Microsoft Defender for Servers review

Microsoft has a head start on Windows servers because Defender Antivirus is installed and enabled by default on Windows Server 2016 and later, and Microsoft documents how to run it headless on Server Core through PowerShell or Group Policy. Defender for Servers is the paid layer on top. Plan 1 brings the EDR from Defender for Endpoint, with automatic onboarding and alerts in one portal, and it can be switched on per server. Plan 2 adds agentless malware and vulnerability scanning, secrets scanning, file integrity monitoring, just-in-time VM access and 500 MB of free data ingestion. The same plans cover Linux machines and servers in AWS and Google Cloud, which suits mixed estates. The catch is the billing. Prices are listed on the Azure pricing page, which renders them with scripts, so we could not confirm a USD figure, and several Plan 2 features need Azure or Azure Arc. Teams outside Azure should check that onboarding path first.

Who it is for

Windows Server shops, and teams running servers in Azure or across clouds, that want to build on the Defender Antivirus already in the operating system.

Price

See vendor pricing (USD check pending).

US price check pending. See the vendor pricing page.

Key features

• Microsoft Defender Antivirus is installed and on by default in Windows Server 2016 and later
• Plan 1 adds Defender for Endpoint EDR with automatic onboarding and integrated alerts
• Plan 2 adds agentless malware scanning, agentless vulnerability scanning and machine secrets scanning
• File integrity monitoring and just-in-time VM access in Plan 2
• Covers Windows and Linux machines on Azure, AWS, Google Cloud and on-premises

Strengths and weaknesses

• Strength: The antivirus engine is already part of Windows Server, so there is no third-party agent to add on Windows
• Strength: Plan 1 can be turned on or off per server, not only per subscription
• Strength: A 30-day trial starts when you enable a plan
• Weakness: The Azure pricing page loads its prices with scripts, so we could not confirm a USD figure
• Weakness: Some Plan 2 features apply only to Azure or to machines onboarded with Azure Arc
• Weakness: Windows Server 2012 R2 needs Defender for Endpoint onboarding before Defender Antivirus is installed

Key facts

• Plans: Plan 1 and Plan 2
• Built-in antivirus: Windows Server 2016 and later
• Clouds covered: Azure, AWS, Google Cloud, on-premises
• Trial: 30 days after enabling a plan

Where it ranks

Microsoft Defender for Servers is No. 1 in our Best Antivirus for Servers verdict.