Microsoft Defender · Managed
Service group: CybersecurityGet full value from the Microsoft Defender you already pay for
Microsoft 365 plans include a family of Defender products that are only as good as their configuration. We manage Defender policies across devices, email and identities, work the incident queue during agreed hours, and track Secure Score recommendations to a decision.
At a glance
- Service
- Recurring administration of the Microsoft Defender product family in your Microsoft 365 tenant
- Best suited to
- Organizations of roughly 5 to 200 employees on Microsoft 365 Business Premium, E3 or E5, or with Defender add-ons
- Products covered
- Defender for Business or Defender for Endpoint, Defender for Office 365 and the Defender XDR portal, plus Defender for Identity or Cloud Apps where licensed
- Core inclusions
- Policy configuration, incident queue review in agreed hours, Secure Score tracking, monthly reporting and change documentation
- Not included by default
- Microsoft licences, non-Microsoft security products, after-hours incident handling and Azure workload protection with Defender for Cloud
- Pricing basis
- Per user or per device per month, proposed after a tenant review and confirmed in a written quotation
- How to start
- Begin with a Microsoft 365 Security Assessment, or book a consultation to confirm your licences
What Microsoft Defender management involves
Microsoft Defender is not one product. Depending on your licences, your tenant may include Defender Antivirus on every Windows device, Defender for Business or Defender for Endpoint for device protection and EDR, Defender for Office 365 for email and collaboration threats, and the unified Defender XDR portal where incidents from these sources are correlated.
Each component ships with defaults that are reasonable but not tailored, and several valuable features are off until someone turns them on. Defender management is the recurring work of configuring these products deliberately, watching the incident queue, acting on Secure Score recommendations and keeping a record of why each setting is the way it is.
If you are deciding whether Defender for Business fits a smaller organization, our Microsoft Defender for Business page covers that product choice. This service is for organizations that want the whole Defender stack run as an ongoing responsibility.
Problems we see in Defender tenants
Licensed but never onboarded
Business Premium includes Defender for Business, but devices were never onboarded, so the portal shows a handful of machines or none.
Preset policies never applied
Defender for Office 365 Safe Links, Safe Attachments and anti-impersonation are available but left at minimal settings or scoped to no one.
An incident queue nobody opens
Incidents and automated investigation results accumulate in the Defender portal without anyone reviewing or closing them.
Secure Score as a vanity number
Recommendations are ignored or accepted wholesale without considering the impact on staff and business applications.
What we manage
Device protection policies
Antivirus, tamper protection, attack surface reduction rules, controlled folder access and web protection, deployed through Intune and documented.
Email and collaboration protection
Standard or strict preset security policies, anti-phishing with impersonation protection for key staff and domains, Safe Links and Safe Attachments for email, Teams and SharePoint.
Incident queue operations
Review and classification of Defender XDR incidents during agreed hours, with remediation actions and closure notes.
Automated investigation settings
Automation levels for device and email remediation chosen with you and recorded, with pending actions approved or rejected.
Secure Score and vulnerability management
Recommendations reviewed monthly; each one is implemented, scheduled, or accepted as a risk with a reason. Defender vulnerability management data informs patch priorities where licensed.
Quarantine and user reporting
Quarantine policies, admin release processes and the Report button for users configured so suspicious messages reach review.
Scope of Defender management
The exact components depend on your licences and are listed in your proposal.
Typically included
- Device onboarding and policy management for licensed Defender endpoint products
- Defender for Office 365 policy configuration and quarantine management
- Incident and alert review in the Defender portal during agreed hours
- Monthly Secure Score review with a written decision for each recommendation
- Change records for every security policy modification
- Monthly report on coverage, incidents and outstanding recommendations
Requires separate scope or quotation
- Microsoft licence purchases or upgrades
- After-hours or weekend incident handling unless written into your plan
- Microsoft Defender for Cloud and Azure workload protection (see CloudArchitects.expert for complex Azure environments)
- Microsoft Sentinel deployment or custom detection engineering
- Management of non-Microsoft security products
Microsoft products in scope
- Microsoft Defender Antivirus
- Microsoft Defender for Business and Defender for Endpoint Plan 1 and Plan 2
- Microsoft Defender for Office 365 Plan 1 and Plan 2
- Microsoft Defender XDR portal, incidents and advanced hunting
- Microsoft Defender for Identity and Defender for Cloud Apps where licensed
- Microsoft Intune and Microsoft Entra ID for policy delivery and identity signals
- Microsoft Secure Score and Defender Vulnerability Management
Who should consider this
Business Premium organizations
Teams that pay for Business Premium and want the security features in it actually configured and used.
E3 and E5 tenants
Larger organizations within our 200-employee range with Defender for Endpoint Plan 2 or Defender for Office 365 Plan 2 licences.
Teams consolidating tools
Organizations considering replacing third-party antivirus or email filtering with the Defender capabilities they already license.
Results you can expect
- Defender features you already pay for configured and in use
- One place where device, email and identity incidents are reviewed
- Secure Score recommendations decided rather than ignored
- Fewer overlapping security products and invoices
- Documented reasons for every security setting in your tenant
How we take over Defender
Licence and tenant review
We map which Defender components you own, what is enabled, how devices are onboarded and how alerts are routed.
Baseline proposal
We recommend settings for each component, noting any that may affect staff or applications.
Staged changes
Policies move from audit to enforcement in stages, starting with a pilot group, with communication to staff.
Operating rhythm
Incident queue review in agreed hours, monthly Secure Score decisions and a monthly report begin.
Quarterly review
We revisit licensing, new Microsoft features and outstanding risks with you each quarter.
Ways to buy
Recurring services are confirmed in a written quotation.
Microsoft 365 Security Assessment
A fixed-fee review of your Defender, identity and email configuration with prioritized recommendations.
Defender management subscription
Per-user or per-device monthly management once your licensing and scope are confirmed.
With Microsoft 365 administration
Combine Defender management with day-to-day Microsoft 365 administration for one accountable tenant owner.
Frequently asked questions
Which Microsoft 365 plans include Defender?
Windows includes Defender Antivirus. Microsoft 365 Business Premium includes Defender for Business and Defender for Office 365 Plan 1. E5 plans include Defender for Endpoint Plan 2 and Defender for Office 365 Plan 2. Microsoft changes packaging periodically, so we confirm against your current licences.
Can Defender replace our third-party antivirus and email filter?
Often, yes, when licensing and configuration are right. We assess feature gaps and migration effort before recommending a switch, and we plan a staged changeover.
Do you monitor the Defender portal around the clock?
No. We review incidents during agreed hours. Defender's automatic protections continue to act at all times, and automated investigation can remediate many threats without waiting for us.
Will stricter settings disrupt staff?
Some changes, such as attack surface reduction rules, can block legitimate macros or tools. We run them in audit mode first, review the results with you, and only then enforce.
Related services
Products and packages
Industries we support
Service areas
Further reading
See which Defender features are switched on in your tenant
A Microsoft 365 Security Assessment shows what you own, what is configured and what to fix first.