Is the free Microsoft Defender Antivirus in Windows not enough?

It is a good foundation and should stay switched on. But without EDR you cannot see suspicious behaviour, cannot isolate a laptop remotely and have no central overview of all devices. For a business with customer data and several employees, that is not enough.

Do I need Microsoft 365 Business Premium for Defender for Business?

No, Defender for Business can also be bought separately alongside other Microsoft 365 plans. It is included as standard in Business Premium, together with Intune and Conditional Access, which makes management simpler.

Does EDR also work on Macs, phones and servers?

Besides Windows, Defender for Business supports macOS, iOS and Android. Servers need a separate licence. Include those devices too, because an attacker will pick the weakest one.

Will employees notice EDR?

Usually not. EDR runs in the background. Only when something suspicious happens does an employee see a notification or have something blocked. Agree that staff report such a notification straight away and do not try to work around it.

From antivirus to EDR: why an SME needs more than a virus scanner

Almost every SME has a virus scanner on its laptops, often the built-in Microsoft Defender Antivirus or a separate package bought years ago. That feels safe. But modern attacks increasingly use no recognisable virus at all. An attacker signs in with a stolen password, uses ordinary Windows tools such as PowerShell or a remote management program, and only deploys ransomware at the very end. A classic virus scanner sees little of that. EDR is built to recognise and stop exactly that behaviour.

What a virus scanner does and does not do

A classic virus scanner works largely with signatures: characteristics of known malicious files. If such a file arrives through an attachment or download, it is blocked. That is still useful and should stay switched on. The problem is that attackers know this. They tweak their software until it is no longer recognised, or they use no software of their own at all. With a stolen account and the tools already on every Windows laptop, they can look around, collect data and move through the network without a single “virus” in sight.

What EDR adds

EDR stands for Endpoint Detection and Response. An endpoint is a device, such as a laptop, PC or server. EDR continuously tracks what happens on that device and looks for suspicious patterns. Think of Word suddenly launching a command line, a process encrypting large numbers of files, or a program trying to read passwords from memory. When it sees such a pattern, EDR:

Detects the behaviour, even if the file involved is not yet known anywhere as malicious.
Responds by stopping the process, quarantining files or isolating the laptop from the network, so an attack cannot spread.
Records what happened in a timeline. Afterwards you can see how the attacker got in and which devices were affected.

Microsoft Defender for Business for SMEs

For businesses that already work with Microsoft 365, Microsoft Defender for Business is often the simplest step. It is designed for organisations with up to three hundred users and is included in Microsoft 365 Business Premium; it can also be bought separately. It builds on the antivirus already in Windows and adds EDR, automated investigation and remediation, and an overview of vulnerabilities. You roll it out through Intune, together with your compliance policies, so every managed laptop is protected automatically. If you already use another EDR product, that is fine too; what matters is that it runs on every device and is managed centrally.

Following up alerts is half the work

EDR that raises alerts nobody reads offers little protection. Many attacks are carried out in the evening or at the weekend, precisely because nobody is watching. So agree who receives the alerts, how quickly someone responds and what happens with a serious alert. Record that in your IT incident plan. Turn on automated remediation where possible, so Defender cleans up known threats itself and a person can focus on what really needs attention.

EDR does not replace the basics

EDR is an extra layer, not a cure-all. It works best combined with MFA, up-to-date systems through patch management, staff without local admin rights and a backup that survives ransomware. More and more cyber insurers also ask explicitly about EDR; see what a cyber insurer expects from your IT.

How Floor ICT handles this

Floor ICT rolls out Microsoft Defender for Business to all your laptops, PCs and servers through Intune and checks that no device is missing. We set up the policies, turn on automated investigation and remediation, and connect the alerts to our monitoring. With a serious alert, we isolate the device, find out what happened and restore it. You receive a regular overview of alerts and vulnerabilities, in plain language.

View MSP packages Request an intake Microsoft 365