“Defender” is not one product — it is Microsoft’s name for a family of security tools, each licensed separately, each protecting something different. Schools are told “you have Defender” and reasonably believe they are covered; whether that is true depends on which Defender, which licence tier, and whether anyone actually configured it. This page untangles the three.
The family, in school terms
- Microsoft Defender Antivirus — the built-in Windows protection. Baseline malware blocking on the device.
- Defender for Office 365 — protects email and collaboration: Safe Links, Safe Attachments, anti-phishing (Plan 1), plus investigation, automated response and attack simulation training (Plan 2).
- Defender for Endpoint — watches the devices themselves: Plan 1 is foundational protection; Plan 2 adds full EDR — detection, investigation and response for attacks in progress.
- Defender for Identity — watches for identity-based attacks across your directory.
Who gets what — from Microsoft’s own tables
Per Microsoft’s education service description (linked in the sources, and worth reading against your actual invoice): Microsoft 365 Education A3 carries Defender Antivirus management and Defender for Endpoint Plan 1; Microsoft 365 Education A5 carries Defender for Endpoint Plan 2, Defender for Office 365 Plan 2, and Defender for Identity. The free Office 365 A1 tier carries none of those (higher-tier Defender products are available to A1/A3 as paid add-ons). And the two product families are easily confused: an “A3” that is Office 365 A3 rather than Microsoft 365 A3 includes materially less — check the exact product name on your agreement before assuming any of the above.
Is A5 worth it for a school?
Honestly: it depends on whether anyone will operate what it adds. Plan 2 capabilities — investigation, hunting, automated response — assume somebody looks at a console. A school with an engaged provider or trust-central team can get real value; a school where nobody will ever open the portal is paying for shelf-ware, and should either negotiate the operating into its IT contract or spend the difference elsewhere first (enforced MFA beats an unwatched console). That judgement is ours, not Microsoft’s, and it is the one we would give a school that asked.
Evidence and the wider picture
Keep: which Defender products your licence includes (from the agreement, not memory), which are deployed, and who reviews alerts on what cadence. With consent, Atlas reads the Defender device exposure and configuration scores and alert counts where a school connects them — a read-only posture picture, never a management console. Email protection overlaps with your DNS-level defences too: the email security hub covers the half that works whatever you pay Microsoft.