What is Microsoft Defender for Endpoint Plan 1 / Plan 2? Explaining E3 and E5 Endpoint Protection
About This Article
This article was created using an automated generation workflow powered by generative AI. Microsoft's official information was re-verified on September 18, 2026, to organize Plan 1/2, E3/E5, and mixed licensing from a practical perspective.Verification Status: 📘 Microsoft Official Information Verified / Physical Device Not Tested
Microsoft Defender for Endpoint (MDE) is an endpoint security solution that protects devices such as Windows, macOS, Linux, Android, and iOS.Endpointrefers to user-operated devices such as PCs and smartphones, whileEDRstands for Endpoint Detection and Response, which records and detects post-intrusion behavior to facilitate investigation and response.
E3/E5 and Plan 1/2
According to official Microsoft information as of 2026, Microsoft 365 E3 includes Defender for Endpoint Plan 1, while Microsoft 365 E5 includes Plan 2. Plan 1 focuses primarily on prevention and Attack Surface Reduction, whereas Plan 2 expands to include EDR, advanced investigation, and response capabilities.
| Aspect | Plan 1 | Plan 2 |
|---|---|---|
| Next-generation protection / ASR | ○ | ○ |
| Advanced detection and investigation including EDR | — | ○ |
| Plan 2 features such as automated investigation and remediation | — | ○ |
| Representative Microsoft 365 SKUs | E3 | E5 |
Since detailed features are subject to change, the latest Microsoft comparison table should be treated as the source of truth.
flowchart LR LIC[E3=P1 / E5=P2] --> ONB[端末をOnboard] ONB --> SIG[センサー/保護信号] SIG --> PORTAL[Microsoft Defender portal] PORTAL --> OPS[監視・調査・対応]
First Step: Read Status Without Making Changes
In the Defender portal, go to Settings > Endpoints > Licenses to check your subscription status, then go to Assets > Devices to open a device and check its OS, onboarding status, and last seen timestamp. Do not perform device isolation or quarantine during this initial check.
Microsoft provides guidance on mixed mode for tenants with a mix of Plan 1 and Plan 2. In addition to user license assignments, verify the subscription settings and conditions such as device tags. Note that it may take some time for settings to take effect.
Viewing Local Status with PowerShell
Get-MpComputerStatus |
Select-Object AntivirusEnabled, RealTimeProtectionEnabled,
AntivirusSignatureLastUpdated
Key points to checkare the antivirus status, real-time protection, and definition update timestamp.The success conditionis that the status can be successfully retrieved. However, this only verifies the local Defender Antivirus and does not independently prove successful onboarding to MDE. If you want to modify one part, add Select-Object to AMRunningMode and verify the operating mode.
Perspectives of General Users, Administrative Staff, and IT Admins
General users should report alerts rather than dismissing them based on their own judgment. For administrative staff, it is practical to establish a workflow to verify whether replacement devices or home PCs are properly managed. IT admins should validate "license assignment -> onboarding -> policy -> sensor health -> alert operations" as separate phases.
Key Points for Administrators to Verify
E3 = Plan 1, E5 = Plan 2, and additional Security SKUs
Subscription settings for mixed-license scenarios
Number of onboarded devices and target OSs
Endpoint security policies in Intune, etc.
Demarcation of responsibility for EDR, ASR, Firewall, and AV
Plan 2 is licensed per user, and official Microsoft documentation states that a single user can onboard up to 5 devices concurrently.
Servers have different requirements than clients, so verify Defender for Servers or other relevant licenses separately.
RBAC and approval workflows for high-impact actions like device isolation
Official Microsoft Primary Sources
The difference between Plan 1 and Plan 2 is not simply "stronger antivirus protection," but rather which capabilities—ranging from prevention to detection, investigation, and response—are included in the service.
