Microsoft 365 Defender Australia — Business Security Suite Guide

Microsoft 365 Defender is Microsoft's unified security suite — combining Defender for Office 365 (email protection), Defender for Endpoint (device protection), Defender for Identity (Active Directory and Entra ID protection), and Defender for Cloud Apps (shadow IT and cloud app governance) into a single security operations platform. For Australian businesses on Microsoft 365 Business Premium, Defender for Office 365 Plan 1 and Defender for Business are both included at no additional cost.

Microsoft Defender products — what's included in each Microsoft 365 plan

Microsoft Defender Antivirus ships with Windows 11 on every plan and provides baseline endpoint antimalware. Defender for Business is included in Business Premium and delivers EDR, automated investigation and response, and vulnerability management for up to 300 devices — it is the SMB-specific packaging of Defender for Endpoint. Defender for Office 365 Plan 1 is also included in Business Premium, covering anti-phishing, anti-malware, Safe Links URL scanning, and Safe Attachments sandboxing across email and Teams. Defender for Office 365 Plan 2 comes with E5 and adds threat intelligence, attack simulation training, and automated investigation and response for email.

On the endpoint side, Defender for Endpoint Plan 1 is effectively what Business Premium customers get via Defender for Business, while Defender for Endpoint Plan 2 ships with E5 and adds advanced EDR, proactive threat hunting, and a 180-day investigation timeline. Defender for Identity (E5) detects Active Directory and Entra ID attacks including lateral movement. Microsoft Sentinel is a separate add-on — a cloud-native SIEM for enterprise environments, billed on ingestion.

Microsoft Defender for Business — Essential Eight alignment for Australian SMBs

Defender for Business maps directly onto several Essential Eight controls. Patch Applications: Defender Vulnerability Management inventories unpatched applications and prioritises remediation by exploitability. Patch Operating Systems: Defender reports OS patch compliance per device, so gaps are visible rather than assumed. Application Control: Defender Application Control policies deploy through Intune and block unsigned executables. Configure Microsoft Office Macro Settings: Attack Surface Reduction rules block macro execution from internet-sourced files. User Application Hardening: further ASR rules block web shell execution, scripting engine abuse, and other high-risk behaviours.

Restrict Administrative Privileges and Multi-Factor Authentication are strengthened by Defender for Identity, which detects privilege escalation and MFA bypass techniques such as pass-the-hash and pass-the-ticket. Mycelium 365 configures Defender for Business as a core component of every Essential Eight gap remediation engagement — see our guide to Essential Eight compliance for Melbourne businesses.

Microsoft Defender for Office 365 — protecting Australian business email

Safe Attachments detonates every email attachment in an isolated sandbox before delivery, so zero-day malware is blocked before it reaches the inbox rather than being caught by signature matching afterwards. Safe Links rewrites and scans URLs in email and Teams messages at click time, which defeats time-of-click weaponisation where an attacker sends a clean link and arms it hours later.

Anti-phishing adds impersonation protection for named executives and sender domains, spoof intelligence, and mailbox intelligence built from Microsoft's global telemetry of roughly 8.5 trillion signals per day. Attack Simulation Training, included in Defender for Office 365 Plan 2, runs realistic phishing campaigns against your own staff and automatically assigns remediation training to anyone who clicks.

Australian businesses see an average of 3.4 targeted phishing attempts per user per month. Defender for Office 365 blocks the overwhelming majority before they reach staff inboxes — but only when the policies are actually configured.

Setting up Microsoft 365 Defender for an Australian business

Five configuration steps are missed in most Australian tenants we audit. Enable the Standard or Strict preset security policies — many tenants run Custom policies that quietly omit important protections, while the Standard preset applies Microsoft's recommended baseline in a single click. Configure anti-phishing impersonation protection by adding all executives and key sender domains to the impersonation list; this is not enabled by default.

Activate Defender for Business in the Microsoft 365 Defender portal — it must be explicitly turned on, and plenty of tenants hold Business Premium licences with Defender for Business sitting inactive. Connect Intune to Defender for Business so device compliance signals flow between the two; this is a one-time connector setup in the Defender portal, and it pairs with proper Intune device management. Finally, complete DMARC, DKIM, and SPF — Defender's anti-spoofing depends on correct email authentication, and incomplete records are common across Australian tenants.

Microsoft Defender vs third-party security tools for Australian businesses

The common alternatives Australian SMBs consider are CrowdStrike Falcon Go (around AUD $8.50 per device per month standalone), SentinelOne Singularity Core (around AUD $6–9 per device per month) and Sophos Intercept X (around AUD $7–12 per device per month). All three deliver EDR capability broadly comparable to Defender for Business — at an additional licence cost.

For businesses already on Microsoft 365 Business Premium, Defender for Business is included at no additional cost, which makes it effectively free enterprise-grade EDR. The incremental step from Business Standard to Business Premium ($11.10 per user per month) simultaneously buys Intune, Entra ID P1, Defender for Business, and Defender for Office 365 Plan 1 — better value than bolting a standalone EDR product onto Business Standard.

Our recommendation for Australian SMBs is to run Defender for Business as the primary endpoint security tool and supplement it with Huntress for 24/7 SOC coverage, rather than paying twice for overlapping EDR.

How Mycelium 365 manages Microsoft 365 Defender for Australian businesses

Mycelium 365 configures, monitors, and reports on the full Defender stack as part of managed Microsoft 365 — preset security policies, ASR rules, impersonation protection, vulnerability remediation, and monthly security reporting. Defender alerts feed into our security operations centre for 24/7 triage and response, so detections are actioned rather than accumulating in a portal nobody opens.

Read our guides to Zero Trust security in Microsoft 365 and managed Microsoft 365 services, compare packages and pricing, or contact our team for a Defender configuration review.