Licences that are deployed, tuned and actually watched.
Defender for Endpoint, Office 365, Identity and Cloud Apps — supplied in AED and configured against a real baseline, with exclusions tuned so your staff do not end up disabling it.
- Endpoint P1 & P2
- Office 365 P1 & P2
- Identity & Cloud Apps
- Managed option available
Defender licence pricing
Several of these are already included in Microsoft 365 Business Premium and Enterprise E5. Before you buy standalone, check what your existing licence already entitles you to — we do that check as part of the quotation.
| Product | Covers | Per user / month (AED) |
|---|---|---|
| Defender for Endpoint P1 | Endpoint protection, attack surface reduction | 11 |
| Defender for Endpoint P2 | P1 plus EDR, threat hunting, automated investigation | 19 |
| Defender for Office 365 P1 | Safe Links, Safe Attachments, anti-phishing | 7.50 |
| Defender for Office 365 P2 | P1 plus attack simulation, automated response | 19 |
| Defender for Identity | On-premise Active Directory attack detection | 19 |
| Defender for Cloud Apps | SaaS discovery, session control, DLP for cloud apps | 19 |
| Defender for Business | SMB bundle, up to 300 users | 11 |
Indicative pricing, exclusive of 5% UAE VAT, on annual commitment. Included at no extra cost within Microsoft 365 Business Premium and Enterprise E5 for the relevant components.
Most tenants start lower than they'd guess
Microsoft Secure Score is a single number built from dozens of configuration checks. The baseline assessment gives you the current figure; the engagement moves it — not by chasing every point, but the ones that matter for your risk profile.
- MFA enforcement across all privileged accounts
- Legacy authentication protocols disabled
- Conditional access baseline applied
Deployment, not just delivery
A Defender licence that has never been tuned generates noise, and noise gets ignored. This is the work that prevents that.
Onboarding and policy baseline
Devices enrolled, attack surface reduction rules applied in audit mode first, then enforced once exceptions are understood.
Email protection tuning
Safe Links and Safe Attachments configured with the exclusions your business actually needs, and anti-phishing tuned to your domains and executives.
Identity protection
Risky sign-in policies, conditional access and privileged account monitoring, connected to on-premise Active Directory where it still exists.
Alert routing and triage
Alerts routed to a named owner with a defined severity model, rather than accumulating unread in a portal nobody opens.
Automated investigation
Automated response configured to contain confirmed threats without waiting for a human, within limits you approve.
Monthly security review
A written report on what was detected, what was contained, and what needs a decision from you.
A sample of what lands in the queue
Anonymised examples of the alert types the products actually raise, and how they get triaged once routing is set up properly.
Frequently asked questions
Defender for Endpoint P1 and P2, Defender for Office 365 P1 and P2, Defender for Identity, Defender for Cloud Apps, and Defender for Business for smaller organisations. Several are already bundled inside Business Premium and E5, which is often the cheaper route.
Defender covers endpoints, identity, email and SaaS. It is not a network firewall, and it does not replace one. We also supply Sophos and Fortinet where a perimeter or branch requirement exists, and we will tell you which layer a given threat actually belongs to.
Either. Many customers take the deployment and run it themselves. Where you want it watched, we offer a managed service with defined triage hours, escalation paths and a monthly review — priced per endpoint and quoted separately.
A typical mid-sized tenant is baselined in two to three weeks: onboarding, policy configuration, exclusion tuning, alert routing and a period of monitoring in audit mode before enforcement is switched on. Rushing that step is what generates the false positives that make people disable it.