[advisory]List reference prices. The figures on this page are the vendor’s published list or reference prices, not negotiated quotes. Actual pricing varies with volume, contract term, and reseller discount, and should not be used as a basis for procurement decisions. Always request a direct quote from the vendors you shortlist.
Microsoft is one of the few XDR vendors with published per-user list prices. The catch is that “Defender XDR” is not one SKU: it is a stack of Defender products that Microsoft now sells as a bundle, either as the Microsoft Defender Suite add-on at $12 per user per month on a Microsoft 365 E3 base, or inside Microsoft 365 E5 at $60. Server and cloud-workload protection is billed separately. Microsoft 365 E5 rose from $57 to $60 on 1 July 2026 (E3 rose from $36 to $39 in the same move); existing agreements keep the prior rate until renewal. The real cost question is rarely the sticker; it is whether you would buy E5 anyway.
What Microsoft publishes per user
| Product | Per user / month | What it carries |
|---|---|---|
| Microsoft Defender Suite | $12.00 | Defender for Endpoint, Office 365, Identity and Cloud Apps as one add-on. Requires Microsoft 365 E3, or Office 365 E3 with EMS E3. |
| Microsoft 365 E5 | $60.00 | The full Defender stack plus E5 productivity, compliance and Teams ($51.45 without Teams). |
| Defender for Office 365 Plan 2 | $5.00 | Email and collaboration protection on its own (Plan 1 is $2.00). |
| Defender for Endpoint, Identity, Cloud Apps | Not shown | Microsoft’s product pages now sell these through Defender Suite and E5, with no standalone price. |
Microsoft US list prices, paid yearly, checked 30 October 2026 on microsoft.com security pricing, the Defender product pages and the Microsoft 365 E5 page. Microsoft Defender Suite was called the E5 Security add-on until October 2025. Server and cloud-workload protection (Defender for Servers, Defender for Cloud) is billed separately. See /sources.
Four worked cost scenarios
Annual cost of the user-facing Defender XDR stack by acquisition route, before server and cloud-workload protection. The add-on column is users times $12 times 12 months, on top of your E3 licences.
| Users | Defender Suite on E3 / yr | Already on E5 |
|---|---|---|
| 250 | $36,000 | $0 incremental |
| 1,000 | $144,000 | $0 incremental |
| 5,000 | $720,000 | $0 incremental |
| 25,000 | $3,600,000 | $0 incremental |
The “already on E5” column is why Microsoft-stack shops rarely buy a third-party XDR: the licence is sunk. Add Defender for Servers ($0.02 per server per hour for Plan 2 on the Azure retail price list) and Defender for Cloud for non-user assets.
Five optimisations that genuinely cut the Defender bill
- Check what your E3 or E5 already includes. The single most common Defender overspend is buying standalone components a tenant already has bundled. Audit the licensing before adding any Defender SKU.
- Use Defender Suite, not full E5, for security-only needs. At $12 per user per month on an E3 base ($39) it delivers the Defender XDR stack for $51 against $60 for full E5, at list.
- Right-size Defender for Servers plans. Plan 1 covers core server EDR; Plan 2 adds vulnerability management and more. Many estates over-buy Plan 2 where Plan 1 suffices.
- Tune Defender for Cloud resource scope. Defender for Cloud bills per protected resource type. Disabling plans on resource types you do not run avoids silent per-resource charges.
- Negotiate the E5 enterprise agreement. Microsoft EA and CSP pricing moves with commit size; the $60 list (up from $57 on 1 July 2026) is a ceiling, not a floor, for large estates.
Right pick when
- You already license Microsoft 365 E5; Defender XDR is effectively free.
- Your estate is predominantly Windows and Microsoft 365.
- You want identity, email, endpoint, and SaaS detection from one vendor.
- You value tight integration with Entra, Intune, and Sentinel.
Wrong pick when
- Your endpoint estate is heavily macOS, Linux, or mixed and non-Microsoft.
- You are not on Microsoft 365 E3 or E5; Defender Suite needs an E3 base, so the bundle economics fall away.
- You want a single agent independent of Microsoft licensing changes.
- You need detection depth in areas Microsoft does not lead and a best-of-breed agent matters more than bundle economics.
// Q&A appendix
Frequently asked questions
01.How much does Microsoft Defender XDR cost per user in 2026?+
Microsoft sells the Defender XDR stack two ways, both with published US prices. Microsoft Defender Suite, the add-on that brings Defender for Endpoint, Office 365, Identity and Cloud Apps to a Microsoft 365 E3 base, lists at $12.00 per user per month paid yearly. Microsoft 365 E5, which includes the same Defender products alongside the rest of E5, lists at $60.00 per user per month (E5 without Teams is $51.45). Microsoft does not currently show standalone prices for Defender for Endpoint, Defender for Identity or Defender for Cloud Apps. Defender for Office 365 is still sold on its own, at $2.00 for Plan 1 and $5.00 for Plan 2. Server and cloud-workload protection (Defender for Servers, Defender for Cloud) is billed separately.
02.Is Defender XDR included in Microsoft 365 E5?+
Yes. Microsoft 365 E5, at $60 per user per month (up from $57 on 1 July 2026), includes Defender for Endpoint Plan 2, Defender for Office 365 Plan 2, Defender for Identity and Defender for Cloud Apps, which together form the user-facing Defender XDR stack. If you already license E5 for productivity reasons, the marginal cost of Defender XDR is effectively zero, which is why E5 shops rarely shortlist a third-party XDR. Microsoft Defender Suite ($12 per user per month, formerly the E5 Security add-on) is the route to the same Defender stack on an E3 base.
03.Is it cheaper to buy Defender XDR as an add-on or via E5?+
If you only want the security stack, Microsoft Defender Suite at $12 per user per month on top of Microsoft 365 E3 ($39) is cheaper than moving to full E5 at $60: $51 against $60 per user per month at list. If you would buy E5 anyway for Teams, productivity, compliance and the rest, Defender XDR rides along at no marginal cost. The decision turns on whether you value the rest of E5, not on the security stack alone.
04.Does Defender XDR cover servers and cloud workloads in the per-user price?+
No. The per-user Defender XDR stack covers user endpoints, email, identity, and SaaS apps. Server and cloud-workload protection is Defender for Servers and Defender for Cloud, billed separately per protected resource. Defender for Servers Plan 2 is $0.02 per server per hour on the Azure retail price list, about $14.60 for a 730-hour month. Environments with large server estates or heavy cloud footprints should add these lines, which can materially exceed the user-licence cost.
05.What does Defender XDR cost for a 1,000-user organisation?+
Via Microsoft Defender Suite on an E3 base, 1,000 users is $144,000 per year at the $12 per-user-per-month list, before server and cloud workload protection. If the organisation already licenses Microsoft 365 E5 for productivity, the incremental Defender XDR cost is effectively zero. Add Defender for Servers and Defender for Cloud for non-user assets.
06.Is Defender XDR worth it over a third-party XDR?+
Defender XDR is the default economic choice for any organisation already standardised on Microsoft 365 E5, because the licence is largely already paid. It is worth evaluating a third-party XDR (Cortex, Falcon, SentinelOne) when your endpoint estate is heavily non-Windows, when you need detection depth Microsoft does not lead on, or when you want a single agent independent of Microsoft licensing changes. For Microsoft-stack shops, the cost advantage of Defender XDR is hard to beat.