In short: Microsoft Defender Suite is Microsoft's current name for the add-on formerly sold as Microsoft 365 E5 Security. It bundles Defender for Endpoint Plan 2, Defender for Office 365 Plan 2, Defender for Identity, Defender for Cloud Apps and Entra ID P2 as an add-on, mainly bought by Microsoft 365 E3 and Business Premium customers who want E5-level threat protection.
What the Defender Suite is
Microsoft has renamed its two E5 mini-suites. Microsoft 365 E5 Security is now the Microsoft Defender Suite, and Microsoft 365 E5 Compliance is now the Microsoft Purview Suite. The features did not change, so licences, documentation and quotes that mention E5 Security refer to the same thing.
The suite exists because many organisations want E5's security without the rest of E5, such as its Purview compliance and data security tools. It is licensed per user as an add-on to a qualifying base plan. For the data protection equivalent, see Microsoft Purview.
What is included
| Component | What it adds | Our guide |
|---|---|---|
| Microsoft Defender for Endpoint Plan 2 | Full EDR, advanced hunting, six months' data, automatic attack disruption, threat analytics | Defender for Endpoint |
| Microsoft Defender for Office 365 Plan 2 | Threat Explorer, automated investigation and response, attack simulation training | Defender for Office 365 |
| Microsoft Defender for Identity | Detection of attacks on on-premises Active Directory and hybrid identity | Defender for Identity |
| Microsoft Defender for Cloud Apps | Shadow IT discovery, app governance for OAuth apps, session controls | Defender for Cloud Apps |
| Microsoft Entra ID P2 | ID Protection risk-based policies, Privileged Identity Management, access reviews | Entra ID P1 and P2 |
Together these feed Microsoft Defender XDR with endpoint, email, identity and SaaS signals, which is what makes cross-product incidents and attack disruption work well.
Who buys it
There are two common buyers:
- Microsoft 365 E3 customers: E3 already includes Defender for Endpoint Plan 1, Defender for Office 365 Plan 1 and Entra ID P1. Microsoft lists Microsoft 365 E3 with the Defender Suite add-on as a qualifying licence for Defender XDR. This is the classic route to E5 security on E3.
- Business Premium customers: Microsoft offers a Microsoft Defender Suite for Business Premium add-on with the same five components, limited to 300 licences, plus a version combined with the Purview Suite. See Business Premium security.
- Frontline workers: a Defender Suite add-on for Microsoft 365 F1 and F3 brings the same protection to frontline staff.
If an E3 organisation only needs part of the suite, Microsoft also sells step-up licences that add just Entra ID P2 or just Defender for Endpoint Plan 2 to Microsoft 365 E3. They are worth comparing with the full suite before you buy.
You can license it for a subset of users, such as administrators, finance and executives, but check Microsoft's licensing terms and the practical effects first. In particular, Microsoft says a tenant with Defender for Business and some Defender for Endpoint Plan 2 users defaults to the Defender for Business experience until all users are on Plan 2 and Support switches the tenant.
Defender Suite vs Microsoft 365 E5 vs Microsoft 365 E7
| E3 + Defender Suite | Microsoft 365 E5 | Microsoft 365 E7 | |
|---|---|---|---|
| Defender for Endpoint P2, Defender for Office 365 P2, Defender for Identity, Defender for Cloud Apps | Yes | Yes | Yes |
| Entra ID P2 | Yes | Yes | Yes |
| Purview premium compliance and data security | No (Purview Suite add-on) | Yes | Yes |
| Security Copilot included allocation | No (capacity model) | Yes | Yes |
| Microsoft Entra Suite (Private Access, Internet Access, ID Governance, Verified ID) | No | No (add-on) | Yes |
| Microsoft 365 Copilot and Agent 365 | No | No (add-on) | Yes |
Microsoft 365 E7 became generally available on 1 May 2026, the same day as Microsoft Agent 365. It combines Microsoft 365 E5, Microsoft 365 Copilot, the Microsoft Entra Suite and Agent 365, Microsoft's control plane for governing AI agents. E5 and E7 both qualify for the Security Copilot allocation; the Defender Suite on its own is not listed as qualifying.
Choose the Defender Suite when you want E5 threat protection but not the rest of E5. Choose E5 when you also need Purview compliance and data security, or the Security Copilot allocation. Choose E7 when you are rolling out Microsoft 365 Copilot and AI agents widely and want identity, access and governance for them in the same licence. Pricing for all three: ask us for a quote.
Planning a Defender Suite roll-out
- Defender for Identity needs sensors installed on domain controllers, and on AD FS, AD CS and Entra Connect servers where you have them
- Defender for Endpoint Plan 2: onboard all devices and servers, and plan the switch if you are moving from Defender for Business
- Entra ID P2: build sign-in risk and user risk policies, move admins into Privileged Identity Management, and schedule access reviews
- Defender for Cloud Apps: connect Microsoft 365 and key SaaS apps, review OAuth app permissions; note that its file policies retire on 6 January 2027, with Microsoft Purview DLP or auto-labelling as the replacement
- Defender for Office 365 Plan 2: set up automated investigation, Threat Explorer access and attack simulation
- Operations: decide who works the Defender XDR incident queue, your team or an MDR service
How we help
We map your current licences, model whether the Defender Suite, E5 or E7 fits best, and then deploy and tune each component so the add-on delivers more than a line on the invoice. Commercial licensing support is available from Forever Group's Microsoft licensing team.
Contact us to compare the options for your organisation.
How Forever Systems helps with cloud security
We are an independent UK IT and cyber security provider. We supply and support a wide range of security platforms, so we recommend what fits your organisation rather than one vendor's answer to everything.
- Assess first: we review what you already own, especially your Microsoft 365 licences, before suggesting anything new
- Vendor-aware advice across secure access, email, identity, data protection, endpoint, MDR, cloud infrastructure, browser, AI and backup, including Cisco Secure, Check Point Harmony and Sophos
- Deployment and migration from a UK team, from tenant hardening to replacing a VPN or an endpoint product
- Ongoing support: policy tuning, alert handling, renewals and regular reviews
- People and certification too: security awareness training and Cyber Essentials
We work with businesses, schools, charities and public sector organisations.
Want an independent view of your cloud security?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Is Microsoft 365 E5 Security still available?
Yes, under a new name. Microsoft 365 E5 Security is now called the Microsoft Defender Suite, and Microsoft 365 E5 Compliance is now the Microsoft Purview Suite. The security components are the same.
What is in the Microsoft Defender Suite?
Defender for Endpoint Plan 2, Defender for Office 365 Plan 2, Defender for Identity, Defender for Cloud Apps and Microsoft Entra ID P2.
Can Business Premium customers buy the Defender Suite?
Yes. Microsoft offers the Microsoft Defender Suite for Business Premium, with the same five components, for up to 300 licences, and a combined version with the Purview Suite.
What is the difference between the Defender Suite and Microsoft 365 E5?
The Defender Suite is only E5's security components. Full E5 also includes Purview compliance and data security, the Security Copilot allocation and the rest of the E5 productivity plan.
What is Microsoft 365 E7?
Microsoft 365 E7 became generally available on 1 May 2026. It combines Microsoft 365 E5, Microsoft 365 Copilot, the Microsoft Entra Suite and Agent 365 in one licence, and qualifies for the Security Copilot allocation.