A company using Microsoft 365 Business Premium adds Defender for Endpoint Plan 2 for its security team. The portal still shows Defender for Business. That does not necessarily mean the licence assignment failed. Microsoft distinguishes user entitlements, subscriptions and the endpoint security experience of the tenant.
Microsoft security names are easily confused. Business Premium includes Microsoft Defender for Business. This is a product for small and medium organizations, not the full Defender for Endpoint Plan 2 under a different name. At the same time, it is not true that it is only Plan 1 with a new icon: Microsoft presents the functions of P1, part of the functions of P2 and its own simplified options. The exact comparison is in the Official Defender for Business Overview.
A practical problem arises when a company wants to add P2 to just a few people or devices. Three questions need to be separated: to whom the license is assigned, what functions the device should have and what endpoint security mode is running in the tenant. The SKU name on the invoice alone does not answer the last question.
What is already in Business Premium
Business Premium includes Defender for Business to protect end devices. The product is designed for organizations with up to 300 users. For example, it provides antivirus protection, attack surface limitation, optimized endpoint detection and response, and automated investigation. The comparison according to Microsoft is not a simple "P1 versus P2": some advanced features are also in the Business version, others remain in P2.
Therefore, a list of marketing names is not enough to decide on a supplement. Write down a specific requirement of the security team: do you need longer data availability for hunting, live response, a certain type of investigation, or just a better way of working with incidents? Verify the feature in the current product table and in the pilot tenant. Otherwise, you can buy a P2 without solving a real operational deficiency.
Business Premium itself also does not mean automatic server coverage. Microsoft describes server add-ons and other plans separately. Include the server in your inventory, but don't count it as a regular user laptop.
What happens if you add P2 licences for only some users
Here is an essential boundary. According to the Microsoft 365 Business Premium security FAQ Defender for Business does not support mixed licensing mode with Defender for Endpoint P2 as businesses often imagine. Microsoft gives an example of 80 users with Business Premium, of which 30 will receive an additional add-on with P2. The result is a Defender for Business environment for everyone.
This does not mean that the assigned P2 license does not exist in the administration. This means that adding it for only some users will not by itself switch the tenant to the expected Defender for Endpoint P2 experience. Therefore, the security team should not approve a purchase based on the assumption that "we will give P2 to five analysts and the feature will appear on five devices".
| Licence mix | What it means | Common wrong assumption |
|---|---|---|
| Business Premium for users | Defender for Business is included | "It's full Endpoint P2" |
| Business Premium plus P2 for only some users | A P2 license can be assigned, but by default the tenant remains in the Business experience | "P2 function is automatically separated by device" |
| P2 for all relevant users and transition through support | A transition to the Defender for Endpoint experience may be possible through Microsoft support | "Just flip one switch" |
| Defender for Endpoint P1 + P2 without Defender for Business | Microsoft describes a separate supported P1/P2 mix | "The same procedure applies to Business" |
| Servers | They require separate product assessment and authorization | "They are automatically in Business Premium" |
The table does not change the product conditions. Please verify the exact SKU, number of people and intended features in the current documentation and product offer before ordering.
Do not confuse a P1/P2 mix with Business plus P2
Microsoft has guidance on how to combine Defender for Endpoint Plan 1 and Plan 2 in a certain scenario and control the capabilities of selected devices using settings and labels. This leads to the conclusion that the same procedure works with Defender for Business. But the document explicitly states that Defender for Business is not supported in this mixed mode.
The statement "P1 + P2 mix is possible" is therefore correct only with the product description. If your tenant is based on Business Premium and Defender for Business, do not borrow the procedure for two Defender for Endpoint plans without verification. You can prepare labels and policies that do not match the actual tenant mode.
When does it make sense to switch to Endpoint P2?
Start the transition from the need, not the SKU. Write down which specific ability the Business version does not provide or does not fulfill to the required extent. Add the number of users, device types, server systems, security team responsibilities, and required incident handling time. Then compare the value of the solution to the difficulty of the change.
If the goal is indeed a Defender for Endpoint P2 experience, Microsoft describes two steps in Business Premium FAQ: P2 cover all users affected by the transition in that licensing model, and ask Microsoft Support to switch the organization. Separate procedure says that the company should have a sufficient number of active trial or paid licenses before applying.
After the switch, it is not enough to celebrate the new name in the portal. Review incident response policies, onboarding, reporting and procedures. Some of the settings designed for simplified Business mode will need to be reassessed. Also plan for the return and communication of the team; an environment transition is not suitable as an unannounced experiment in production.
Checks before and after purchase
Take one particular missing scenario and perform these six checks:
- Describe the functionality you want. For example, a specific method of hunting or responding, not just a general "we need P2".
- Check feature comparison. Microsoft is may change product capabilities; don't decide based on the outdated forum comparison.
- Add up target users and devices. Create a separate row for servers.
- Determine tenant status. In the Defender portal, open Settings → Endpoints → Licenses and record the current subscription and usage according to Microsoft's procedure.
- Review change path. If you require P2 experience, include necessary licenses and support communications; don't expect immediate automatic switching.
- Test the resulting functionality. After the change, verify the analyst's specific work task as well as the protection of representative devices.
The license usage overview may be an estimate derived from device logins and may not be reflected immediately, according to Microsoft. A one-off screen shortly after a change may not mean the final state.
A practical example
A hypothetical company has 90 Business Premium users and wants advanced P2 functionality for ten security and IT team members. Purchases ten P2 licenses. However, they still see Defender for Business in the portal. The first check is not "why the licenses were not registered", but whether the company expects a mode that Microsoft does not support for the Business + P2 combination. If he really needs the full P2 experience, he needs to recalculate the coverage and go through the support process as described. If he only needs a better process of working with alerts, it may turn out that the requirement is already solved by the current Business version and the correct configuration.
This is a hypothetical example, not a quotation or a recommendation to buy 90 add-on licences. It shows why the required feature should be defined before ordering.
Frequently asked questions
Does Business Premium include Defender for Endpoint P2?
No. Includes Defender for Business. The products share some capabilities but are not identical. Compare the exact feature you want in Microsoft's current overview.
Can we add P2 to just the security team?
Licenses can be ordered and assigned, but don't expect a tenant with Defender for Business to automatically split into a Business and P2 experience based on those users. Microsoft does not support this mixed mode.
Why does Microsoft describe mixed P1/P2 licenses elsewhere?
It is a combination of two Defender for Endpoint plans. The document explicitly distinguishes Defender for Business and provides a different procedure for it.
Does the environment switch itself after purchasing P2 for everyone?
Current Microsoft practice requires sufficient P2 coverage and support contact to change the organization's experience. Do not plan the transition as an immediate automatic effect of the order.
Are servers also licensed in Business Premium?
Consider server protection separately. Microsoft offers a specific server add-on for Business and other server plans. The basic Business Premium user alone is not sufficient to derive rights for each server.
A practical conclusion
Before you purchase P2, match the security feature you want with a specific licensing and operational plan. Check the status of the tenant, decide on the coverage you really need, and deal with any transition according to Microsoft's documentation with its support. The biggest mistake is to mistake a visibly assigned license for confirmation that the entire environment is already working in P2 mode.
