278,000 per year at the $23.20 per-user-per-month list, before server and cloud workload protection. Via the E5 Security add-on on an E3 base it is closer to $144,000 per year. If the organisation already licenses Microsoft 365 E5 for productivity, the incremental Defender XDR cost is effectively zero. Add Defender for Servers and Defender for Cloud for non-user assets.
06.Is Defender XDR worth it over a third-party XDR?+
Defender XDR is the default economic choice for any organisation already standardised on Microsoft 365 E5, because the licence is largely already paid. It is worth evaluating a third-party XDR (Cortex, Falcon, SentinelOne) when your endpoint estate is heavily non-Windows, when you need detection depth Microsoft does not lead on, or when you want a single agent independent of Microsoft licensing changes. For Microsoft-stack shops, the cost advantage of Defender XDR is hard to beat.