Microsoft Defender vs paid antivirus for small business PCs: is it enough?

For most small businesses, built-in Microsoft Defender Antivirus is enough protection on each Windows PC, provided you keep it on, keep it updated and turn on tamper protection. What it doesn't give you by itself is a central view of every device. If you have more than a handful of PCs, or you need alerts, reports and response actions, add central management with Microsoft Defender for Business (included in Microsoft 365 Business Premium) or choose a paid product that has its own console.

Who this is for and what you will have at the end

This guide is for owners and part-time administrators of businesses with roughly 5 to 300 Windows PCs who are being asked to buy antivirus licences, or who wonder whether they already have what they need. It doesn't rank products by detection score. Microsoft's documentation doesn't publish comparisons against other vendors, and this guide only states what the official pages say.

By the end you will be able to:

• Check whether Defender Antivirus is actually protecting a PC right now.
• Harden the built-in settings that matter most.
• Understand what happens to Defender when you install another antivirus.
• Decide between built-in protection, Defender for Business and a third-party product, using a short list of questions.

What you already have in Windows

Microsoft Defender Antivirus is available in Windows 10 and Windows 11 and in versions of Windows Server. Microsoft describes it as a major component of next-generation protection in Microsoft Defender for Endpoint. It uses machine learning, cloud analysis and behavior-based detection, and it can stop threats based on behavior and process trees even after execution has started, which matters for fileless malware.

Some details that affect a business decision:

• Cloud protection is enabled by default. It works with Microsoft cloud services (also called Microsoft Advanced Protection Service, MAPS) to identify new threats quickly, and Microsoft recommends keeping it on.
• Security intelligence updates are delivered regularly through the day, and the product works online and offline.
• Tamper protection keeps important settings from being turned off or changed, including real-time protection, behavior monitoring, cloud protection and automatic actions on detected threats. Attackers often try to disable security features first.
• Controlled folder access, which protects folders from ransomware by allowing only trusted apps to change files in them, is off by default. It is a Defender Antivirus feature available on editions that include Defender Antivirus, such as Windows 11 Home.

The practical point: on each PC, the engine is capable. The gaps are in how you manage, monitor and respond across the fleet.

Check what is protecting a PC today

Before buying anything, confirm the current state.

Windows Security app

1. Open the Windows Security app from the Start menu.
2. Select Virus & threat protection.
3. Under Who's protecting me?, select Manage providers.
4. On the Security providers page, under Antivirus, you should see the active product, for example Microsoft Defender Antivirus is turned on.

PowerShell

Open Windows PowerShell and run:

Get-MpComputerStatus | Select-Object AMRunningMode, RealTimeProtectionEnabled, IsTamperProtected

Read AMRunningMode as follows:

RealTimeProtectionEnabled and IsTamperProtected return True when the setting is on. If you see Normal and True for both, the PC is protected by Defender as intended.

Harden the built-in protection

These steps take a few minutes per PC and cost nothing. For many PCs, push the same settings through Microsoft Intune instead of visiting each one (see Intune vs Group Policy for small business).

Turn on tamper protection

On a single device that isn't managed by a security team:

1. In Windows Security, go to Virus & threat protection.
2. Under Virus & threat protection settings, select Manage settings.
3. Slide the Tamper Protection toggle to On.

For managed devices, Microsoft recommends Intune: create an endpoint security Antivirus policy for Windows with the profile Windows Security Experience, and set Tamper protection (device) to On. A policy that manages tamper protection takes precedence over the Defender portal setting, and both take precedence over a local change in the Windows Security app. Microsoft's documentation says tamper protection is on by default for new Defender portal deployments as part of built-in protection.

Keep cloud protection and real-time protection on

Leave both enabled. Microsoft says not to turn off capabilities such as real-time protection or cloud-delivered protection when Defender is used in passive mode or with EDR in block mode.

Consider controlled folder access in audit mode

Controlled folder access protects default folders such as Documents, Pictures, Music, Videos and Favorites under user profiles. Microsoft recommends running it in Audit Mode first, reviewing what it would block, allowing the line-of-business apps you need, then moving to Enabled (block) mode. Audit mode isn't available from the Windows Security app; it is available through Intune, Group Policy, PowerShell and similar methods. If a folder is redirected, for example with OneDrive Known Folder Move, controlled folder access protects it in the redirected location.

To see which folders are protected on a device with it turned on, run this in an elevated PowerShell window:

(Get-MpPreference).ControlledFolderAccessDefaultProtectedFolders

Keep updates flowing

Defender receives security intelligence updates through Windows Update. A PC that hasn't updated for weeks is a bigger risk than a choice between vendors, so confirm Windows Update is working on every device.

What happens when you install another antivirus

This is where many small businesses get surprised, so it is worth knowing exactly how Windows behaves.

Key points from Microsoft's compatibility page:

• On Windows 10 and 11, Defender turns itself off when a non-Microsoft product takes over, and can re-enable itself automatically if that product expires, is uninstalled or stops providing real-time protection. That is a safety net if a paid licence lapses.
• Passive mode, in which Defender keeps scanning alongside another product, is generally possible only on endpoints onboarded to Defender for Endpoint, and the Windows Security Center Service must be enabled. If it is disabled, Defender can't detect the other antivirus and stays active, which can cause conflicts and isn't supported.
• Microsoft says not to disable, stop or modify the wscsvc, SecurityHealthService, MsSense, Sense, WinDefend or MsMpEng services.
• On Windows Server, Defender doesn't switch off automatically when you install a third-party product. Microsoft says to set passive mode (the ForceDefenderPassiveMode value) or to disable or uninstall Defender manually, depending on whether the server is onboarded.
• Controlled folder access works only when Defender is the primary antivirus in active mode. It doesn't work in passive mode.

So "Defender plus a paid product" isn't a free double layer. Choose one primary antivirus per PC.

What built-in protection does not give you

Defender Antivirus on a standalone PC doesn't, on its own, give you:

• A central console that shows every device, alerts and their state in one place.
• Policy deployment across devices. You need Intune, Group Policy, Configuration Manager or another management tool.
• Endpoint detection and response, automated investigation and remediation, and attack disruption. These come from Defender for Endpoint or Defender for Business.
• Server and cross-platform coverage from the same console. Mac, iOS, Android and Linux protection is delivered through Defender for Endpoint, not through Windows built-ins.

If you have no central management, the practical risk is silence: a PC with protection turned off, an outdated device or a detection nobody read.

Option 2: Microsoft Defender for Business

Defender for Business is an endpoint security product based on Defender for Endpoint, designed for businesses with up to 300 users. It covers Windows, Mac, iOS/iPadOS and Android, with up to five client devices per user licence.

It is available in two ways:

• Standalone, for non-Microsoft organisations or eligible Microsoft 365 or Office 365 organisations with up to 300 users, such as Microsoft 365 Business Basic, Business Standard or Office 365 E1.
• Included in Microsoft 365 Business Premium. If you already pay for Business Premium, you already have it (see Business Premium vs E3 vs E5).

According to Microsoft's comparison, Defender for Business includes the features of Defender for Endpoint Plan 1, some Plan 2 features, and some features unique to smaller organisations:

Things to plan for:

• Servers need extra licences. Microsoft's FAQ says the Defender for Business servers add-on was priced at $3 per server instance; check the current price with Microsoft or a partner before budgeting. If you have more than 60 servers, a different licence type is needed.
• Some capabilities need Intune. Controlled folder access and custom attack surface reduction rules must be configured in the Intune admin center, and you can't create custom ASR rules without Intune.
• Mixed licensing isn't supported. If some users have Defender for Endpoint Plan 2 and others have Defender for Business, the organisation defaults to the Defender for Business experience.
• Non-Microsoft antivirus can be used, with a caveat. Microsoft says real-time protection could be turned off on those devices, so they might appear unprotected in the portal.

For onboarding steps see Defender for Endpoint onboarding with Intune, and for rollout of attack surface reduction see Defender attack surface reduction rules rollout.

Option 3: A paid third-party antivirus

A third-party product makes sense if you want a vendor console, support terms or features that Microsoft's stack doesn't give you, and you aren't already licensed for Business Premium. When comparing, check these points on the vendor's own pages:

1. Does it have a management console that covers all your operating systems?
2. What does it cost per device per year at your device count, and what is the renewal price?
3. Does it register correctly with Windows Security so Defender steps aside cleanly?
4. Does it include server support, and at what price?
5. Is there EDR or response capability, or only scanning?

Don't buy on detection claims alone. Microsoft doesn't publish vendor-to-vendor comparisons, and this guide doesn't either; if detection quality matters to you, look for current results from independent testing labs and read their methodology.

A short decision guide

This table is guidance, not a Microsoft recommendation. Antivirus doesn't replace backups, patching, multifactor authentication or user training. See small business IT disaster recovery plan template for the recovery side.

Troubleshooting

Checklist

• Run Get-MpComputerStatus on each PC and confirm Normal, real-time protection and tamper protection are True.
• Decide on one primary antivirus per PC; don't try to run two active ones.
• Turn on tamper protection locally or through policy.
• Trial controlled folder access in Audit Mode before blocking.
• If you have more than a few PCs, add central management with Intune or Defender for Business.
• Count servers separately; they need their own licences.
• Keep backups, patching and MFA in place regardless of the antivirus you choose.

References

• Microsoft Defender Antivirus in Windows overview
• Microsoft Defender Antivirus compatibility with other security products
• Cloud protection and Microsoft Defender Antivirus
• Tamper protection overview
• Configure tamper protection on Windows
• Protect folders from ransomware with controlled folder access
• What is Microsoft Defender for Business?
• Microsoft Defender for Business FAQ