# Microsoft Defender vs paid antivirus for small business PCs: is it enough?

> Decide whether built-in Microsoft Defender Antivirus is enough for your small business PCs, what it lacks without central management, and when to add Defender for Business or a paid product.

Source: https://www.epifive.com/blog/free-vs-paid-antivirus-windows-defender-small-business · Published 2026-10-28 · EpiFive

## Key takeaways

- Microsoft Defender Antivirus is built into Windows 10 and 11, and it is the primary antivirus by default unless a non-Microsoft product registers itself.
- The decision for a small business is less about detection engines and more about central management, reporting and response across all devices.
- Defender for Business is designed for up to 300 users, covers up to five devices per user, and is included in Microsoft 365 Business Premium.
- Running Defender alongside another antivirus in passive mode requires onboarding to Microsoft Defender for Endpoint; otherwise Defender is disabled automatically.
- Turn on tamper protection and check the protection state with Get-MpComputerStatus before deciding you need to buy anything.

For most small businesses, built-in Microsoft Defender Antivirus is enough protection on each Windows PC, provided you keep it on, keep it updated and turn on tamper protection. What it doesn't give you by itself is a central view of every device. If you have more than a handful of PCs, or you need alerts, reports and response actions, add central management with Microsoft Defender for Business (included in Microsoft 365 Business Premium) or choose a paid product that has its own console.

## Who this is for and what you will have at the end

This guide is for owners and part-time administrators of businesses with roughly 5 to 300 Windows PCs who are being asked to buy antivirus licences, or who wonder whether they already have what they need. It doesn't rank products by detection score. Microsoft's documentation doesn't publish comparisons against other vendors, and this guide only states what the official pages say.

By the end you will be able to:

- Check whether Defender Antivirus is actually protecting a PC right now.
- Harden the built-in settings that matter most.
- Understand what happens to Defender when you install another antivirus.
- Decide between built-in protection, Defender for Business and a third-party product, using a short list of questions.

## What you already have in Windows

Microsoft Defender Antivirus is available in Windows 10 and Windows 11 and in versions of Windows Server. Microsoft describes it as a major component of next-generation protection in Microsoft Defender for Endpoint. It uses machine learning, cloud analysis and behavior-based detection, and it can stop threats based on behavior and process trees even after execution has started, which matters for fileless malware.

Some details that affect a business decision:

- **Cloud protection** is enabled by default. It works with Microsoft cloud services (also called Microsoft Advanced Protection Service, MAPS) to identify new threats quickly, and Microsoft recommends keeping it on.
- **Security intelligence updates** are delivered regularly through the day, and the product works online and offline.
- **Tamper protection** keeps important settings from being turned off or changed, including real-time protection, behavior monitoring, cloud protection and automatic actions on detected threats. Attackers often try to disable security features first.
- **Controlled folder access**, which protects folders from ransomware by allowing only trusted apps to change files in them, is **off by default**. It is a Defender Antivirus feature available on editions that include Defender Antivirus, such as Windows 11 Home.

The practical point: on each PC, the engine is capable. The gaps are in how you manage, monitor and respond across the fleet.

## Check what is protecting a PC today

Before buying anything, confirm the current state.

### Windows Security app

1. Open the **Windows Security** app from the Start menu.
2. Select **Virus & threat protection**.
3. Under **Who's protecting me?**, select **Manage providers**.
4. On the **Security providers** page, under **Antivirus**, you should see the active product, for example **Microsoft Defender Antivirus is turned on**.

### PowerShell

Open Windows PowerShell and run:

```powershell
Get-MpComputerStatus | Select-Object AMRunningMode, RealTimeProtectionEnabled, IsTamperProtected
```

Read `AMRunningMode` as follows:

| Value | Meaning |
|---|---|
| Normal | Defender Antivirus is running in active mode as the primary antivirus |
| Passive mode | Running, but not the primary antivirus; only possible on devices onboarded to Defender for Endpoint |
| EDR Block Mode | Defender Antivirus is running with endpoint detection and response in block mode enabled |
| SxS Passive Mode | Running alongside another antivirus, with limited periodic scanning |

`RealTimeProtectionEnabled` and `IsTamperProtected` return `True` when the setting is on. If you see `Normal` and `True` for both, the PC is protected by Defender as intended.

## Harden the built-in protection

These steps take a few minutes per PC and cost nothing. For many PCs, push the same settings through Microsoft Intune instead of visiting each one (see [Intune vs Group Policy for small business](https://www.epifive.com/blog/intune-vs-group-policy-small-business)).

### Turn on tamper protection

On a single device that isn't managed by a security team:

1. In **Windows Security**, go to **Virus & threat protection**.
2. Under **Virus & threat protection settings**, select **Manage settings**.
3. Slide the **Tamper Protection** toggle to **On**.

For managed devices, Microsoft recommends Intune: create an endpoint security **Antivirus** policy for **Windows** with the profile **Windows Security Experience**, and set **Tamper protection (device)** to **On**. A policy that manages tamper protection takes precedence over the Defender portal setting, and both take precedence over a local change in the Windows Security app. Microsoft's documentation says tamper protection is on by default for new Defender portal deployments as part of built-in protection.

### Keep cloud protection and real-time protection on

Leave both enabled. Microsoft says not to turn off capabilities such as real-time protection or cloud-delivered protection when Defender is used in passive mode or with EDR in block mode.

### Consider controlled folder access in audit mode

Controlled folder access protects default folders such as Documents, Pictures, Music, Videos and Favorites under user profiles. Microsoft recommends running it in **Audit Mode** first, reviewing what it would block, allowing the line-of-business apps you need, then moving to **Enabled** (block) mode. Audit mode isn't available from the Windows Security app; it is available through Intune, Group Policy, PowerShell and similar methods. If a folder is redirected, for example with OneDrive Known Folder Move, controlled folder access protects it in the redirected location.

To see which folders are protected on a device with it turned on, run this in an elevated PowerShell window:

```powershell
(Get-MpPreference).ControlledFolderAccessDefaultProtectedFolders
```

### Keep updates flowing

Defender receives security intelligence updates through Windows Update. A PC that hasn't updated for weeks is a bigger risk than a choice between vendors, so confirm Windows Update is working on every device.

## What happens when you install another antivirus

This is where many small businesses get surprised, so it is worth knowing exactly how Windows behaves.

| Situation | Defender Antivirus state |
|---|---|
| Windows 10 or 11, no other antivirus | Active mode |
| Windows 10 or 11, non-Microsoft antivirus primary, not onboarded to Defender for Endpoint, Smart App Control off | Disabled (happens automatically) |
| Non-Microsoft antivirus primary, any onboarding status, Smart App Control on or in evaluation | Passive mode |
| Windows Server with a non-Microsoft antivirus, not onboarded | Disabled; you set this manually |

Key points from Microsoft's compatibility page:

- On Windows 10 and 11, Defender turns itself off when a non-Microsoft product takes over, and can re-enable itself automatically if that product expires, is uninstalled or stops providing real-time protection. That is a safety net if a paid licence lapses.
- Passive mode, in which Defender keeps scanning alongside another product, is generally possible only on endpoints onboarded to Defender for Endpoint, and the **Windows Security Center Service** must be enabled. If it is disabled, Defender can't detect the other antivirus and stays active, which can cause conflicts and isn't supported.
- Microsoft says not to disable, stop or modify the `wscsvc`, `SecurityHealthService`, `MsSense`, `Sense`, `WinDefend` or `MsMpEng` services.
- On Windows Server, Defender doesn't switch off automatically when you install a third-party product. Microsoft says to set passive mode (the `ForceDefenderPassiveMode` value) or to disable or uninstall Defender manually, depending on whether the server is onboarded.
- Controlled folder access works only when Defender is the primary antivirus in active mode. It doesn't work in passive mode.

So "Defender plus a paid product" isn't a free double layer. Choose one primary antivirus per PC.

## What built-in protection does not give you

Defender Antivirus on a standalone PC doesn't, on its own, give you:

- **A central console** that shows every device, alerts and their state in one place.
- **Policy deployment** across devices. You need Intune, Group Policy, Configuration Manager or another management tool.
- **Endpoint detection and response**, automated investigation and remediation, and attack disruption. These come from Defender for Endpoint or Defender for Business.
- **Server and cross-platform coverage** from the same console. Mac, iOS, Android and Linux protection is delivered through Defender for Endpoint, not through Windows built-ins.

If you have no central management, the practical risk is silence: a PC with protection turned off, an outdated device or a detection nobody read.

## Option 2: Microsoft Defender for Business

Defender for Business is an endpoint security product based on Defender for Endpoint, designed for businesses with up to 300 users. It covers Windows, Mac, iOS/iPadOS and Android, with up to five client devices per user licence.

It is available in two ways:

- **Standalone**, for non-Microsoft organisations or eligible Microsoft 365 or Office 365 organisations with up to 300 users, such as Microsoft 365 Business Basic, Business Standard or Office 365 E1.
- **Included in Microsoft 365 Business Premium.** If you already pay for Business Premium, you already have it (see [Business Premium vs E3 vs E5](https://www.epifive.com/blog/business-premium-vs-e3-vs-e5)).

According to Microsoft's comparison, Defender for Business includes the features of Defender for Endpoint Plan 1, some Plan 2 features, and some features unique to smaller organisations:

| Capability | Defender for Business | Defender for Endpoint Plan 1 |
|---|---|---|
| Next-generation protection | Yes | Yes |
| Attack surface reduction | Yes | Yes |
| Centralized management | Yes | Yes |
| Endpoint detection and response | Yes (optimized) | No |
| Automated investigation and remediation | Yes | No |
| Automatic attack disruption | Yes | No |
| Monthly security summary reporting | Yes | No |
| Simplified firewall and antivirus configuration for Windows | Yes | No |

Things to plan for:

- **Servers need extra licences.** Microsoft's FAQ says the Defender for Business servers add-on was priced at $3 per server instance; check the current price with Microsoft or a partner before budgeting. If you have more than 60 servers, a different licence type is needed.
- **Some capabilities need Intune.** Controlled folder access and custom attack surface reduction rules must be configured in the Intune admin center, and you can't create custom ASR rules without Intune.
- **Mixed licensing isn't supported.** If some users have Defender for Endpoint Plan 2 and others have Defender for Business, the organisation defaults to the Defender for Business experience.
- **Non-Microsoft antivirus can be used, with a caveat.** Microsoft says real-time protection could be turned off on those devices, so they might appear unprotected in the portal.

For onboarding steps see [Defender for Endpoint onboarding with Intune](https://www.epifive.com/blog/defender-for-endpoint-onboarding-intune), and for rollout of attack surface reduction see [Defender attack surface reduction rules rollout](https://www.epifive.com/blog/defender-attack-surface-reduction-rules-rollout).

## Option 3: A paid third-party antivirus

A third-party product makes sense if you want a vendor console, support terms or features that Microsoft's stack doesn't give you, and you aren't already licensed for Business Premium. When comparing, check these points on the vendor's own pages:

1. Does it have a management console that covers all your operating systems?
2. What does it cost per device per year at your device count, and what is the renewal price?
3. Does it register correctly with Windows Security so Defender steps aside cleanly?
4. Does it include server support, and at what price?
5. Is there EDR or response capability, or only scanning?

Don't buy on detection claims alone. Microsoft doesn't publish vendor-to-vendor comparisons, and this guide doesn't either; if detection quality matters to you, look for current results from independent testing labs and read their methodology.

## A short decision guide

| Your situation | Reasonable choice |
|---|---|
| A few PCs, no one to monitor alerts, no Microsoft 365 | Built-in Defender with tamper protection on, updates working, and a backup plan |
| Already on Microsoft 365 Business Premium | Use the Defender for Business you already own; onboard devices and set policies |
| 10 to 300 users, want central visibility, mostly Windows and Mac | Defender for Business (standalone or via Business Premium) |
| Mixed estate with servers and compliance questions | Defender for Business plus the servers add-on, or a vendor with server coverage and reporting |
| Non-Microsoft shop with a managed provider using their own stack | Follow the provider's stack; confirm Defender goes to disabled or passive mode cleanly |

This table is guidance, not a Microsoft recommendation. Antivirus doesn't replace backups, patching, multifactor authentication or user training. See [small business IT disaster recovery plan template](https://www.epifive.com/blog/small-business-it-disaster-recovery-plan-template) for the recovery side.

## Troubleshooting

| Symptom | Likely cause | What to do |
|---|---|---|
| Windows Security says protection is off after uninstalling a third-party product | Defender wasn't re-enabled | Restart; check `Get-MpComputerStatus`. On Windows Server, re-enable Defender manually |
| Two antivirus products slow the PC | Both are active; Windows Security Center Service may be disabled | Confirm `wscsvc` is running; keep one primary product |
| Settings changed in Group Policy don't stick | Tamper protection is blocking the change | Use Intune or the Defender portal policy; use troubleshooting mode only if you must temporarily change a protected setting |
| Controlled folder access blocks a business app | App is untrusted | Run in Audit Mode, then allow the app by its path |
| Device appears unprotected in Defender for Business | Third-party antivirus is primary and real-time protection is off | Make Defender primary, or review the troubleshooting guidance for that state |

## Checklist

- Run `Get-MpComputerStatus` on each PC and confirm `Normal`, real-time protection and tamper protection are `True`.
- Decide on one primary antivirus per PC; don't try to run two active ones.
- Turn on tamper protection locally or through policy.
- Trial controlled folder access in Audit Mode before blocking.
- If you have more than a few PCs, add central management with Intune or Defender for Business.
- Count servers separately; they need their own licences.
- Keep backups, patching and MFA in place regardless of the antivirus you choose.

## References

- [Microsoft Defender Antivirus in Windows overview](https://learn.microsoft.com/en-us/defender-endpoint/microsoft-defender-antivirus-windows)
- [Microsoft Defender Antivirus compatibility with other security products](https://learn.microsoft.com/en-us/defender-endpoint/microsoft-defender-antivirus-compatibility)
- [Cloud protection and Microsoft Defender Antivirus](https://learn.microsoft.com/en-us/defender-endpoint/cloud-protection-microsoft-defender-antivirus)
- [Tamper protection overview](https://learn.microsoft.com/en-us/defender-endpoint/tamper-protection-overview)
- [Configure tamper protection on Windows](https://learn.microsoft.com/en-us/defender-endpoint/tamper-protection-windows-configure)
- [Protect folders from ransomware with controlled folder access](https://learn.microsoft.com/en-us/defender-endpoint/controlled-folder-access-overview)
- [What is Microsoft Defender for Business?](https://learn.microsoft.com/en-us/defender-business/mdb-overview)
- [Microsoft Defender for Business FAQ](https://learn.microsoft.com/en-us/defender-business/mdb-faq)

## Frequently asked questions

### Is Microsoft Defender enough for a small business?

Defender Antivirus is a full antivirus engine that is on by default in Windows 10 and 11, so the protection on each PC is not the weak point. What a small business usually lacks is central visibility and management across devices, which comes from adding Intune or Microsoft Defender for Business, or from a paid product with its own console.

### Do I need to uninstall Defender if I buy another antivirus?

No. On Windows 10 and 11, Defender Antivirus turns itself off automatically when a non-Microsoft antivirus registers as the primary product, and it can turn back on if that product expires or is removed. Don't stop Defender-related services by hand.

### Can I run two antivirus products on the same PC?

Not as two active real-time scanners. Passive mode, where Defender runs alongside another product, is generally possible only on devices onboarded to Microsoft Defender for Endpoint. Without onboarding, Defender is disabled when another antivirus is primary (on Windows 11 with Smart App Control on, it can go passive instead, which is not the same thing).

### What does Microsoft Defender for Business add?

It is an endpoint security product for organisations with up to 300 users, based on Defender for Endpoint. It adds centralised management, endpoint detection and response, automated investigation and remediation, and attack disruption on top of next-generation protection. It is included in Microsoft 365 Business Premium.