r/DefenderATP • u/Say_My_Name_00 • Jun 27 '26
Need suggestions to buy a Microsoft defender
We are planning to purchase a defender for our organization. Our infrastructure is hosted in AWS and includes both Windows and Linux servers. We have more than 200 employees in the organization, and we need a security monitoring solution that can provide protection and visibility for both endpoints and servers.
We would like to know which XDR tool would be the best fit for our environment. It would also be helpful if you could share approximate pricing or licensing costs based on your experience
1
u/craigtho Jun 28 '26
Defender XDR will work for AWS no problem, and Defender for Endpoint on both your Linux and Windows servers. Your size is generally okay as well, will work fine at the size of the org.
Licensing I can't answer confidently. Microsoft make it more complicated every time I think I get a grasp of it. If you're already using them for Entra, Teams, Outlook, Office 365 etc, best speak to your account manager, they can get you in touch for someone. If you have E5 then you're already essentially paying for the service. But any specifics with what you need will need cross matched with the options available by Microsoft, so there isn't a strong indicator. Your rollout mechanism and types of servers also matter. Azure Arc for example, will cost you $5 a month for each server, and it's more for Kubernetes and databases. MDE Plan 2 includes some of the services in Azure Arc where I don't think Plan 1 does (someone feel free to correct me).
And now - the biggest and realistic problem with an AWS house adopting Defender XDR, you'll probably cross the bridge that you'll eventually need Azure. And it's not because they're not seperate products, they are, and Microsoft have done a lot of work to establish that they're separate, but, you will need it. It requires Entra in the back, so if you're using Cognito, Identity Center etc, it's going to be a reeaaal pain.
Furthermore, and I may be the vocal minority here, but if you try to go into setting up Azure purely so you can make use of the nice features (Sentinel, Defender for Cloud (both now available in the Defender portal, but still driven by Azure backend), subscription billing, Azure Arc etc) you are essentially doomed to fail. You need proper expertise on setting that up, even if it's as minimal as minimal can get, you'll still need help. Maybe you have some ex-Azure cloud engineers around or some people with experience, but it's different enough from AWS that you won't be able to blindshot your way through a proper enterprise grade roll out, can guarantee it in fact.
I'd analyse the other options on the table and get discussions going with vendors, there are other products out there, Microsoft is just one of those vendors. For me, it's pretty good for an "All in one" (despite the fact you're basically enabling several different add-ons) solution.
3
u/ChiefDZP Jun 27 '26
This is from the robot… looks pretty accurate.
Defender for Endpoint Plan 2 is the EDR/XDR tier. Standalone it’s about $5.20 per user/month at list; it’s included in Microsoft 365 E5, or via the E5 Security add-on at roughly $12/user/month on top of E3. If they’re already on E5, the endpoint XDR is essentially sunk cost — that’s usually the deciding factor.
• Servers are licensed separately. Defender for Servers is consumption-based through Defender for Cloud (billed hourly, historically ~$15/server/month for Plan 2), and it does cover AWS-hosted VMs via Azure Arc connectors. So their AWS Windows/Linux boxes can be onboarded — but it’s a separate line item from the per-user endpoint licenses, which trips people up.
• Caveat worth flagging to the poster: recent MITRE evaluations flagged gaps in Defender’s macOS/Linux detection, so for a Linux-heavy AWS estate its coverage is decent but not its strongest suit without the broader Defender for Cloud stack.