Microsoft Defender XDR pricing: the real math.

01 Key findings

1. Defender XDR is a brand, not a SKU. It orchestrates five separately licensed products — Endpoint, Office 365, Identity, Cloud Apps, and Cloud — into one incident view. Each is purchased independently, and only four of the five sit on the user-side E5 bundle.

2. The standalone stack and E5 are a photo finish at full use. Endpoint P2 + Office 365 P2 + Identity + Cloud Apps lists at $20.70 per user; the E5 premium over E3 is $21. Bundled and standalone land within 0.5% at 25,000 seats.

3. E5 forces all four; standalone lets you buy one or two. When only Endpoint and Identity are needed, standalone or E5 Security is materially cheaper — the bundle only pays off past three active components.

4. Mixed estates beat blanket E5. E5 on SOC and privileged seats, E3 plus targeted Defender add-ons on standard knowledge workers, typically saves 15–30% against full-E5 deployment.

5. Defender for Cloud sits outside the bundle entirely. CSPM and workload SKUs are priced per resource, not per user, and never appear inside E5. They are a separate, consumption-driven line that participates in Azure commitments.

02 The five Defender components

Each component is independently purchased and metered. User-side products price per user per month; Defender for Cloud prices per resource. Full 2026 list, built from Microsoft's Product Terms (May 2026) and the Defender service descriptions:

03 What each plan includes

Defender for Endpoint. P1 at $2.50 delivers next-gen antimalware, attack surface reduction, device-based Conditional Access, and central management — the EDR-lite tier. P2 at $5.20 adds full EDR with forensic timeline, automated investigation and remediation, threat and vulnerability management, 90-day advanced hunting, and Microsoft Threat Experts. Any environment with an active SOC should hold P2. The $2.70 P1-to-P2 increment is $810,000 a year across 25,000 seats — rarely paid as a delta because P2 sits inside E5. Server endpoints are licensed separately at $5.00 per server; a 1,500-server estate lists at $90,000 a year on top of seats.

Defender for Office 365. P1 at $2.00 delivers Safe Links, Safe Attachments, anti-phishing with impersonation protection, and quarantine policies. P2 at $5.00 adds Threat Explorer and Real-time Detections, Automated Investigation and Response for email, Attack Simulation Training, and Campaign Views. The largest hidden cost is the simulation quota: each P2 seat includes one simulation per year, so a quarterly cadence consumes the entitlement and triggers add-on fees.

Defender for Identity. At $5.50, this is the on-premise Active Directory monitoring product. It deploys sensors on domain controllers to detect lateral movement, Golden Ticket, DCSync, Kerberoasting, and privilege escalation. It only pays off with meaningful on-premise AD scale; cloud-only Entra ID tenants see no benefit, while hybrid estates extract the full value. Bundled in E5, EMS E5, and E5 Security.

Defender for Cloud Apps. At $5.00, the CASB product: Shadow IT discovery, session control and reverse proxy on sanctioned SaaS, conditional access app control, SaaS threat detection, and Information Protection scanning. E3 includes Cloud App Discovery at no cost; E5 includes the full product. The $5 standalone option is for E3 organisations that need full CASB without the rest of E5.

Defender for Cloud. Server-side workload protection plus posture management — structurally different: priced per resource, and absent from E5. CSPM at $15 per resource covers posture assessment across Azure, AWS, and GCP, compliance reporting (CIS, NIST, PCI DSS, ISO 27001), attack path analysis, and agentless scanning. Defender for Servers P2 at $15 per server adds Endpoint integration, file integrity monitoring, just-in-time VM access, and 500 MB/day free Log Analytics ingestion; P1 at $7 covers basic protection.

04 Standalone stack vs Microsoft 365 E5

The four user-side products list at $20.70 per user per month standalone. E5 includes all four for the $21 premium over E3, plus Entra ID P2, Power BI Pro, Teams Phone, and Purview P2. The 25,000-seat comparison at list:

Standalone and bundled land within 0.5% of each other at full consumption. E5 wins decisively when at least three of the four user-side Defender components are in active use. Standalone wins when only one or two are needed, because the bundle forces purchase of all four. Mixed estates — E5 on SOC seats, E3 plus targeted add-ons on standard workers — often deliver 15–30% saving against full-E5 deployment.

05 Cost at scale

Four routes to the same four Defender components, annual cost at 25,000 seats. The bars show why the path — not the product — decides the bill:

06 The E5-bundle trap

07 How to buy

Four questions decide standalone, E5 Security, or full E5. Answer them per seat segment, not per organisation.

08 Our recommendation

09 2026 negotiation levers

Defender inside an EA is typically discounted 8–20% against list depending on level. Three levers move realised cost.

First, the E5 Security path. The $12 E5 Security add-on delivers the four Defender components plus Entra ID P2 and Purview P2 to E3 organisations and is cheaper than full E5 wherever Power BI Pro and Teams Phone consumption sits below ~30% of seats. Model both before committing to a blanket upgrade.

Second, Defender for Cloud commitment. CSPM and workload SKUs participate in Azure consumption commitments. A $5M MACC covering production Azure can absorb $400K–$800K of Defender for Cloud spend at the MACC-tier discount, materially reducing realised cost.

Third, term and renewal timing. Defender list prices typically reset at Microsoft fiscal year-end (June 30) and at new EA versions. Renewing or expanding mid-year locks the current price; renewing into a new EA at fiscal year-end risks a 5–10% list increase that compounds across the term.

For the broader framework see Microsoft Security Licensing, Sentinel pricing, Entra ID pricing, the Microsoft vendor hub, and our vendor audit defence service.