Microsoft Defender basics for a small business

Sorting out the names

Microsoft uses the Defender name for several different things, which causes real confusion. Microsoft Defender Antivirus is the protection built into Windows on every PC. Defender for Office 365 protects email, Teams and files against phishing and malicious attachments. Defender for Business is endpoint protection and response for computers in organisations of up to a few hundred users. Defender for individuals is a consumer app and not what a business wants.

The Defender portal is where they come together for an administrator: alerts, incidents, device inventory and email investigation all in one place. Knowing which products your licences include tells you which parts of the portal will actually have data. Open the billing section of the Microsoft 365 admin centre to see your current subscriptions, and compare against Microsoft's current plan comparison.

Defender for Office 365: the email side

Every Exchange Online mailbox gets basic spam and malware filtering. Defender for Office 365 adds checks that matter for targeted attacks: attachments opened in a safe sandbox before delivery, links rewritten and checked again at the moment someone clicks them, and impersonation protection that flags emails pretending to come from your director or a regular supplier with a lookalike domain.

The quickest way to put these to work is to apply Microsoft's standard or strict preset security policies, which turn on recommended settings in one step. Add your directors and finance staff as protected users for impersonation, and add your key supplier domains so lookalikes stand out. Review the quarantine regularly, and make sure staff know how to report a suspicious email with the built-in Report button.

Defender for Business: the computer side

Defender for Business goes beyond antivirus. It watches what programs do on a computer and raises an alert when behaviour looks like an attack, such as a document launching a script that tries to disable security tools or encrypt files. It can automatically isolate an infected computer from the network while still letting an administrator connect to investigate.

It also reports on vulnerabilities, such as out-of-date browsers or software with known security flaws, across all enrolled devices. For a small office that previously relied on a standalone antivirus subscription, this can replace it, provided someone is watching the alerts. Devices are usually onboarded through Intune, which keeps settings consistent across every laptop and desktop.

Settings worth checking straight away

Turn on tamper protection so malware cannot switch off Defender. Enable attack surface reduction rules in audit mode first, review what they would block for a couple of weeks, then enforce the ones that do not disrupt normal work. Rules that stop Office apps creating child processes and block credential theft from Windows are well worth having in most offices.

Check that cloud-delivered protection and automatic sample submission are on, that every computer shows as onboarded and healthy, and that the automated investigation level suits you. Many small offices set automatic remediation to full so routine threats are dealt with without waiting for someone to approve each action, then review what was done afterwards.

Alerts are only useful if someone responds

Defender produces alerts and groups related ones into incidents. In a small business the typical failure is not missing protection but alerts arriving in a mailbox nobody monitors. Decide who receives them, how quickly they are looked at and what happens out of hours. A ransomware alert at 9pm on a Friday that nobody reads until Monday is a much bigger problem than the same alert dealt with in ten minutes.

If nobody in the business has the time or knowledge to investigate, consider having someone monitor alerts for you. Either way, write down a short response plan: who to call, which computer to disconnect, how to reset a compromised account and when to involve your insurer. The NCSC publishes practical guidance for NZ businesses on responding to incidents.

Do you need anything else?

For many small offices, Defender for Office 365 and Defender for Business configured properly, plus multi-factor sign-in and a good backup, form a solid core. Some businesses add a third-party email filter or endpoint product for specific features or because they prefer a separate layer, but adding products is no substitute for configuring the ones already paid for.

Before buying more security software, ask what gap it fills that Defender does not, who will manage it and whether it overlaps with what you have. Two products doing the same job on one computer can interfere with each other. A clear, well-maintained setup beats a pile of overlapping tools that nobody fully understands.