defender-for-business
starsforks
How to install defender-for-business?
vinayaklatthe/microsoft-security-skills/defender-for-business
$npx -y skills add vinayaklatthe/microsoft-security-skills --skill defender-for-businessGuidance for Microsoft Defender for Business (MDB) — the SMB-segment endpoint security product (≤300 employees), bundled with Microsoft 365 Business Premium and available as a standalone SKU. Covers what's included vs MDE Plan 1/2 (next-gen AV, EDR with simplified configuration,
SKILL.md
| 1 | # Microsoft Defender for Business |
| 2 | |
| 3 | Defender for Business (MDB) is endpoint security packaged for the **small-and-medium- |
| 4 | business (SMB) segment** — up to 300 employees. It includes most of MDE Plan 2's protective |
| 5 | power (next-gen AV, EDR, ASR, automated investigation, vulnerability management) with a |
| 6 | **simplified, wizard-driven configuration** so a small IT team or an MSP can deploy and |
| 7 | operate it without a dedicated SOC. |
| 8 | |
| 9 | It's bundled with **Microsoft 365 Business Premium** and available as a standalone SKU. |
| 10 | For MSPs, it's delivered through **Microsoft 365 Lighthouse** for multi-tenant management. |
| 11 | |
| 12 | ## When to use |
| 13 | You're an SMB up to ~300 employees, or an MSP delivering security to SMB customers, and |
| 14 | you need real endpoint protection without an enterprise SOC budget. |
| 15 | |
| 16 | **Do not use this skill** for enterprise EDR (`defender-for-endpoint`), Defender XDR |
| 17 | cross-product investigation (`defender-xdr`), or Azure server protection |
| 18 | (`defender-for-servers`). |
| 19 | |
| 20 | ## What's in MDB |
| 21 | |
| 22 | | Capability | MDB | MDE P1 | MDE P2 | |
| 23 | |---|---|---|---| |
| 24 | | Next-gen AV | ✅ | ✅ | ✅ | |
| 25 | | Attack surface reduction | ✅ | ✅ | ✅ | |
| 26 | | Web content filtering | ✅ | ✅ | ✅ | |
| 27 | | EDR | ✅ (simplified) | — | ✅ | |
| 28 | | Automated investigation & remediation (AIR) | ✅ | — | ✅ | |
| 29 | | Vulnerability management | ✅ (subset) | — | ✅ | |
| 30 | | Threat intel & advanced hunting (Defender XDR) | Limited | — | ✅ | |
| 31 | | Mobile threat defense (iOS/Android) | Add-on / via Intune | — | Yes | |
| 32 | | Server protection | **MDB Servers** add-on (≤60 servers) | via DfC | via DfC | |
| 33 | |
| 34 | > **Rule of thumb:** MDB stops where you need a SOC analyst doing advanced hunting in |
| 35 | > raw tables. At ~300 users / multi-site / regulated, plan migration to MDE P2 + E5. |
| 36 | |
| 37 | ## Approach |
| 38 | |
| 39 | 1. **License path.** Most SMBs get MDB via **Microsoft 365 Business Premium** — |
| 40 | bundled with Entra P1, Intune, and DLP basics. Check seat count: MDB is hard-capped |
| 41 | at 300 users; once you exceed, you must move to enterprise SKUs. |
| 42 | |
| 43 | 2. **Onboard via the simplified setup wizard** in security.microsoft.com → Assets → |
| 44 | Devices. Three default device groups: workstations, mobile, servers (servers via |
| 45 | add-on). Wizard pre-configures sensible defaults for AV, ASR, EDR. |
| 46 | |
| 47 | 3. **Default policies are usable as shipped, but tune two things:** |
| 48 | - **ASR rules** — review the audit-mode hits in the first 14 days; promote rules |
| 49 | to block one at a time. |
| 50 | - **Web content filtering** — turn on the categories that match your use (block |
| 51 | gambling, adult, illegal). Don't be aggressive on day one. |
| 52 | |
| 53 | 4. **AIR remediation level.** Default is *Semi* (require approval). For workstations, |
| 54 | move to *Full* once the team has confidence. Servers stay *Semi*. |
| 55 | |
| 56 | 5. **Vulnerability management.** Surfaces top exposures and pushes patch tasks. Pair |
| 57 | with Intune patch management (where licensed) to actually deploy. |
| 58 | |
| 59 | 6. **Mobile devices.** MDB on iOS and Android is delivered via the Defender app |
| 60 | (Intune-managed deployment, recommended). Provides web protection, network |
| 61 | protection, and app risk detection. Real-time AV on Android. |
| 62 | |
| 63 | 7. **Servers add-on.** *MDB Servers* protects up to 60 Windows or Linux servers per |
| 64 | tenant — adequate for SMB but not enterprise. Onboard via the same simplified |
| 65 | model. Once you exceed 60 or need DfC posture/JIT/FIM, switch to Defender for |
| 66 | Servers (`defender-for-servers`). |
| 67 | |
| 68 | 8. **MSP / multi-tenant delivery.** Microsoft 365 Lighthouse aggregates MDB across |
| 69 | customer tenants for an MSP: |
| 70 | - Cross-tenant device inventory and threat dashboard. |
| 71 | - Baseline policy templates pushed to multiple tenants. |
| 72 | - Multi-tenant alert triage. |
| 73 | Pair with delegated admin (GDAP) — never DAP — for secure access. |
| 74 | |
| 75 | 9. **Transition path to enterprise.** Trigger criteria for moving to MDE P2 / E5: |
| 76 | - Crossing 300 users. |
| 77 | - Regulated industry needing advanced hunting / KQL / 30+ day raw teleme |
People who liked this also viewed
6 picksType
- entra-app-registrationGuides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API perSkillsJul 2026
- azure-complianceRun Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: SkillsJul 2026
- azure-rbacOfficial agent plugin providing skills and MCP server configurations for Azure scenarios.SkillsJul 2026
- better-auth-best-practicesAgent skill from better-auth/skillsSkillsJul 2026
- firebase-security-rules-auditorA skill to evaluate how secure Firestore security rules are. Use this when Firestore security rules are updated to ensure that the generated rules are extremely secure and robust.SkillsJul 2026
- audit-websiteAudit a website with the squirrelscan CLI and fix the findings in code. Runs SEO, performance, security, technical, content, accessibility, and 15 other rule categories (260+ rules), returns an LLM-opSkillsJul 2026
