Summary
Microsoft has launched the Defender Experts Suite, a bundled managed security service that combines human analysts with Microsoft’s security tools. The suite became generally available on 1 January 2026 with promotional pricing running throughout the year.
Key points:
Promotional pricing (up to 66% off, through December 2026) requires minimum 1,500 seats
Four prerequisite options including Microsoft 365 E5 and Microsoft Defender Suite
Two editions: Plan 1 and Plan 2
Pricing not published
What the Suite Includes
The Defender Experts Suite bundles three existing Microsoft services into a single subscription, priced per user per month. Here is what each component provides.
The suite bundles Defender Experts for XDR, Microsoft Incident Response, and Microsoft Enhanced Designated Engineering into a single subscription.
Microsoft Defender Experts for XDR provides round-the-clock managed extended detection and response, which Microsoft abbreviates as MXDR. Microsoft’s security analysts triage, investigate, and respond to incidents across endpoints, identities, email, cloud apps, and cloud workloads. According to the announcement blog, the analyst team brings “more than 600 years of combined experience.” The service includes Defender Experts for Hunting, which provides proactive threat hunting rather than just reactive incident response.
Microsoft Incident Response covers both proactive and reactive incident response services. Proactive services include incident response planning, assessments, and simulation exercises. When an incident occurs, the team handles investigation, attacker removal, and recovery assistance. Microsoft has operated this service since 2008, according to the announcement.
Microsoft Enhanced Designated Engineering provides direct access to Microsoft security advisors who work with you on architecture design, security operations centre workshops, and ongoing guidance to improve your security posture. According to the services FAQ, this includes “architecture design sessions, SOC workshops, detection and response fundamentals, and tailored assistance to meet business needs.”
Two Editions
Microsoft offers the suite in two editions. The services page includes a comparison table.
Component | Plan 1 | Plan 2 |
|---|---|---|
Microsoft Defender Experts for XDR | ✅ Yes | ✅ Yes |
Microsoft Incident Response | ✅ Yes | ✅ Yes |
Microsoft Enhanced Designated Engineering | ❌ No | ✅ Yes |
Microsoft Unified Enterprise (CSAM, 24/7 support, advisory, training) | ❌ No | ✅ Yes |
Prerequisites and Minimum Purchase
To purchase the suite, you need one of the following prerequisite licences, according to the services FAQ:
Microsoft 365 E5
Microsoft Defender and Purview Suite for Frontline Workers (formerly Microsoft 365 F5)
Microsoft Defender Suite
Microsoft Defender Suite for Frontline Workers
The promotional pricing has narrower eligibility than the general prerequisites. According to the announcement blog, you must purchase at least 1,500 seats and have either Microsoft 365 E5 or Microsoft Defender and Purview Suite for Frontline Workers specifically. The other two prerequisite options do not qualify for promotional pricing.
The 1,500-seat minimum applies to promotional pricing. Microsoft has not stated whether a lower minimum exists for non-promotional purchases.
How the Suite Differs from Standalone Services
Microsoft already sells Defender Experts for XDR and Microsoft Incident Response as standalone offerings. The suite bundles these together with the advisory engineering service.
If you are already using Defender Experts for XDR, the suite adds incident response and advisory services. If you only need one component, the standalone products remain available.
The standalone Defender Experts for XDR service has different prerequisites. According to the Microsoft Learn documentation, it requires at least one Microsoft Defender product deployed in active mode along with Microsoft Entra ID P1 for all users.
Pricing
The promotional offer runs from 1 January 2026 through 31 December 2026, according to the services page FAQ. If you are considering the suite, be aware that Microsoft has not published prices for either the promotional or standard rates. The “up to 66% off” is a marketing claim you cannot verify without a quote from Microsoft Security Sales.
Microsoft’s managed security services add another layer to already complex licensing. When the vendor won’t publish prices and promotional terms require a sales conversation, getting clarity before you commit is essential.
🖐 Need clarity on Defender Experts Suite licensing and prerequisites. Learn more: Microsoft Licensing Services for Enterprises.
Get in touch if you need help. We don’t sell Microsoft licences or cloud services, so our advice is independent.