1
00:00:00,080 --> 00:00:01,600
Attackers don't skip small
businesses.
2
00:00:01,600 --> 00:00:02,560
They prefer them.
3
00:00:02,560 --> 00:00:05,240
That's straight from Microsoft's
own threat reporting, because a
4
00:00:05,240 --> 00:00:07,679
small team usually has fewer
people watching, and that makes
5
00:00:07,679 --> 00:00:08,880
it an easier target.
6
00:00:08,880 --> 00:00:11,519
Microsoft Defender for business
is the tool built to close that
7
00:00:11,519 --> 00:00:14,160
gap, and it's aimed at companies
with up to three hundred users.
8
00:00:14,160 --> 00:00:17,120
It runs the same security engine
big companies use, wrapped in a
9
00:00:17,120 --> 00:00:20,000
setup wizard and policies that
work out of the box.
10
00:00:20,000 --> 00:00:23,920
Welcome to the M365 FM podcast,
where we explore the people,
11
00:00:23,920 --> 00:00:26,920
ideas and technologies shaping
the future of work.
12
00:00:26,920 --> 00:00:29,660
By the end, you'll know what it
does, how you set it up, what it
13
00:00:29,660 --> 00:00:31,800
costs, and where it stops.
14
00:00:31,800 --> 00:00:33,600
What defender for business
actually is.
15
00:00:33,600 --> 00:00:34,920
Microsoft Defender for business
16
00:00:34,920 --> 00:00:36,399
is a security tool that watches
17
00:00:36,399 --> 00:00:37,960
over the devices your business
18
00:00:37,960 --> 00:00:38,320
runs.
19
00:00:38,320 --> 00:00:41,159
That covers every laptop on a
desk, every phone in a pocket,
20
00:00:41,159 --> 00:00:42,880
and every tablet in a bag.
21
00:00:42,880 --> 00:00:45,880
In Microsoft's world, those
devices share one name, and that
22
00:00:45,880 --> 00:00:47,280
name is an endpoint.
23
00:00:47,280 --> 00:00:48,799
An endpoint is just any device
24
00:00:48,799 --> 00:00:50,320
connected to your business that
25
00:00:50,320 --> 00:00:51,600
an attacker could try to break
26
00:00:51,600 --> 00:00:52,200
into.
27
00:00:52,200 --> 00:00:53,880
That category is wider than it
sounds.
28
00:00:53,880 --> 00:00:56,479
It counts the phones your team
carries around and the tablets
29
00:00:56,479 --> 00:00:57,439
on the shop floor.
30
00:00:57,439 --> 00:01:00,520
Not only the computer sitting in
the office defender for business
31
00:01:00,520 --> 00:01:01,560
guards, all of them.
32
00:01:01,560 --> 00:01:02,899
And Microsoft designed it for
33
00:01:02,899 --> 00:01:04,219
small and medium businesses with
34
00:01:04,219 --> 00:01:05,260
a ceiling of three hundred
35
00:01:05,260 --> 00:01:05,620
users.
36
00:01:05,620 --> 00:01:07,780
That number comes up again and
again with this product, so it's
37
00:01:07,780 --> 00:01:10,379
worth remembering it decides
whether this tool is meant for
38
00:01:10,379 --> 00:01:10,900
you at all.
39
00:01:10,900 --> 00:01:11,980
The part that surprises people
40
00:01:11,980 --> 00:01:13,260
is that this isn't a scaled down
41
00:01:13,260 --> 00:01:14,099
security product.
42
00:01:14,099 --> 00:01:15,459
It's built on Microsoft Defender
43
00:01:15,459 --> 00:01:16,459
for endpoint, the same
44
00:01:16,459 --> 00:01:17,500
protection platform large
45
00:01:17,500 --> 00:01:19,299
enterprises run Microsoft tuned
46
00:01:19,299 --> 00:01:20,379
that platform for teams that
47
00:01:20,379 --> 00:01:22,019
don't have a security department
48
00:01:22,019 --> 00:01:23,379
defender for endpoint is what a
49
00:01:23,379 --> 00:01:24,359
company with ten thousand
50
00:01:24,359 --> 00:01:25,739
employees buys, and it's the
51
00:01:25,739 --> 00:01:27,140
foundation this smaller product
52
00:01:27,140 --> 00:01:27,939
sits on.
53
00:01:27,939 --> 00:01:29,700
The engine underneath is
identical.
54
00:01:29,700 --> 00:01:30,980
What changes is the packaging?
55
00:01:30,980 --> 00:01:32,140
Because Microsoft wrapped that
56
00:01:32,140 --> 00:01:33,620
engine in a setup wizard,
57
00:01:33,620 --> 00:01:35,180
sensible default policies and a
58
00:01:35,180 --> 00:01:36,540
simpler screen, the threats it
59
00:01:36,540 --> 00:01:37,420
goes after are the ones
60
00:01:37,420 --> 00:01:38,980
Microsoft lists first, and
61
00:01:38,980 --> 00:01:40,099
they're the ones you hear about
62
00:01:40,099 --> 00:01:40,620
most.
63
00:01:40,620 --> 00:01:43,060
Ransomware is software that
locks up your files and demands
64
00:01:43,060 --> 00:01:44,260
money to unlock them.
65
00:01:44,260 --> 00:01:46,819
Malware is any program built to
cause harm, whether that means
66
00:01:46,819 --> 00:01:49,019
stealing data or quietly
wrecking a machine.
67
00:01:49,019 --> 00:01:51,900
Phishing is a fake message that
tricks someone into handing over
68
00:01:51,900 --> 00:01:53,659
a password or sending a payment.
69
00:01:53,659 --> 00:01:54,939
None of those threats check your
70
00:01:54,939 --> 00:01:56,180
headcount before they strike,
71
00:01:56,180 --> 00:01:56,980
and that should get your
72
00:01:56,980 --> 00:01:57,579
attention.
73
00:01:57,579 --> 00:02:00,620
Microsoft's own threat report
says attackers target small and
74
00:02:00,620 --> 00:02:03,560
medium businesses because those
companies usually have fewer
75
00:02:03,560 --> 00:02:05,040
people watching the doors.
76
00:02:05,040 --> 00:02:07,359
The data they hold is just as
valuable as anyone else's.
77
00:02:07,359 --> 00:02:09,759
The same report notes that
Russia has pushed attacks beyond
78
00:02:09,759 --> 00:02:12,280
Ukraine and onto small
businesses in NATO countries.
79
00:02:12,280 --> 00:02:13,340
Those businesses become a
80
00:02:13,340 --> 00:02:14,120
doorway into larger
81
00:02:14,120 --> 00:02:15,159
organizations.
82
00:02:15,159 --> 00:02:17,520
A small business isn't too small
to be a target, and it's often
83
00:02:17,520 --> 00:02:18,639
the easiest way in.
84
00:02:18,639 --> 00:02:20,620
So the next thing worth
understanding is whether the
85
00:02:20,620 --> 00:02:24,080
antivirus you already have
covers any of this.
86
00:02:24,080 --> 00:02:26,080
Why antivirus alone isn't
enough.
87
00:02:26,080 --> 00:02:29,120
Most of us assume antivirus is
the whole job, and for a long
88
00:02:29,120 --> 00:02:30,560
time, that assumption held up.
89
00:02:30,560 --> 00:02:33,520
Microsoft Defender Antivirus is
the free protection already
90
00:02:33,520 --> 00:02:35,719
built into windows, and it does
a real job.
91
00:02:35,719 --> 00:02:38,360
It catches known viruses,
malware, and unwanted programs
92
00:02:38,360 --> 00:02:39,319
before they run.
93
00:02:39,319 --> 00:02:40,319
It works quietly in the
94
00:02:40,319 --> 00:02:41,439
background while you get on with
95
00:02:41,439 --> 00:02:42,080
your day.
96
00:02:42,080 --> 00:02:44,680
And for plenty of people, that's
what security means until the
97
00:02:44,680 --> 00:02:45,800
day it isn't enough.
98
00:02:45,800 --> 00:02:48,639
The problem is that antivirus is
the flaw, and it never was.
99
00:02:48,639 --> 00:02:51,080
The ceiling antivirus mostly
blocks things it already
100
00:02:51,080 --> 00:02:54,159
recognizes, tells you a file was
stopped and then goes quiet.
101
00:02:54,159 --> 00:02:57,479
It doesn't tell you who sent it,
which device was involved, or
102
00:02:57,479 --> 00:02:59,400
whether the attacker found
another way in.
103
00:02:59,400 --> 00:03:00,439
That silence is the gap.
104
00:03:00,439 --> 00:03:02,520
Defender for business is built
to fill.
105
00:03:02,520 --> 00:03:04,740
The core of that gap is
something Microsoft calls
106
00:03:04,740 --> 00:03:07,539
endpoint detection and response,
usually shortened to EDR.
107
00:03:07,539 --> 00:03:09,180
In plain words, EDR is the part
108
00:03:09,180 --> 00:03:10,379
of the system that watches
109
00:03:10,379 --> 00:03:11,659
what's actually happening on a
110
00:03:11,659 --> 00:03:12,379
device.
111
00:03:12,379 --> 00:03:15,860
It spots behavior that looks
like an attack and it responds.
112
00:03:15,860 --> 00:03:16,960
The move from blocking to
113
00:03:16,960 --> 00:03:18,419
watching changes what you can
114
00:03:18,419 --> 00:03:19,139
actually see.
115
00:03:19,139 --> 00:03:20,939
So instead of a silent block,
you get a story.
116
00:03:20,939 --> 00:03:22,240
You see that a file tried to run
117
00:03:22,240 --> 00:03:23,699
on a specific laptop and that it
118
00:03:23,699 --> 00:03:24,819
tried to reach an address on the
119
00:03:24,819 --> 00:03:25,460
internet.
120
00:03:25,460 --> 00:03:27,780
The system already stopped it
and cleaned it up.
121
00:03:27,780 --> 00:03:29,219
That story is what lets a person
122
00:03:29,219 --> 00:03:30,659
decide whether the incident is
123
00:03:30,659 --> 00:03:32,180
over or whether it needs a
124
00:03:32,180 --> 00:03:32,780
closer look.
125
00:03:32,780 --> 00:03:35,180
There's a second weakness in
relying on antivirus alone, and
126
00:03:35,180 --> 00:03:36,620
it has to do with timing.
127
00:03:36,620 --> 00:03:39,300
New attacks get built faster
than a list of known bad files
128
00:03:39,300 --> 00:03:40,379
can keep up with.
129
00:03:40,379 --> 00:03:41,460
The ones that slip through are
130
00:03:41,460 --> 00:03:42,620
exactly the ones that business
131
00:03:42,620 --> 00:03:43,259
can't afford.
132
00:03:43,259 --> 00:03:46,500
EDR watches for behavior rather
than only matching names, which
133
00:03:46,500 --> 00:03:48,860
is how it catches an attack
nobody has seen before.
134
00:03:48,860 --> 00:03:50,060
That shift is the whole point.
135
00:03:50,060 --> 00:03:51,139
Antivirus answers whether
136
00:03:51,139 --> 00:03:52,680
something bad was blocked and
137
00:03:52,680 --> 00:03:53,939
EDR answers what happened, where
138
00:03:53,939 --> 00:03:54,960
it happened, and what needs to
139
00:03:54,960 --> 00:03:55,900
happen next.
140
00:03:55,900 --> 00:03:58,300
For a small business without a
security team, that difference
141
00:03:58,300 --> 00:03:59,659
is the reason to care.
142
00:03:59,659 --> 00:04:02,900
Nobody on staff is going to sit
and read logs all day.
143
00:04:02,900 --> 00:04:04,810
The four jobs it does on every
device.
144
00:04:04,810 --> 00:04:06,330
Microsoft describes this product
145
00:04:06,330 --> 00:04:07,849
around for jobs, and they line
146
00:04:07,849 --> 00:04:09,449
up with how a real security team
147
00:04:09,449 --> 00:04:10,409
works.
148
00:04:10,409 --> 00:04:13,770
The four are identify, protect,
detect and respond and recover.
149
00:04:13,770 --> 00:04:14,889
Each one covers a different
150
00:04:14,889 --> 00:04:16,250
moment in the life of a threat
151
00:04:16,250 --> 00:04:17,250
and defender for business
152
00:04:17,250 --> 00:04:18,569
handles all four on the same set
153
00:04:18,569 --> 00:04:19,209
of devices.
154
00:04:19,209 --> 00:04:20,649
The first job is identify and
155
00:04:20,649 --> 00:04:21,569
this is the vulnerability
156
00:04:21,569 --> 00:04:22,689
management piece.
157
00:04:22,689 --> 00:04:25,769
It scans your devices for weak
spots, missing updates and
158
00:04:25,769 --> 00:04:27,250
settings that leave a door open.
159
00:04:27,250 --> 00:04:30,250
Then it tells you what to fix
first based on what's riskiest.
160
00:04:30,250 --> 00:04:32,850
The list is ordered by what an
attacker would try first.
161
00:04:32,850 --> 00:04:35,730
That list earns its name because
vulnerability is simply a hole
162
00:04:35,730 --> 00:04:38,170
in your defenses, and most of
them are not exotic.
163
00:04:38,170 --> 00:04:39,569
They are things like a program
164
00:04:39,569 --> 00:04:41,069
nobody updated in two years, or
165
00:04:41,069 --> 00:04:42,129
a setting that got switched off
166
00:04:42,129 --> 00:04:43,009
by accident.
167
00:04:43,009 --> 00:04:45,410
Those are exactly what an
attacker looks for first.
168
00:04:45,410 --> 00:04:46,850
The second job is protect, and
169
00:04:46,850 --> 00:04:48,089
this is where next generation
170
00:04:48,089 --> 00:04:49,449
protection comes in, which is
171
00:04:49,449 --> 00:04:50,610
the modern antivirus and
172
00:04:50,610 --> 00:04:52,410
anti-malware engine.
173
00:04:52,410 --> 00:04:55,769
Alongside it sits attack surface
reduction, which closes off the
174
00:04:55,769 --> 00:04:57,529
tricks attackers lean on most.
175
00:04:57,529 --> 00:04:58,810
Those tricks include macros
176
00:04:58,810 --> 00:05:00,009
hidden inside documents and
177
00:05:00,009 --> 00:05:01,250
scripts that try to run without
178
00:05:01,250 --> 00:05:01,889
you noticing.
179
00:05:01,889 --> 00:05:03,209
The protection shuts the door on
180
00:05:03,209 --> 00:05:04,259
them before a person has to
181
00:05:04,259 --> 00:05:04,790
react.
182
00:05:04,790 --> 00:05:06,589
The third job is detect and
respond.
183
00:05:06,589 --> 00:05:08,350
And this is the EDR piece again.
184
00:05:08,350 --> 00:05:09,389
Now working with something
185
00:05:09,389 --> 00:05:11,389
Microsoft calls automatic attack
186
00:05:11,389 --> 00:05:12,189
disruption.
187
00:05:12,189 --> 00:05:13,589
When a real attack starts, that
188
00:05:13,589 --> 00:05:14,870
feature can contain it in real
189
00:05:14,870 --> 00:05:15,189
time.
190
00:05:15,189 --> 00:05:16,470
It cuts the threat off before it
191
00:05:16,470 --> 00:05:17,790
spreads from one device to the
192
00:05:17,790 --> 00:05:18,389
next.
193
00:05:18,389 --> 00:05:21,110
Microsoft's own wording for it
is automatic, because the point
194
00:05:21,110 --> 00:05:23,750
is that it acts even when nobody
is watching the screen.
195
00:05:23,750 --> 00:05:25,110
The fourth job is recover.
196
00:05:25,110 --> 00:05:26,350
Automated investigation and
197
00:05:26,350 --> 00:05:27,550
remediation takes the alerts
198
00:05:27,550 --> 00:05:28,990
that fire, examines them, and
199
00:05:28,990 --> 00:05:29,790
responds.
200
00:05:29,790 --> 00:05:31,149
In practice, that means the
201
00:05:31,149 --> 00:05:32,389
system can remove a malicious
202
00:05:32,389 --> 00:05:34,069
file or undo a change on its
203
00:05:34,069 --> 00:05:34,709
own.
204
00:05:34,709 --> 00:05:37,029
A small business gets back to
work faster instead of waiting
205
00:05:37,029 --> 00:05:37,949
on a specialist.
206
00:05:37,949 --> 00:05:40,189
One more detail makes all of
this practical.
207
00:05:40,189 --> 00:05:43,269
Defender for business covers
windows, Mac, iOS, and Android,
208
00:05:43,269 --> 00:05:45,750
so the phone in your pocket is
in scope along with the laptop
209
00:05:45,750 --> 00:05:46,589
on your desk.
210
00:05:46,589 --> 00:05:49,750
A single license covers up to
five devices for each user, and
211
00:05:49,750 --> 00:05:52,470
there's no minimum number of
devices to get started.
212
00:05:52,470 --> 00:05:54,990
All of it reports back to one
place the Microsoft Defender
213
00:05:54,990 --> 00:05:57,230
Portal, so you're not juggling
five different tools to see
214
00:05:57,230 --> 00:05:57,990
what's going on.
215
00:05:57,990 --> 00:06:00,790
That single view matters most
for the person who has to act,
216
00:06:00,790 --> 00:06:02,990
because a small team doesn't
have time to check for
217
00:06:02,990 --> 00:06:05,029
dashboards before it decides
what to do.
218
00:06:06,410 --> 00:06:08,050
How you actually set it up.
219
00:06:08,050 --> 00:06:09,410
This is the part beginners worry
220
00:06:09,410 --> 00:06:10,829
about most, and it's the part
221
00:06:10,829 --> 00:06:12,610
Microsoft spent the most effort
222
00:06:12,610 --> 00:06:13,370
simplifying.
223
00:06:13,370 --> 00:06:15,490
You don't need a dedicated
security team, and you don't
224
00:06:15,490 --> 00:06:16,129
need to stand up.
225
00:06:16,129 --> 00:06:18,730
A separate security console
defender for business lives
226
00:06:18,730 --> 00:06:21,290
inside the Microsoft tools you
may already be using, which
227
00:06:21,290 --> 00:06:23,769
means the learning curve is
shorter than it sounds.
228
00:06:23,769 --> 00:06:26,250
Setup can run through a guided
wizard that walks you through
229
00:06:26,250 --> 00:06:27,009
the whole thing.
230
00:06:27,009 --> 00:06:29,250
The wizard is optional, and you
can work through the steps
231
00:06:29,250 --> 00:06:30,490
yourself if you'd rather.
232
00:06:30,490 --> 00:06:32,850
But for a first timer, it's the
easier path.
233
00:06:32,850 --> 00:06:34,850
Either way, there are six steps
to get through.
234
00:06:34,850 --> 00:06:36,569
You start by getting the
subscription and.
235
00:06:36,569 --> 00:06:39,089
Next you add your users and
assign each one a license.
236
00:06:39,089 --> 00:06:41,889
From there, you assign roles to
your security team, which in a
237
00:06:41,889 --> 00:06:44,050
small business might be you and
one other person.
238
00:06:44,050 --> 00:06:44,850
Then you set up email
239
00:06:44,850 --> 00:06:46,410
notifications so alerts don't
240
00:06:46,410 --> 00:06:47,089
sit unseen.
241
00:06:47,089 --> 00:06:48,250
After that, you onboard your
242
00:06:48,250 --> 00:06:49,490
devices so they're protected
243
00:06:49,490 --> 00:06:50,290
right away.
244
00:06:50,290 --> 00:06:52,970
And finally, you review the
security policies that Microsoft
245
00:06:52,970 --> 00:06:54,290
already set up for you.
246
00:06:54,290 --> 00:06:56,250
The roles are simpler than they
sound.
247
00:06:56,250 --> 00:06:58,850
A security administrator can
view and change settings and act
248
00:06:58,850 --> 00:06:59,970
when a threat is found.
249
00:06:59,970 --> 00:07:01,050
A security reader can look at
250
00:07:01,050 --> 00:07:02,410
reports and dashboards but can't
251
00:07:02,410 --> 00:07:03,250
change anything.
252
00:07:03,250 --> 00:07:06,069
If you're a team of five, one
person probably holds the
253
00:07:06,069 --> 00:07:08,389
administrator role and everyone
else can be a reader.
254
00:07:08,389 --> 00:07:10,709
Email notifications are worth
turning on early.
255
00:07:10,709 --> 00:07:13,629
When an alert fires or a new
vulnerability shows up, your
256
00:07:13,629 --> 00:07:16,230
team gets an email even if
they're away from their desk.
257
00:07:16,230 --> 00:07:17,149
For a business without a
258
00:07:17,149 --> 00:07:18,509
security desk, that email is
259
00:07:18,509 --> 00:07:19,470
often the first sign that
260
00:07:19,470 --> 00:07:20,430
something happened.
261
00:07:20,430 --> 00:07:23,389
Onboarding is the step where
devices actually get connected,
262
00:07:23,389 --> 00:07:25,269
and you have more than one way
to do it.
263
00:07:25,269 --> 00:07:26,589
On windows, you can run a local
264
00:07:26,589 --> 00:07:28,629
script, use group policy, or use
265
00:07:28,629 --> 00:07:29,910
Microsoft Intune.
266
00:07:29,910 --> 00:07:31,250
Microsoft recommends doing about
267
00:07:31,250 --> 00:07:32,389
ten devices at a time with the
268
00:07:32,389 --> 00:07:32,949
script.
269
00:07:32,949 --> 00:07:34,269
Macs use a local script or
270
00:07:34,269 --> 00:07:36,149
Intune and phones and tablets on
271
00:07:36,149 --> 00:07:37,470
board through the Microsoft
272
00:07:37,470 --> 00:07:38,269
Defender app.
273
00:07:38,269 --> 00:07:41,269
If you already use Intune,
windows devices can even onboard
274
00:07:41,269 --> 00:07:44,149
themselves automatically as they
get enrolled with devices
275
00:07:44,149 --> 00:07:46,189
connected, everything lands in
one dashboard, and that
276
00:07:46,189 --> 00:07:48,790
dashboard is written for people
who aren't security experts.
277
00:07:48,790 --> 00:07:49,949
It shows you the devices you're
278
00:07:49,949 --> 00:07:51,269
protecting, the threats that
279
00:07:51,269 --> 00:07:52,470
were stopped, and the fixes
280
00:07:52,470 --> 00:07:53,670
Microsoft recommends.
281
00:07:53,670 --> 00:07:55,389
Everything is ranked by what
matters most.
282
00:07:55,389 --> 00:07:56,470
You don't have to know what a
283
00:07:56,470 --> 00:07:58,189
detection rule is to use it, and
284
00:07:58,189 --> 00:07:59,589
you never have to guess what to
285
00:07:59,589 --> 00:08:00,350
do next.
286
00:08:00,350 --> 00:08:03,149
Two practical notes before you
start provisioning in the
287
00:08:03,149 --> 00:08:05,550
defender portal can take up to
twenty four hours the first
288
00:08:05,550 --> 00:08:08,129
time, so don't panic if the
dashboard looks empty.
289
00:08:08,129 --> 00:08:11,370
And once devices are on,
Microsoft documents a harmless
290
00:08:11,370 --> 00:08:13,370
detection test and a phishing
test you can run.
291
00:08:13,370 --> 00:08:14,569
And if everything is working, an
292
00:08:14,569 --> 00:08:15,889
alert shows up within about ten
293
00:08:15,889 --> 00:08:16,649
minutes.
294
00:08:16,649 --> 00:08:18,730
The limits you should know
before you buy.
295
00:08:18,730 --> 00:08:20,089
Now for the honest part, because
296
00:08:20,089 --> 00:08:21,410
no tool fits every business
297
00:08:21,410 --> 00:08:22,129
perfectly.
298
00:08:22,129 --> 00:08:24,329
Defender for business has clear
edges you should know about
299
00:08:24,329 --> 00:08:26,889
before you buy, and knowing them
up front is how you decide
300
00:08:26,889 --> 00:08:27,769
whether it's right.
301
00:08:27,769 --> 00:08:30,410
The biggest one is the three
hundred user ceiling defender
302
00:08:30,410 --> 00:08:32,649
for business is designed for
organizations of no more than
303
00:08:32,649 --> 00:08:34,809
three hundred users, and that's
a hard line.
304
00:08:34,809 --> 00:08:36,490
Once you grow past it, Microsoft
305
00:08:36,490 --> 00:08:37,850
points you to an enterprise plan
306
00:08:37,850 --> 00:08:38,450
instead.
307
00:08:38,450 --> 00:08:40,970
If your company is on a growth
curve that's worth planning
308
00:08:40,970 --> 00:08:43,809
around, the device rule is the
next thing to know.
309
00:08:43,809 --> 00:08:45,490
Because one license covers as
310
00:08:45,490 --> 00:08:47,389
many as five client devices per
311
00:08:47,389 --> 00:08:48,049
user.
312
00:08:48,049 --> 00:08:49,210
That's generous for most people,
313
00:08:49,210 --> 00:08:50,570
but it's a limit all the same,
314
00:08:50,570 --> 00:08:52,169
and servers sit outside the deal
315
00:08:52,169 --> 00:08:52,769
entirely.
316
00:08:52,769 --> 00:08:55,690
Protecting a Windows Server or a
Linux server needs an extra
317
00:08:55,690 --> 00:08:58,970
license sold as the defender for
business servers add on.
318
00:08:58,970 --> 00:09:01,889
If you have more than sixty
servers, Microsoft recommends a
319
00:09:01,889 --> 00:09:03,289
different license altogether.
320
00:09:03,289 --> 00:09:06,210
There's also a licensing quirk
that catches people off guard.
321
00:09:06,210 --> 00:09:07,470
Defender for business doesn't
322
00:09:07,470 --> 00:09:08,429
support mixing with the
323
00:09:08,429 --> 00:09:09,549
enterprise product in the same
324
00:09:09,549 --> 00:09:10,470
organization.
325
00:09:10,470 --> 00:09:13,350
If you add defender for Endpoint
Plan two alongside it, the whole
326
00:09:13,350 --> 00:09:15,669
organization defaults back to
the defender for business
327
00:09:15,669 --> 00:09:18,110
experience, which isn't what you
wanted if you paid for more.
328
00:09:18,110 --> 00:09:19,830
A couple of smaller limits round
it out.
329
00:09:19,830 --> 00:09:21,350
Web content filtering supports
330
00:09:21,350 --> 00:09:22,950
only one uniform policy for the
331
00:09:22,950 --> 00:09:24,590
whole organization, so you can't
332
00:09:24,590 --> 00:09:25,590
set different rules for
333
00:09:25,590 --> 00:09:26,309
different teams.
334
00:09:26,309 --> 00:09:28,909
Some settings like controlled
folder access and the attack
335
00:09:28,909 --> 00:09:32,070
surface reduction rules live in
the Intune admin center rather
336
00:09:32,070 --> 00:09:34,789
than the defender portal, which
means a little more than one
337
00:09:34,789 --> 00:09:35,950
screen to learn.
338
00:09:35,950 --> 00:09:37,909
It's also fair to say what these
limits are not.
339
00:09:37,909 --> 00:09:38,750
They're not a sign that
340
00:09:38,750 --> 00:09:40,029
Microsoft held back the
341
00:09:40,029 --> 00:09:41,629
protection to push you toward a
342
00:09:41,629 --> 00:09:42,429
bigger bill.
343
00:09:42,429 --> 00:09:43,789
Because the detection engine is
344
00:09:43,789 --> 00:09:45,190
the same one the enterprise pays
345
00:09:45,190 --> 00:09:45,710
for.
346
00:09:45,710 --> 00:09:48,950
They're the practical edges of a
product built to a certain size,
347
00:09:48,950 --> 00:09:50,789
and anything built to a size
comes with edges.
348
00:09:50,789 --> 00:09:52,990
None of these limits change how
well the protection works,
349
00:09:52,990 --> 00:09:54,590
because they change who it fits.
350
00:09:54,590 --> 00:09:57,470
If you're under three hundred
users, your servers are few and
351
00:09:57,470 --> 00:10:00,409
one set of rules suits you, then
the edges won't bother you if
352
00:10:00,409 --> 00:10:02,710
you're past those lines, they're
the reason to look at the
353
00:10:02,710 --> 00:10:05,149
enterprise option instead.
354
00:10:05,149 --> 00:10:07,629
Defender for business versus
defender for endpoint.
355
00:10:07,629 --> 00:10:08,850
At this point, the natural
356
00:10:08,850 --> 00:10:10,210
question is how this differs
357
00:10:10,210 --> 00:10:11,490
from the bigger product with the
358
00:10:11,490 --> 00:10:12,370
similar name.
359
00:10:12,370 --> 00:10:13,429
The two look like separate
360
00:10:13,429 --> 00:10:14,690
tools, and the names don't help
361
00:10:14,690 --> 00:10:15,730
much, but they come from the
362
00:10:15,730 --> 00:10:16,610
same place.
363
00:10:16,610 --> 00:10:18,690
And the difference is mostly
about scale.
364
00:10:18,690 --> 00:10:21,809
Microsoft Defender for endpoint
is the enterprise product.
365
00:10:21,809 --> 00:10:22,649
It's built for larger
366
00:10:22,649 --> 00:10:23,769
organizations that have a
367
00:10:23,769 --> 00:10:25,169
security team and want deep
368
00:10:25,169 --> 00:10:26,009
control.
369
00:10:26,009 --> 00:10:27,570
It adds advanced tools for
370
00:10:27,570 --> 00:10:28,850
hunting threats across the whole
371
00:10:28,850 --> 00:10:29,610
company.
372
00:10:29,610 --> 00:10:31,129
And it comes in two plans.
373
00:10:31,129 --> 00:10:33,649
The gap between those plans is
worth understanding.
374
00:10:33,649 --> 00:10:35,090
Plan one gives you the basics of
375
00:10:35,090 --> 00:10:36,750
device protection, which means
376
00:10:36,750 --> 00:10:38,210
next generation protection and
377
00:10:38,210 --> 00:10:38,490
attack.
378
00:10:38,490 --> 00:10:39,570
Surface reduction.
379
00:10:39,570 --> 00:10:42,049
Plan two builds on that with
core vulnerability management,
380
00:10:42,049 --> 00:10:45,090
endpoint detection and response,
automated investigation and
381
00:10:45,090 --> 00:10:47,210
remediation, and threat hunting.
382
00:10:47,210 --> 00:10:48,850
It also adds six months of data
383
00:10:48,850 --> 00:10:50,129
retention, thirty days of
384
00:10:50,129 --> 00:10:51,769
advanced hunting data, and a
385
00:10:51,769 --> 00:10:53,169
service called Microsoft Threat
386
00:10:53,169 --> 00:10:54,850
Experts, where Microsoft's own
387
00:10:54,850 --> 00:10:56,409
analysts help investigate
388
00:10:56,409 --> 00:10:57,490
serious attacks.
389
00:10:57,490 --> 00:10:59,169
So where does defender for
business land?
390
00:10:59,169 --> 00:11:00,370
It includes everything in plan
391
00:11:00,370 --> 00:11:01,929
one, plus some of what plan two
392
00:11:01,929 --> 00:11:03,129
offers, plus a few features
393
00:11:03,129 --> 00:11:04,169
built specifically for small
394
00:11:04,169 --> 00:11:04,850
business.
395
00:11:04,850 --> 00:11:07,370
Those small business extras
include a simplified firewall
396
00:11:07,370 --> 00:11:10,679
and antivirus setup for windows,
and a monthly security summary
397
00:11:10,679 --> 00:11:13,399
report that lands in your inbox.
398
00:11:13,399 --> 00:11:14,840
Advanced hunting is the clearest
399
00:11:14,840 --> 00:11:16,360
example of the split in the
400
00:11:16,360 --> 00:11:17,399
enterprise plan.
401
00:11:17,399 --> 00:11:18,899
It lets an analyst write queries
402
00:11:18,899 --> 00:11:20,759
against months of security data
403
00:11:20,759 --> 00:11:22,240
to trace an attacker across the
404
00:11:22,240 --> 00:11:23,080
whole company.
405
00:11:23,080 --> 00:11:25,519
That's powerful work, and it
takes a trained person and
406
00:11:25,519 --> 00:11:26,600
plenty of time.
407
00:11:26,600 --> 00:11:29,120
A small business rarely has
either one, so a defender for
408
00:11:29,120 --> 00:11:31,480
business keeps the automated
parts and leaves the deep manual
409
00:11:31,480 --> 00:11:33,240
investigation to the plan.
410
00:11:33,240 --> 00:11:35,320
Built for teams that do it all
day.
411
00:11:35,320 --> 00:11:36,399
The cleanest way to hold it all
412
00:11:36,399 --> 00:11:37,419
together is the number three
413
00:11:37,419 --> 00:11:38,840
hundred under three hundred
414
00:11:38,840 --> 00:11:39,240
users.
415
00:11:39,240 --> 00:11:41,759
Defender for business is the fit
and over three hundred.
416
00:11:41,759 --> 00:11:43,039
Microsoft recommends an
417
00:11:43,039 --> 00:11:44,159
enterprise plan such as
418
00:11:44,159 --> 00:11:44,960
Microsoft three.
419
00:11:44,960 --> 00:11:47,759
Sixty five E3 or E5 or defender
420
00:11:47,759 --> 00:11:49,379
for Endpoint Plan one or plan
421
00:11:49,379 --> 00:11:49,919
two.
422
00:11:49,919 --> 00:11:51,200
The protection core is shared
423
00:11:51,200 --> 00:11:52,559
across all of them, so you're
424
00:11:52,559 --> 00:11:54,080
not choosing between strong and
425
00:11:54,080 --> 00:11:54,559
weak.
426
00:11:54,559 --> 00:11:55,919
You're choosing the packaging
427
00:11:55,919 --> 00:11:57,240
that matches the size of your
428
00:11:57,240 --> 00:11:58,000
team.
429
00:11:58,000 --> 00:11:59,879
What it costs and how to get it
430
00:11:59,879 --> 00:12:00,919
cost is usually the last
431
00:12:00,919 --> 00:12:01,480
question.
432
00:12:01,480 --> 00:12:02,600
And here it's simple.
433
00:12:02,600 --> 00:12:03,840
Defender for business costs
434
00:12:03,840 --> 00:12:05,039
three dollars per user per
435
00:12:05,039 --> 00:12:05,279
month.
436
00:12:05,279 --> 00:12:08,039
When you buy it on its own and
pay yearly for that price.
437
00:12:08,039 --> 00:12:11,500
Each user is covered across as
many as five devices and there
438
00:12:11,500 --> 00:12:12,860
is no minimum device count.
439
00:12:12,860 --> 00:12:14,259
There's a second route worth
440
00:12:14,259 --> 00:12:15,379
understanding because for many
441
00:12:15,379 --> 00:12:16,460
businesses, it's the better
442
00:12:16,460 --> 00:12:17,059
deal.
443
00:12:17,059 --> 00:12:17,740
Microsoft three.
444
00:12:17,740 --> 00:12:18,779
Sixty five Business Premium
445
00:12:18,779 --> 00:12:19,940
includes defender for business
446
00:12:19,940 --> 00:12:21,580
as part of the plan, and it adds
447
00:12:21,580 --> 00:12:23,179
a lot on top, including email
448
00:12:23,179 --> 00:12:24,820
protection, device management,
449
00:12:24,820 --> 00:12:26,299
identity protection, and data
450
00:12:26,299 --> 00:12:27,539
protection tools.
451
00:12:27,539 --> 00:12:29,259
Business premium costs more per
user.
452
00:12:29,259 --> 00:12:31,899
So the real question is whether
you need those extra pieces.
453
00:12:31,899 --> 00:12:34,460
If you do, the bundle usually
wins to make the choice.
454
00:12:34,460 --> 00:12:38,139
Concrete picture two small
companies, one already has email
455
00:12:38,139 --> 00:12:41,059
and identity handled elsewhere
and only needs its devices
456
00:12:41,059 --> 00:12:44,019
protected, so the three dollars
standalone plan fits.
457
00:12:44,019 --> 00:12:45,019
The other is starting from
458
00:12:45,019 --> 00:12:46,259
scratch and needs email
459
00:12:46,259 --> 00:12:48,019
security, device management, and
460
00:12:48,019 --> 00:12:48,779
data protection.
461
00:12:48,779 --> 00:12:49,779
At the same time.
462
00:12:49,779 --> 00:12:51,340
The bundle saves money and setup
463
00:12:51,340 --> 00:12:52,620
effort by covering all of it in
464
00:12:52,620 --> 00:12:53,419
one place.
465
00:12:53,419 --> 00:12:56,259
If you want to test before you
commit, Microsoft offers a one
466
00:12:56,259 --> 00:12:59,419
month free trial, a credit card
is required, and the trial turns
467
00:12:59,419 --> 00:13:02,460
into a paid subscription unless
you cancel it during the month.
468
00:13:02,460 --> 00:13:04,179
Server protection is separate at
469
00:13:04,179 --> 00:13:05,299
three dollars per server
470
00:13:05,299 --> 00:13:06,779
instance, and if you'd rather
471
00:13:06,779 --> 00:13:08,379
not buy it directly, Microsoft
472
00:13:08,379 --> 00:13:09,460
recommends working with a
473
00:13:09,460 --> 00:13:10,759
partner who can set it up for
474
00:13:10,759 --> 00:13:11,120
you.
475
00:13:11,120 --> 00:13:13,720
Add up the picture and the value
is easy to see.
476
00:13:13,720 --> 00:13:14,919
That three dollars price buys
477
00:13:14,919 --> 00:13:16,080
the same protection engine that
478
00:13:16,080 --> 00:13:17,580
large enterprises rely on with a
479
00:13:17,580 --> 00:13:18,720
guided wizard and default
480
00:13:18,720 --> 00:13:19,559
policies.
481
00:13:19,559 --> 00:13:21,120
So a small team can actually run
it.
482
00:13:21,120 --> 00:13:23,960
That's the promise this product
makes, and the price is part of
483
00:13:23,960 --> 00:13:25,399
why it holds up.
484
00:13:25,399 --> 00:13:27,000
The recap and one question
485
00:13:27,000 --> 00:13:28,440
defender for business is an
486
00:13:28,440 --> 00:13:29,879
endpoint security tool built for
487
00:13:29,879 --> 00:13:31,600
small and medium businesses with
488
00:13:31,600 --> 00:13:32,799
a hard cap of three hundred
489
00:13:32,799 --> 00:13:34,399
users, and it runs on the same
490
00:13:34,399 --> 00:13:36,039
engine as Microsoft's enterprise
491
00:13:36,039 --> 00:13:36,759
product.
492
00:13:36,759 --> 00:13:39,559
It does for jobs on every
device, which are finding weak
493
00:13:39,559 --> 00:13:41,820
spots, protecting against
malware and ransomware,
494
00:13:41,820 --> 00:13:44,879
detecting and responding to real
attacks and helping you recover.
495
00:13:44,879 --> 00:13:47,519
You set it up with a wizard, and
it doesn't require a security
496
00:13:47,519 --> 00:13:48,120
team to run.
497
00:13:48,120 --> 00:13:49,519
It runs three dollars per user
498
00:13:49,519 --> 00:13:51,120
each month on its own, or it
499
00:13:51,120 --> 00:13:52,399
comes included with Microsoft
500
00:13:52,399 --> 00:13:53,259
three hundred sixty five
501
00:13:53,259 --> 00:13:54,200
Business Premium.
502
00:13:54,200 --> 00:13:56,639
The protection is real, the
setup is manageable, and the
503
00:13:56,639 --> 00:13:59,200
cost is small enough that the
only question left is whether it
504
00:13:59,200 --> 00:14:00,240
fits your situation.
505
00:14:00,240 --> 00:14:02,360
That leaves one question worth
asking yourself.
506
00:14:02,360 --> 00:14:05,299
Microsoft's own report found
that attackers go after small
507
00:14:05,299 --> 00:14:07,799
businesses because there are
fewer people standing guard.
508
00:14:07,799 --> 00:14:10,399
So what is guarding the laptops,
the phones and the tablets your
509
00:14:10,399 --> 00:14:11,919
business depends on right now.
00:00:00,080 --> 00:00:01,600
Attackers don't skip small
businesses.
2
00:00:01,600 --> 00:00:02,560
They prefer them.
3
00:00:02,560 --> 00:00:05,240
That's straight from Microsoft's
own threat reporting, because a
4
00:00:05,240 --> 00:00:07,679
small team usually has fewer
people watching, and that makes
5
00:00:07,679 --> 00:00:08,880
it an easier target.
6
00:00:08,880 --> 00:00:11,519
Microsoft Defender for business
is the tool built to close that
7
00:00:11,519 --> 00:00:14,160
gap, and it's aimed at companies
with up to three hundred users.
8
00:00:14,160 --> 00:00:17,120
It runs the same security engine
big companies use, wrapped in a
9
00:00:17,120 --> 00:00:20,000
setup wizard and policies that
work out of the box.
10
00:00:20,000 --> 00:00:23,920
Welcome to the M365 FM podcast,
where we explore the people,
11
00:00:23,920 --> 00:00:26,920
ideas and technologies shaping
the future of work.
12
00:00:26,920 --> 00:00:29,660
By the end, you'll know what it
does, how you set it up, what it
13
00:00:29,660 --> 00:00:31,800
costs, and where it stops.
14
00:00:31,800 --> 00:00:33,600
What defender for business
actually is.
15
00:00:33,600 --> 00:00:34,920
Microsoft Defender for business
16
00:00:34,920 --> 00:00:36,399
is a security tool that watches
17
00:00:36,399 --> 00:00:37,960
over the devices your business
18
00:00:37,960 --> 00:00:38,320
runs.
19
00:00:38,320 --> 00:00:41,159
That covers every laptop on a
desk, every phone in a pocket,
20
00:00:41,159 --> 00:00:42,880
and every tablet in a bag.
21
00:00:42,880 --> 00:00:45,880
In Microsoft's world, those
devices share one name, and that
22
00:00:45,880 --> 00:00:47,280
name is an endpoint.
23
00:00:47,280 --> 00:00:48,799
An endpoint is just any device
24
00:00:48,799 --> 00:00:50,320
connected to your business that
25
00:00:50,320 --> 00:00:51,600
an attacker could try to break
26
00:00:51,600 --> 00:00:52,200
into.
27
00:00:52,200 --> 00:00:53,880
That category is wider than it
sounds.
28
00:00:53,880 --> 00:00:56,479
It counts the phones your team
carries around and the tablets
29
00:00:56,479 --> 00:00:57,439
on the shop floor.
30
00:00:57,439 --> 00:01:00,520
Not only the computer sitting in
the office defender for business
31
00:01:00,520 --> 00:01:01,560
guards, all of them.
32
00:01:01,560 --> 00:01:02,899
And Microsoft designed it for
33
00:01:02,899 --> 00:01:04,219
small and medium businesses with
34
00:01:04,219 --> 00:01:05,260
a ceiling of three hundred
35
00:01:05,260 --> 00:01:05,620
users.
36
00:01:05,620 --> 00:01:07,780
That number comes up again and
again with this product, so it's
37
00:01:07,780 --> 00:01:10,379
worth remembering it decides
whether this tool is meant for
38
00:01:10,379 --> 00:01:10,900
you at all.
39
00:01:10,900 --> 00:01:11,980
The part that surprises people
40
00:01:11,980 --> 00:01:13,260
is that this isn't a scaled down
41
00:01:13,260 --> 00:01:14,099
security product.
42
00:01:14,099 --> 00:01:15,459
It's built on Microsoft Defender
43
00:01:15,459 --> 00:01:16,459
for endpoint, the same
44
00:01:16,459 --> 00:01:17,500
protection platform large
45
00:01:17,500 --> 00:01:19,299
enterprises run Microsoft tuned
46
00:01:19,299 --> 00:01:20,379
that platform for teams that
47
00:01:20,379 --> 00:01:22,019
don't have a security department
48
00:01:22,019 --> 00:01:23,379
defender for endpoint is what a
49
00:01:23,379 --> 00:01:24,359
company with ten thousand
50
00:01:24,359 --> 00:01:25,739
employees buys, and it's the
51
00:01:25,739 --> 00:01:27,140
foundation this smaller product
52
00:01:27,140 --> 00:01:27,939
sits on.
53
00:01:27,939 --> 00:01:29,700
The engine underneath is
identical.
54
00:01:29,700 --> 00:01:30,980
What changes is the packaging?
55
00:01:30,980 --> 00:01:32,140
Because Microsoft wrapped that
56
00:01:32,140 --> 00:01:33,620
engine in a setup wizard,
57
00:01:33,620 --> 00:01:35,180
sensible default policies and a
58
00:01:35,180 --> 00:01:36,540
simpler screen, the threats it
59
00:01:36,540 --> 00:01:37,420
goes after are the ones
60
00:01:37,420 --> 00:01:38,980
Microsoft lists first, and
61
00:01:38,980 --> 00:01:40,099
they're the ones you hear about
62
00:01:40,099 --> 00:01:40,620
most.
63
00:01:40,620 --> 00:01:43,060
Ransomware is software that
locks up your files and demands
64
00:01:43,060 --> 00:01:44,260
money to unlock them.
65
00:01:44,260 --> 00:01:46,819
Malware is any program built to
cause harm, whether that means
66
00:01:46,819 --> 00:01:49,019
stealing data or quietly
wrecking a machine.
67
00:01:49,019 --> 00:01:51,900
Phishing is a fake message that
tricks someone into handing over
68
00:01:51,900 --> 00:01:53,659
a password or sending a payment.
69
00:01:53,659 --> 00:01:54,939
None of those threats check your
70
00:01:54,939 --> 00:01:56,180
headcount before they strike,
71
00:01:56,180 --> 00:01:56,980
and that should get your
72
00:01:56,980 --> 00:01:57,579
attention.
73
00:01:57,579 --> 00:02:00,620
Microsoft's own threat report
says attackers target small and
74
00:02:00,620 --> 00:02:03,560
medium businesses because those
companies usually have fewer
75
00:02:03,560 --> 00:02:05,040
people watching the doors.
76
00:02:05,040 --> 00:02:07,359
The data they hold is just as
valuable as anyone else's.
77
00:02:07,359 --> 00:02:09,759
The same report notes that
Russia has pushed attacks beyond
78
00:02:09,759 --> 00:02:12,280
Ukraine and onto small
businesses in NATO countries.
79
00:02:12,280 --> 00:02:13,340
Those businesses become a
80
00:02:13,340 --> 00:02:14,120
doorway into larger
81
00:02:14,120 --> 00:02:15,159
organizations.
82
00:02:15,159 --> 00:02:17,520
A small business isn't too small
to be a target, and it's often
83
00:02:17,520 --> 00:02:18,639
the easiest way in.
84
00:02:18,639 --> 00:02:20,620
So the next thing worth
understanding is whether the
85
00:02:20,620 --> 00:02:24,080
antivirus you already have
covers any of this.
86
00:02:24,080 --> 00:02:26,080
Why antivirus alone isn't
enough.
87
00:02:26,080 --> 00:02:29,120
Most of us assume antivirus is
the whole job, and for a long
88
00:02:29,120 --> 00:02:30,560
time, that assumption held up.
89
00:02:30,560 --> 00:02:33,520
Microsoft Defender Antivirus is
the free protection already
90
00:02:33,520 --> 00:02:35,719
built into windows, and it does
a real job.
91
00:02:35,719 --> 00:02:38,360
It catches known viruses,
malware, and unwanted programs
92
00:02:38,360 --> 00:02:39,319
before they run.
93
00:02:39,319 --> 00:02:40,319
It works quietly in the
94
00:02:40,319 --> 00:02:41,439
background while you get on with
95
00:02:41,439 --> 00:02:42,080
your day.
96
00:02:42,080 --> 00:02:44,680
And for plenty of people, that's
what security means until the
97
00:02:44,680 --> 00:02:45,800
day it isn't enough.
98
00:02:45,800 --> 00:02:48,639
The problem is that antivirus is
the flaw, and it never was.
99
00:02:48,639 --> 00:02:51,080
The ceiling antivirus mostly
blocks things it already
100
00:02:51,080 --> 00:02:54,159
recognizes, tells you a file was
stopped and then goes quiet.
101
00:02:54,159 --> 00:02:57,479
It doesn't tell you who sent it,
which device was involved, or
102
00:02:57,479 --> 00:02:59,400
whether the attacker found
another way in.
103
00:02:59,400 --> 00:03:00,439
That silence is the gap.
104
00:03:00,439 --> 00:03:02,520
Defender for business is built
to fill.
105
00:03:02,520 --> 00:03:04,740
The core of that gap is
something Microsoft calls
106
00:03:04,740 --> 00:03:07,539
endpoint detection and response,
usually shortened to EDR.
107
00:03:07,539 --> 00:03:09,180
In plain words, EDR is the part
108
00:03:09,180 --> 00:03:10,379
of the system that watches
109
00:03:10,379 --> 00:03:11,659
what's actually happening on a
110
00:03:11,659 --> 00:03:12,379
device.
111
00:03:12,379 --> 00:03:15,860
It spots behavior that looks
like an attack and it responds.
112
00:03:15,860 --> 00:03:16,960
The move from blocking to
113
00:03:16,960 --> 00:03:18,419
watching changes what you can
114
00:03:18,419 --> 00:03:19,139
actually see.
115
00:03:19,139 --> 00:03:20,939
So instead of a silent block,
you get a story.
116
00:03:20,939 --> 00:03:22,240
You see that a file tried to run
117
00:03:22,240 --> 00:03:23,699
on a specific laptop and that it
118
00:03:23,699 --> 00:03:24,819
tried to reach an address on the
119
00:03:24,819 --> 00:03:25,460
internet.
120
00:03:25,460 --> 00:03:27,780
The system already stopped it
and cleaned it up.
121
00:03:27,780 --> 00:03:29,219
That story is what lets a person
122
00:03:29,219 --> 00:03:30,659
decide whether the incident is
123
00:03:30,659 --> 00:03:32,180
over or whether it needs a
124
00:03:32,180 --> 00:03:32,780
closer look.
125
00:03:32,780 --> 00:03:35,180
There's a second weakness in
relying on antivirus alone, and
126
00:03:35,180 --> 00:03:36,620
it has to do with timing.
127
00:03:36,620 --> 00:03:39,300
New attacks get built faster
than a list of known bad files
128
00:03:39,300 --> 00:03:40,379
can keep up with.
129
00:03:40,379 --> 00:03:41,460
The ones that slip through are
130
00:03:41,460 --> 00:03:42,620
exactly the ones that business
131
00:03:42,620 --> 00:03:43,259
can't afford.
132
00:03:43,259 --> 00:03:46,500
EDR watches for behavior rather
than only matching names, which
133
00:03:46,500 --> 00:03:48,860
is how it catches an attack
nobody has seen before.
134
00:03:48,860 --> 00:03:50,060
That shift is the whole point.
135
00:03:50,060 --> 00:03:51,139
Antivirus answers whether
136
00:03:51,139 --> 00:03:52,680
something bad was blocked and
137
00:03:52,680 --> 00:03:53,939
EDR answers what happened, where
138
00:03:53,939 --> 00:03:54,960
it happened, and what needs to
139
00:03:54,960 --> 00:03:55,900
happen next.
140
00:03:55,900 --> 00:03:58,300
For a small business without a
security team, that difference
141
00:03:58,300 --> 00:03:59,659
is the reason to care.
142
00:03:59,659 --> 00:04:02,900
Nobody on staff is going to sit
and read logs all day.
143
00:04:02,900 --> 00:04:04,810
The four jobs it does on every
device.
144
00:04:04,810 --> 00:04:06,330
Microsoft describes this product
145
00:04:06,330 --> 00:04:07,849
around for jobs, and they line
146
00:04:07,849 --> 00:04:09,449
up with how a real security team
147
00:04:09,449 --> 00:04:10,409
works.
148
00:04:10,409 --> 00:04:13,770
The four are identify, protect,
detect and respond and recover.
149
00:04:13,770 --> 00:04:14,889
Each one covers a different
150
00:04:14,889 --> 00:04:16,250
moment in the life of a threat
151
00:04:16,250 --> 00:04:17,250
and defender for business
152
00:04:17,250 --> 00:04:18,569
handles all four on the same set
153
00:04:18,569 --> 00:04:19,209
of devices.
154
00:04:19,209 --> 00:04:20,649
The first job is identify and
155
00:04:20,649 --> 00:04:21,569
this is the vulnerability
156
00:04:21,569 --> 00:04:22,689
management piece.
157
00:04:22,689 --> 00:04:25,769
It scans your devices for weak
spots, missing updates and
158
00:04:25,769 --> 00:04:27,250
settings that leave a door open.
159
00:04:27,250 --> 00:04:30,250
Then it tells you what to fix
first based on what's riskiest.
160
00:04:30,250 --> 00:04:32,850
The list is ordered by what an
attacker would try first.
161
00:04:32,850 --> 00:04:35,730
That list earns its name because
vulnerability is simply a hole
162
00:04:35,730 --> 00:04:38,170
in your defenses, and most of
them are not exotic.
163
00:04:38,170 --> 00:04:39,569
They are things like a program
164
00:04:39,569 --> 00:04:41,069
nobody updated in two years, or
165
00:04:41,069 --> 00:04:42,129
a setting that got switched off
166
00:04:42,129 --> 00:04:43,009
by accident.
167
00:04:43,009 --> 00:04:45,410
Those are exactly what an
attacker looks for first.
168
00:04:45,410 --> 00:04:46,850
The second job is protect, and
169
00:04:46,850 --> 00:04:48,089
this is where next generation
170
00:04:48,089 --> 00:04:49,449
protection comes in, which is
171
00:04:49,449 --> 00:04:50,610
the modern antivirus and
172
00:04:50,610 --> 00:04:52,410
anti-malware engine.
173
00:04:52,410 --> 00:04:55,769
Alongside it sits attack surface
reduction, which closes off the
174
00:04:55,769 --> 00:04:57,529
tricks attackers lean on most.
175
00:04:57,529 --> 00:04:58,810
Those tricks include macros
176
00:04:58,810 --> 00:05:00,009
hidden inside documents and
177
00:05:00,009 --> 00:05:01,250
scripts that try to run without
178
00:05:01,250 --> 00:05:01,889
you noticing.
179
00:05:01,889 --> 00:05:03,209
The protection shuts the door on
180
00:05:03,209 --> 00:05:04,259
them before a person has to
181
00:05:04,259 --> 00:05:04,790
react.
182
00:05:04,790 --> 00:05:06,589
The third job is detect and
respond.
183
00:05:06,589 --> 00:05:08,350
And this is the EDR piece again.
184
00:05:08,350 --> 00:05:09,389
Now working with something
185
00:05:09,389 --> 00:05:11,389
Microsoft calls automatic attack
186
00:05:11,389 --> 00:05:12,189
disruption.
187
00:05:12,189 --> 00:05:13,589
When a real attack starts, that
188
00:05:13,589 --> 00:05:14,870
feature can contain it in real
189
00:05:14,870 --> 00:05:15,189
time.
190
00:05:15,189 --> 00:05:16,470
It cuts the threat off before it
191
00:05:16,470 --> 00:05:17,790
spreads from one device to the
192
00:05:17,790 --> 00:05:18,389
next.
193
00:05:18,389 --> 00:05:21,110
Microsoft's own wording for it
is automatic, because the point
194
00:05:21,110 --> 00:05:23,750
is that it acts even when nobody
is watching the screen.
195
00:05:23,750 --> 00:05:25,110
The fourth job is recover.
196
00:05:25,110 --> 00:05:26,350
Automated investigation and
197
00:05:26,350 --> 00:05:27,550
remediation takes the alerts
198
00:05:27,550 --> 00:05:28,990
that fire, examines them, and
199
00:05:28,990 --> 00:05:29,790
responds.
200
00:05:29,790 --> 00:05:31,149
In practice, that means the
201
00:05:31,149 --> 00:05:32,389
system can remove a malicious
202
00:05:32,389 --> 00:05:34,069
file or undo a change on its
203
00:05:34,069 --> 00:05:34,709
own.
204
00:05:34,709 --> 00:05:37,029
A small business gets back to
work faster instead of waiting
205
00:05:37,029 --> 00:05:37,949
on a specialist.
206
00:05:37,949 --> 00:05:40,189
One more detail makes all of
this practical.
207
00:05:40,189 --> 00:05:43,269
Defender for business covers
windows, Mac, iOS, and Android,
208
00:05:43,269 --> 00:05:45,750
so the phone in your pocket is
in scope along with the laptop
209
00:05:45,750 --> 00:05:46,589
on your desk.
210
00:05:46,589 --> 00:05:49,750
A single license covers up to
five devices for each user, and
211
00:05:49,750 --> 00:05:52,470
there's no minimum number of
devices to get started.
212
00:05:52,470 --> 00:05:54,990
All of it reports back to one
place the Microsoft Defender
213
00:05:54,990 --> 00:05:57,230
Portal, so you're not juggling
five different tools to see
214
00:05:57,230 --> 00:05:57,990
what's going on.
215
00:05:57,990 --> 00:06:00,790
That single view matters most
for the person who has to act,
216
00:06:00,790 --> 00:06:02,990
because a small team doesn't
have time to check for
217
00:06:02,990 --> 00:06:05,029
dashboards before it decides
what to do.
218
00:06:06,410 --> 00:06:08,050
How you actually set it up.
219
00:06:08,050 --> 00:06:09,410
This is the part beginners worry
220
00:06:09,410 --> 00:06:10,829
about most, and it's the part
221
00:06:10,829 --> 00:06:12,610
Microsoft spent the most effort
222
00:06:12,610 --> 00:06:13,370
simplifying.
223
00:06:13,370 --> 00:06:15,490
You don't need a dedicated
security team, and you don't
224
00:06:15,490 --> 00:06:16,129
need to stand up.
225
00:06:16,129 --> 00:06:18,730
A separate security console
defender for business lives
226
00:06:18,730 --> 00:06:21,290
inside the Microsoft tools you
may already be using, which
227
00:06:21,290 --> 00:06:23,769
means the learning curve is
shorter than it sounds.
228
00:06:23,769 --> 00:06:26,250
Setup can run through a guided
wizard that walks you through
229
00:06:26,250 --> 00:06:27,009
the whole thing.
230
00:06:27,009 --> 00:06:29,250
The wizard is optional, and you
can work through the steps
231
00:06:29,250 --> 00:06:30,490
yourself if you'd rather.
232
00:06:30,490 --> 00:06:32,850
But for a first timer, it's the
easier path.
233
00:06:32,850 --> 00:06:34,850
Either way, there are six steps
to get through.
234
00:06:34,850 --> 00:06:36,569
You start by getting the
subscription and.
235
00:06:36,569 --> 00:06:39,089
Next you add your users and
assign each one a license.
236
00:06:39,089 --> 00:06:41,889
From there, you assign roles to
your security team, which in a
237
00:06:41,889 --> 00:06:44,050
small business might be you and
one other person.
238
00:06:44,050 --> 00:06:44,850
Then you set up email
239
00:06:44,850 --> 00:06:46,410
notifications so alerts don't
240
00:06:46,410 --> 00:06:47,089
sit unseen.
241
00:06:47,089 --> 00:06:48,250
After that, you onboard your
242
00:06:48,250 --> 00:06:49,490
devices so they're protected
243
00:06:49,490 --> 00:06:50,290
right away.
244
00:06:50,290 --> 00:06:52,970
And finally, you review the
security policies that Microsoft
245
00:06:52,970 --> 00:06:54,290
already set up for you.
246
00:06:54,290 --> 00:06:56,250
The roles are simpler than they
sound.
247
00:06:56,250 --> 00:06:58,850
A security administrator can
view and change settings and act
248
00:06:58,850 --> 00:06:59,970
when a threat is found.
249
00:06:59,970 --> 00:07:01,050
A security reader can look at
250
00:07:01,050 --> 00:07:02,410
reports and dashboards but can't
251
00:07:02,410 --> 00:07:03,250
change anything.
252
00:07:03,250 --> 00:07:06,069
If you're a team of five, one
person probably holds the
253
00:07:06,069 --> 00:07:08,389
administrator role and everyone
else can be a reader.
254
00:07:08,389 --> 00:07:10,709
Email notifications are worth
turning on early.
255
00:07:10,709 --> 00:07:13,629
When an alert fires or a new
vulnerability shows up, your
256
00:07:13,629 --> 00:07:16,230
team gets an email even if
they're away from their desk.
257
00:07:16,230 --> 00:07:17,149
For a business without a
258
00:07:17,149 --> 00:07:18,509
security desk, that email is
259
00:07:18,509 --> 00:07:19,470
often the first sign that
260
00:07:19,470 --> 00:07:20,430
something happened.
261
00:07:20,430 --> 00:07:23,389
Onboarding is the step where
devices actually get connected,
262
00:07:23,389 --> 00:07:25,269
and you have more than one way
to do it.
263
00:07:25,269 --> 00:07:26,589
On windows, you can run a local
264
00:07:26,589 --> 00:07:28,629
script, use group policy, or use
265
00:07:28,629 --> 00:07:29,910
Microsoft Intune.
266
00:07:29,910 --> 00:07:31,250
Microsoft recommends doing about
267
00:07:31,250 --> 00:07:32,389
ten devices at a time with the
268
00:07:32,389 --> 00:07:32,949
script.
269
00:07:32,949 --> 00:07:34,269
Macs use a local script or
270
00:07:34,269 --> 00:07:36,149
Intune and phones and tablets on
271
00:07:36,149 --> 00:07:37,470
board through the Microsoft
272
00:07:37,470 --> 00:07:38,269
Defender app.
273
00:07:38,269 --> 00:07:41,269
If you already use Intune,
windows devices can even onboard
274
00:07:41,269 --> 00:07:44,149
themselves automatically as they
get enrolled with devices
275
00:07:44,149 --> 00:07:46,189
connected, everything lands in
one dashboard, and that
276
00:07:46,189 --> 00:07:48,790
dashboard is written for people
who aren't security experts.
277
00:07:48,790 --> 00:07:49,949
It shows you the devices you're
278
00:07:49,949 --> 00:07:51,269
protecting, the threats that
279
00:07:51,269 --> 00:07:52,470
were stopped, and the fixes
280
00:07:52,470 --> 00:07:53,670
Microsoft recommends.
281
00:07:53,670 --> 00:07:55,389
Everything is ranked by what
matters most.
282
00:07:55,389 --> 00:07:56,470
You don't have to know what a
283
00:07:56,470 --> 00:07:58,189
detection rule is to use it, and
284
00:07:58,189 --> 00:07:59,589
you never have to guess what to
285
00:07:59,589 --> 00:08:00,350
do next.
286
00:08:00,350 --> 00:08:03,149
Two practical notes before you
start provisioning in the
287
00:08:03,149 --> 00:08:05,550
defender portal can take up to
twenty four hours the first
288
00:08:05,550 --> 00:08:08,129
time, so don't panic if the
dashboard looks empty.
289
00:08:08,129 --> 00:08:11,370
And once devices are on,
Microsoft documents a harmless
290
00:08:11,370 --> 00:08:13,370
detection test and a phishing
test you can run.
291
00:08:13,370 --> 00:08:14,569
And if everything is working, an
292
00:08:14,569 --> 00:08:15,889
alert shows up within about ten
293
00:08:15,889 --> 00:08:16,649
minutes.
294
00:08:16,649 --> 00:08:18,730
The limits you should know
before you buy.
295
00:08:18,730 --> 00:08:20,089
Now for the honest part, because
296
00:08:20,089 --> 00:08:21,410
no tool fits every business
297
00:08:21,410 --> 00:08:22,129
perfectly.
298
00:08:22,129 --> 00:08:24,329
Defender for business has clear
edges you should know about
299
00:08:24,329 --> 00:08:26,889
before you buy, and knowing them
up front is how you decide
300
00:08:26,889 --> 00:08:27,769
whether it's right.
301
00:08:27,769 --> 00:08:30,410
The biggest one is the three
hundred user ceiling defender
302
00:08:30,410 --> 00:08:32,649
for business is designed for
organizations of no more than
303
00:08:32,649 --> 00:08:34,809
three hundred users, and that's
a hard line.
304
00:08:34,809 --> 00:08:36,490
Once you grow past it, Microsoft
305
00:08:36,490 --> 00:08:37,850
points you to an enterprise plan
306
00:08:37,850 --> 00:08:38,450
instead.
307
00:08:38,450 --> 00:08:40,970
If your company is on a growth
curve that's worth planning
308
00:08:40,970 --> 00:08:43,809
around, the device rule is the
next thing to know.
309
00:08:43,809 --> 00:08:45,490
Because one license covers as
310
00:08:45,490 --> 00:08:47,389
many as five client devices per
311
00:08:47,389 --> 00:08:48,049
user.
312
00:08:48,049 --> 00:08:49,210
That's generous for most people,
313
00:08:49,210 --> 00:08:50,570
but it's a limit all the same,
314
00:08:50,570 --> 00:08:52,169
and servers sit outside the deal
315
00:08:52,169 --> 00:08:52,769
entirely.
316
00:08:52,769 --> 00:08:55,690
Protecting a Windows Server or a
Linux server needs an extra
317
00:08:55,690 --> 00:08:58,970
license sold as the defender for
business servers add on.
318
00:08:58,970 --> 00:09:01,889
If you have more than sixty
servers, Microsoft recommends a
319
00:09:01,889 --> 00:09:03,289
different license altogether.
320
00:09:03,289 --> 00:09:06,210
There's also a licensing quirk
that catches people off guard.
321
00:09:06,210 --> 00:09:07,470
Defender for business doesn't
322
00:09:07,470 --> 00:09:08,429
support mixing with the
323
00:09:08,429 --> 00:09:09,549
enterprise product in the same
324
00:09:09,549 --> 00:09:10,470
organization.
325
00:09:10,470 --> 00:09:13,350
If you add defender for Endpoint
Plan two alongside it, the whole
326
00:09:13,350 --> 00:09:15,669
organization defaults back to
the defender for business
327
00:09:15,669 --> 00:09:18,110
experience, which isn't what you
wanted if you paid for more.
328
00:09:18,110 --> 00:09:19,830
A couple of smaller limits round
it out.
329
00:09:19,830 --> 00:09:21,350
Web content filtering supports
330
00:09:21,350 --> 00:09:22,950
only one uniform policy for the
331
00:09:22,950 --> 00:09:24,590
whole organization, so you can't
332
00:09:24,590 --> 00:09:25,590
set different rules for
333
00:09:25,590 --> 00:09:26,309
different teams.
334
00:09:26,309 --> 00:09:28,909
Some settings like controlled
folder access and the attack
335
00:09:28,909 --> 00:09:32,070
surface reduction rules live in
the Intune admin center rather
336
00:09:32,070 --> 00:09:34,789
than the defender portal, which
means a little more than one
337
00:09:34,789 --> 00:09:35,950
screen to learn.
338
00:09:35,950 --> 00:09:37,909
It's also fair to say what these
limits are not.
339
00:09:37,909 --> 00:09:38,750
They're not a sign that
340
00:09:38,750 --> 00:09:40,029
Microsoft held back the
341
00:09:40,029 --> 00:09:41,629
protection to push you toward a
342
00:09:41,629 --> 00:09:42,429
bigger bill.
343
00:09:42,429 --> 00:09:43,789
Because the detection engine is
344
00:09:43,789 --> 00:09:45,190
the same one the enterprise pays
345
00:09:45,190 --> 00:09:45,710
for.
346
00:09:45,710 --> 00:09:48,950
They're the practical edges of a
product built to a certain size,
347
00:09:48,950 --> 00:09:50,789
and anything built to a size
comes with edges.
348
00:09:50,789 --> 00:09:52,990
None of these limits change how
well the protection works,
349
00:09:52,990 --> 00:09:54,590
because they change who it fits.
350
00:09:54,590 --> 00:09:57,470
If you're under three hundred
users, your servers are few and
351
00:09:57,470 --> 00:10:00,409
one set of rules suits you, then
the edges won't bother you if
352
00:10:00,409 --> 00:10:02,710
you're past those lines, they're
the reason to look at the
353
00:10:02,710 --> 00:10:05,149
enterprise option instead.
354
00:10:05,149 --> 00:10:07,629
Defender for business versus
defender for endpoint.
355
00:10:07,629 --> 00:10:08,850
At this point, the natural
356
00:10:08,850 --> 00:10:10,210
question is how this differs
357
00:10:10,210 --> 00:10:11,490
from the bigger product with the
358
00:10:11,490 --> 00:10:12,370
similar name.
359
00:10:12,370 --> 00:10:13,429
The two look like separate
360
00:10:13,429 --> 00:10:14,690
tools, and the names don't help
361
00:10:14,690 --> 00:10:15,730
much, but they come from the
362
00:10:15,730 --> 00:10:16,610
same place.
363
00:10:16,610 --> 00:10:18,690
And the difference is mostly
about scale.
364
00:10:18,690 --> 00:10:21,809
Microsoft Defender for endpoint
is the enterprise product.
365
00:10:21,809 --> 00:10:22,649
It's built for larger
366
00:10:22,649 --> 00:10:23,769
organizations that have a
367
00:10:23,769 --> 00:10:25,169
security team and want deep
368
00:10:25,169 --> 00:10:26,009
control.
369
00:10:26,009 --> 00:10:27,570
It adds advanced tools for
370
00:10:27,570 --> 00:10:28,850
hunting threats across the whole
371
00:10:28,850 --> 00:10:29,610
company.
372
00:10:29,610 --> 00:10:31,129
And it comes in two plans.
373
00:10:31,129 --> 00:10:33,649
The gap between those plans is
worth understanding.
374
00:10:33,649 --> 00:10:35,090
Plan one gives you the basics of
375
00:10:35,090 --> 00:10:36,750
device protection, which means
376
00:10:36,750 --> 00:10:38,210
next generation protection and
377
00:10:38,210 --> 00:10:38,490
attack.
378
00:10:38,490 --> 00:10:39,570
Surface reduction.
379
00:10:39,570 --> 00:10:42,049
Plan two builds on that with
core vulnerability management,
380
00:10:42,049 --> 00:10:45,090
endpoint detection and response,
automated investigation and
381
00:10:45,090 --> 00:10:47,210
remediation, and threat hunting.
382
00:10:47,210 --> 00:10:48,850
It also adds six months of data
383
00:10:48,850 --> 00:10:50,129
retention, thirty days of
384
00:10:50,129 --> 00:10:51,769
advanced hunting data, and a
385
00:10:51,769 --> 00:10:53,169
service called Microsoft Threat
386
00:10:53,169 --> 00:10:54,850
Experts, where Microsoft's own
387
00:10:54,850 --> 00:10:56,409
analysts help investigate
388
00:10:56,409 --> 00:10:57,490
serious attacks.
389
00:10:57,490 --> 00:10:59,169
So where does defender for
business land?
390
00:10:59,169 --> 00:11:00,370
It includes everything in plan
391
00:11:00,370 --> 00:11:01,929
one, plus some of what plan two
392
00:11:01,929 --> 00:11:03,129
offers, plus a few features
393
00:11:03,129 --> 00:11:04,169
built specifically for small
394
00:11:04,169 --> 00:11:04,850
business.
395
00:11:04,850 --> 00:11:07,370
Those small business extras
include a simplified firewall
396
00:11:07,370 --> 00:11:10,679
and antivirus setup for windows,
and a monthly security summary
397
00:11:10,679 --> 00:11:13,399
report that lands in your inbox.
398
00:11:13,399 --> 00:11:14,840
Advanced hunting is the clearest
399
00:11:14,840 --> 00:11:16,360
example of the split in the
400
00:11:16,360 --> 00:11:17,399
enterprise plan.
401
00:11:17,399 --> 00:11:18,899
It lets an analyst write queries
402
00:11:18,899 --> 00:11:20,759
against months of security data
403
00:11:20,759 --> 00:11:22,240
to trace an attacker across the
404
00:11:22,240 --> 00:11:23,080
whole company.
405
00:11:23,080 --> 00:11:25,519
That's powerful work, and it
takes a trained person and
406
00:11:25,519 --> 00:11:26,600
plenty of time.
407
00:11:26,600 --> 00:11:29,120
A small business rarely has
either one, so a defender for
408
00:11:29,120 --> 00:11:31,480
business keeps the automated
parts and leaves the deep manual
409
00:11:31,480 --> 00:11:33,240
investigation to the plan.
410
00:11:33,240 --> 00:11:35,320
Built for teams that do it all
day.
411
00:11:35,320 --> 00:11:36,399
The cleanest way to hold it all
412
00:11:36,399 --> 00:11:37,419
together is the number three
413
00:11:37,419 --> 00:11:38,840
hundred under three hundred
414
00:11:38,840 --> 00:11:39,240
users.
415
00:11:39,240 --> 00:11:41,759
Defender for business is the fit
and over three hundred.
416
00:11:41,759 --> 00:11:43,039
Microsoft recommends an
417
00:11:43,039 --> 00:11:44,159
enterprise plan such as
418
00:11:44,159 --> 00:11:44,960
Microsoft three.
419
00:11:44,960 --> 00:11:47,759
Sixty five E3 or E5 or defender
420
00:11:47,759 --> 00:11:49,379
for Endpoint Plan one or plan
421
00:11:49,379 --> 00:11:49,919
two.
422
00:11:49,919 --> 00:11:51,200
The protection core is shared
423
00:11:51,200 --> 00:11:52,559
across all of them, so you're
424
00:11:52,559 --> 00:11:54,080
not choosing between strong and
425
00:11:54,080 --> 00:11:54,559
weak.
426
00:11:54,559 --> 00:11:55,919
You're choosing the packaging
427
00:11:55,919 --> 00:11:57,240
that matches the size of your
428
00:11:57,240 --> 00:11:58,000
team.
429
00:11:58,000 --> 00:11:59,879
What it costs and how to get it
430
00:11:59,879 --> 00:12:00,919
cost is usually the last
431
00:12:00,919 --> 00:12:01,480
question.
432
00:12:01,480 --> 00:12:02,600
And here it's simple.
433
00:12:02,600 --> 00:12:03,840
Defender for business costs
434
00:12:03,840 --> 00:12:05,039
three dollars per user per
435
00:12:05,039 --> 00:12:05,279
month.
436
00:12:05,279 --> 00:12:08,039
When you buy it on its own and
pay yearly for that price.
437
00:12:08,039 --> 00:12:11,500
Each user is covered across as
many as five devices and there
438
00:12:11,500 --> 00:12:12,860
is no minimum device count.
439
00:12:12,860 --> 00:12:14,259
There's a second route worth
440
00:12:14,259 --> 00:12:15,379
understanding because for many
441
00:12:15,379 --> 00:12:16,460
businesses, it's the better
442
00:12:16,460 --> 00:12:17,059
deal.
443
00:12:17,059 --> 00:12:17,740
Microsoft three.
444
00:12:17,740 --> 00:12:18,779
Sixty five Business Premium
445
00:12:18,779 --> 00:12:19,940
includes defender for business
446
00:12:19,940 --> 00:12:21,580
as part of the plan, and it adds
447
00:12:21,580 --> 00:12:23,179
a lot on top, including email
448
00:12:23,179 --> 00:12:24,820
protection, device management,
449
00:12:24,820 --> 00:12:26,299
identity protection, and data
450
00:12:26,299 --> 00:12:27,539
protection tools.
451
00:12:27,539 --> 00:12:29,259
Business premium costs more per
user.
452
00:12:29,259 --> 00:12:31,899
So the real question is whether
you need those extra pieces.
453
00:12:31,899 --> 00:12:34,460
If you do, the bundle usually
wins to make the choice.
454
00:12:34,460 --> 00:12:38,139
Concrete picture two small
companies, one already has email
455
00:12:38,139 --> 00:12:41,059
and identity handled elsewhere
and only needs its devices
456
00:12:41,059 --> 00:12:44,019
protected, so the three dollars
standalone plan fits.
457
00:12:44,019 --> 00:12:45,019
The other is starting from
458
00:12:45,019 --> 00:12:46,259
scratch and needs email
459
00:12:46,259 --> 00:12:48,019
security, device management, and
460
00:12:48,019 --> 00:12:48,779
data protection.
461
00:12:48,779 --> 00:12:49,779
At the same time.
462
00:12:49,779 --> 00:12:51,340
The bundle saves money and setup
463
00:12:51,340 --> 00:12:52,620
effort by covering all of it in
464
00:12:52,620 --> 00:12:53,419
one place.
465
00:12:53,419 --> 00:12:56,259
If you want to test before you
commit, Microsoft offers a one
466
00:12:56,259 --> 00:12:59,419
month free trial, a credit card
is required, and the trial turns
467
00:12:59,419 --> 00:13:02,460
into a paid subscription unless
you cancel it during the month.
468
00:13:02,460 --> 00:13:04,179
Server protection is separate at
469
00:13:04,179 --> 00:13:05,299
three dollars per server
470
00:13:05,299 --> 00:13:06,779
instance, and if you'd rather
471
00:13:06,779 --> 00:13:08,379
not buy it directly, Microsoft
472
00:13:08,379 --> 00:13:09,460
recommends working with a
473
00:13:09,460 --> 00:13:10,759
partner who can set it up for
474
00:13:10,759 --> 00:13:11,120
you.
475
00:13:11,120 --> 00:13:13,720
Add up the picture and the value
is easy to see.
476
00:13:13,720 --> 00:13:14,919
That three dollars price buys
477
00:13:14,919 --> 00:13:16,080
the same protection engine that
478
00:13:16,080 --> 00:13:17,580
large enterprises rely on with a
479
00:13:17,580 --> 00:13:18,720
guided wizard and default
480
00:13:18,720 --> 00:13:19,559
policies.
481
00:13:19,559 --> 00:13:21,120
So a small team can actually run
it.
482
00:13:21,120 --> 00:13:23,960
That's the promise this product
makes, and the price is part of
483
00:13:23,960 --> 00:13:25,399
why it holds up.
484
00:13:25,399 --> 00:13:27,000
The recap and one question
485
00:13:27,000 --> 00:13:28,440
defender for business is an
486
00:13:28,440 --> 00:13:29,879
endpoint security tool built for
487
00:13:29,879 --> 00:13:31,600
small and medium businesses with
488
00:13:31,600 --> 00:13:32,799
a hard cap of three hundred
489
00:13:32,799 --> 00:13:34,399
users, and it runs on the same
490
00:13:34,399 --> 00:13:36,039
engine as Microsoft's enterprise
491
00:13:36,039 --> 00:13:36,759
product.
492
00:13:36,759 --> 00:13:39,559
It does for jobs on every
device, which are finding weak
493
00:13:39,559 --> 00:13:41,820
spots, protecting against
malware and ransomware,
494
00:13:41,820 --> 00:13:44,879
detecting and responding to real
attacks and helping you recover.
495
00:13:44,879 --> 00:13:47,519
You set it up with a wizard, and
it doesn't require a security
496
00:13:47,519 --> 00:13:48,120
team to run.
497
00:13:48,120 --> 00:13:49,519
It runs three dollars per user
498
00:13:49,519 --> 00:13:51,120
each month on its own, or it
499
00:13:51,120 --> 00:13:52,399
comes included with Microsoft
500
00:13:52,399 --> 00:13:53,259
three hundred sixty five
501
00:13:53,259 --> 00:13:54,200
Business Premium.
502
00:13:54,200 --> 00:13:56,639
The protection is real, the
setup is manageable, and the
503
00:13:56,639 --> 00:13:59,200
cost is small enough that the
only question left is whether it
504
00:13:59,200 --> 00:14:00,240
fits your situation.
505
00:14:00,240 --> 00:14:02,360
That leaves one question worth
asking yourself.
506
00:14:02,360 --> 00:14:05,299
Microsoft's own report found
that attackers go after small
507
00:14:05,299 --> 00:14:07,799
businesses because there are
fewer people standing guard.
508
00:14:07,799 --> 00:14:10,399
So what is guarding the laptops,
the phones and the tablets your
509
00:14:10,399 --> 00:14:11,919
business depends on right now.
