What is Microsoft Defender for Endpoint Plan 1 / Plan 2? Understanding endpoint protection in E3 and E5
About this article
This article was created using an automated generation workflow leveraging generative AI. Official Microsoft documentation was re-verified on 2026-09-18, and Plan 1/2, E3/E5, and mixed licenses are organized from a practical standpoint.Verification Status: 📘 Confirmed via official Microsoft documentation, physical hardware not tested
Microsoft Defender for Endpoint (MDE) is an endpoint security solution that protects devices such as Windows, macOS, Linux, Android, and iOS.Endpoint refers to devices operated by users, such as PCs and smartphones, whileEDR stands for Endpoint Detection and Response, which records and detects post-intrusion behavior to facilitate investigation and response.
E3/E5 and Plan 1/2
According to official Microsoft information as of 2026, Microsoft 365 E3 includes Defender for Endpoint Plan 1, and Microsoft 365 E5 includes Plan 2. P1 focuses on prevention and Attack Surface Reduction (ASR), whereas P2 extends to EDR, advanced investigation, and response.
| Perspective | Plan 1 | Plan 2 |
|---|---|---|
| Next-generation protection / ASR | ○ | ○ |
| Advanced detection and investigation including EDR | — | ○ |
| P2 features such as automated investigation and remediation | — | ○ |
| Representative Microsoft 365 SKUs | E3 | E5 |
Because detailed features are subject to updates, the latest Microsoft comparison table serves as the authoritative source.
flowchart LR LIC[E3=P1 / E5=P2] --> ONB[端末をOnboard] ONB --> SIG[センサー/保護信号] SIG --> PORTAL[Microsoft Defender portal] PORTAL --> OPS[監視・調査・対応]
First step: Read the status without making changes
Check the subscription status in the Defender portal under Settings > Endpoints > Licenses, and then open a device under Assets > Devices to read the OS, onboarding status, and last seen time. Do not perform device isolation or quarantine during the initial check.
Microsoft provides guidance on mixed mode for tenants where P1 and P2 coexist. In addition to assigning licenses to users, verify conditions such as subscription settings and device tags. It may take some time for settings to take effect.
Checking local status using PowerShell
Get-MpComputerStatus |
Select-Object AntivirusEnabled, RealTimeProtectionEnabled,
AntivirusSignatureLastUpdated
Key points to check are antivirus and real-time protection status, and definition update timestamps.Success criteria are the ability to retrieve the status. However, this only confirms the local Defender Antivirus and does not independently prove successful MDE onboarding. If you change one thing, add Select-Object to AMRunningMode and check the operational mode.
Perspectives of general users, office workers, and IT administrators
General users should report warnings rather than dismissing them on their own judgment. For office workers, establishing an operational workflow to verify whether device replacements or remote work PCs are covered under management is practical. IT administrators should validate "license assignment -> onboarding -> policy -> sensor health -> alert operations" as separate processes.
Items for administrators to verify
E3 = P1, E5 = P2, and additional Security SKUs
Subscription settings in mixed-license scenarios
Number of onboarded devices and target operating systems
Endpoint security policies in Intune and similar tools
Division of responsibility across EDR, ASR, Firewall, and AV
P2 is licensed per user, and official Microsoft documentation states a limit of up to 5 concurrently onboarded devices per user
Servers have different conditions than clients, so verify solutions like Defender for Servers separately
RBAC and approvals for high-impact actions such as isolation
Official Microsoft primary sources
Plan 1 and Plan 2 are not simply a matter of "antivirus strength," but rather represent a difference in the scope of services provided, ranging from prevention to detection, investigation, and response.
