The question has changed
Every business device needs protection against malware and ransomware. That has not changed. The question has. It is no longer only whether you have antivirus, but whether you are buying a second product to do work your Microsoft licences may already cover.
Microsoft Defender Antivirus is built into Windows, and for years it was treated as a placeholder until something else was installed. Microsoft's business security products now build on it with central policy management, device visibility and, depending on the plan, investigation and response.
What your licence includes
The plans are not identical, and the differences matter. The useful question is specific: which capabilities are you licensed for, which devices do they cover and are they working?
- Microsoft 365 Business Premium includes Defender for Business. Microsoft lists endpoint detection and response, automated investigation and remediation, and core vulnerability management among its capabilities.
- Microsoft 365 E3 includes Defender for Endpoint Plan 1: next-generation protection, attack surface reduction, manual response actions and central management. Endpoint detection and response and automated investigation are not among its listed capabilities.
- Defender for Endpoint Plan 2 adds endpoint detection and response and automated investigation for organisations that need them.
- Servers are separate. Microsoft notes that Windows and Linux servers need extra licences, even alongside Defender for Business.
A licence is not protection
Having the subscription does not mean every laptop is protected to the standard you expect. Devices need to be onboarded, policies assigned and alerts reviewed by someone with the time and authority to act. Depending on your plan, a review should cover the following.
- Real-time and cloud-delivered protection.
- Tamper protection and attack surface reduction rules.
- Device management and security policy assignment.
- Endpoint detection and response, where licensed.
- Vulnerability reporting, updates, encryption and local administrator rights.
- Devices missing from management entirely. A second antivirus product will not protect a laptop nobody knew about.
Different products do detect differently
Security vendors share threat intelligence through partnerships, research communities and services such as VirusTotal. That does not mean they all work from one database. Each combines shared information with its own research, telemetry and behavioural analysis, so one product may spot a particular threat before another.
That is a reason to understand what your organisation needs. It is not, by itself, an argument that every business needs two endpoint products.
When more protection makes sense
Assuming an extra product must be better, without first checking what is already deployed, is not a good reason to buy. There are good reasons to add to, or replace, Microsoft's endpoint tools, though.
- Specialist systems that Microsoft's tools do not cover well.
- Capabilities your current plan does not include, such as endpoint detection and response on an E3 estate.
- Monitoring and incident response outside working hours, which comes from a managed service rather than another antivirus engine.
- A demonstrated gap in detection, coverage or management that an alternative would close.
Compare like for like
List your licences and the devices people actually use. Confirm which are onboarded and which policies apply. Check who receives alerts, who investigates them and what happens when a device needs isolating. Note any servers and specialist systems that need separate cover.
Then compare that position with what a proposed product would add. If it meaningfully improves detection, response, coverage or management, you have a reason to invest. If not, the budget may do more good configuring and managing the protection you already own.