The Microsoft Defender Experts Suite will be generally available starting January 1, 2026. With this new managed security service, Microsoft will help organizations expand their security operations by combining Managed XDR (MXDR) with direct support from Microsoft security experts.

Many organizations are finding it increasingly difficult to maintain sufficient specialized security expertise in-house. The Defender Experts Suite addresses this challenge by combining technology and human expertise. In this article, we explain what the suite entails, how Defender Experts for XDR works, and the licensing considerations involved.

What is the Microsoft Defender Experts Suite?

The Microsoft Defender Experts Suite is an integrated security solution that helps organizations detect, investigate, and respond to security incidents. The suite is designed for organizations that want to professionalize their security without having to scale up a full-fledged Security Operations Center (SOC) themselves.

The suite's distinguishing feature lies in the combination of Microsoft Defender technology and active support from Microsoft analysts. Alerts are not only technically detected but also substantively evaluated and prioritized. This provides greater visibility and allows for faster response to actual threats.

The structure of the Defender Experts Suite

The Microsoft Defender Experts Suite consists of three interrelated services that together cover the full spectrum of detection, response, and optimization.

A key component is Microsoft Defender Experts for XDR. This managed XDR service focuses on continuous monitoring and triage of security alerts across multiple domains, such as endpoints, identities, email, and cloud applications. Microsoft analysts review alerts, filter out the noise, and help identify real incidents. This frees up internal security teams and allows them to focus on the most important risks.

The suite also includes Microsoft Incident Response. This service provides support during and after a cyberattack. Microsoft experts help manage the incident, conduct forensic investigations, and support recovery measures. They also address the underlying causes to prevent recurrence.

Finally, Microsoft Enhanced Designated Engineering is part of the suite. This service focuses on the structural improvement of the security environment. Through periodic evaluations and recommendations, Microsoft helps organizations further optimize and future-proof their security architecture.

Collaboration with Microsoft experts

Organizations using the Defender Experts Suite collaborate closely with Microsoft security specialists. Dashboards and reports provide insight into incidents, trends, and areas for improvement. A live chat feature is also available for asking questions about specific alerts or priorities.

Depending on the number of licensed users, support is provided by a Service Delivery Manager (SDM). For larger environments, regular coordination takes place to ensure optimal service delivery for the organization and to structurally improve security posture.

Availability and purchasing model

The Microsoft Defender Experts Suite will be generally available starting January 1, 2026. The suite is available exclusively through a Microsoft Enterprise Agreement (EA) and cannot be purchased via CSP or individual retail licenses. This means that organizations should carefully consider the contract structure and term beforehand.

Licensing technical considerations

Using the Microsoft Defender Experts Suite has specific licensing requirements. Defender Experts Suite P1 and P2 require additional licenses, such as Microsoft 365 E5 or the Microsoft Defender + Purchase Suite FLW (Add-on). In addition, relevant Microsoft Defender products must be active to achieve full XDR coverage.

Microsoft is offering a limited-time promotion for the Defender Experts Suite in 2026. This promotion runs from January 1st to December 31st, 2026, and is valid for organizations that already have Microsoft 365 E5 or Defender + Purview Suite FLW. A key requirement is a minimum purchase of 1.500 licenses, which must be maintained for the duration of the contract.

This combination of prerequisites, minimum purchases, and contractual obligations makes it important to carefully review licenses and terms and conditions.

Independent licensing advice by BeSharp Experts

The Microsoft Defender Experts Suite can be a valuable addition to an organization's security strategy, but the licensing and contract terms are complex. For questions regarding license deployment, promotions, contract renewals, or audits, organizations can contact BeSharp Experts.

BeSharp Experts offers independent licensing advice, free from vendor interests. This provides organizations with insight into risks, costs, and compliance aspects, enabling them to make informed decisions and avoid surprises.

Why this is relevant to your organization

The Microsoft Defender Experts Suite helps organizations detect security incidents faster and handle them more effectively, while reducing the burden on internal teams. At the same time, the suite requires a careful approach to licensing and contract terms. With independent advice, you can ensure your organization is well-prepared not only technically, but also contractually and financially.