Try our new research platform with insights from 80,000+ expert users

Microsoft Defender for Endpoint vs Microsoft Purview Insider Risk Management comparison

 

Comparison Buyer's Guide

Executive Summary

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Microsoft Defender for Endp...
Ranking in Microsoft Security Suite
5th
Average Rating
8.2
Reviews Sentiment
7.1
Number of Reviews
192
Ranking in other categories
Endpoint Protection Platform (EPP) (1st), Advanced Threat Protection (ATP) (2nd), Anti-Malware Tools (1st), Endpoint Detection and Response (EDR) (3rd)
Microsoft Purview Insider R...
Ranking in Microsoft Security Suite
30th
Average Rating
7.6
Reviews Sentiment
6.7
Number of Reviews
3
Ranking in other categories
Insider Risk Management (3rd)
 

Mindshare comparison

As of April 2025, in the Microsoft Security Suite category, the mindshare of Microsoft Defender for Endpoint is 9.1%, up from 6.5% compared to the previous year. The mindshare of Microsoft Purview Insider Risk Management is 0.6%, up from 0.3% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Microsoft Security Suite
 

Featured Reviews

AnuragSrivastava - PeerSpot reviewer
Provides detailed visibility into threats but the ability to add exceptions needs improvement
One major item for improvement is the ability to add exceptions. We can add some exceptions, but not at the level we need to. The second major area for improvement involves enhanced capabilities for different operating systems or platforms. That is, even though we have coverage for different operating systems or platforms such as Linux, we don't get all of the controls and enhanced capabilities that are available with Windows devices. Reporting could also be improved because, at present, we get limited results at times. For example, in an environment with more than 100,000 devices, you may just get 10,000 results when you run a report.
DC
The solution's graphing is highly specific and useful
Implementing policies in the solution isn't easy, and it takes time. For example, you need to use some secrets in Windows or Mac to execute your policies, and you can assign these policies with Microsoft Intune. However, when you execute a policy, you still need to wait up to two days to see alerts. Some of our customers aren't happy because they didn't expect it to take so long. They're satisfied once it starts working because they see the alerts and graphs. The user interface also isn't user-friendly. When we introduce Insider Risk Management to our clients, they often find it difficult to understand. There is too much information, and the UI is not scalable. Also, entry-level IT technicians are not always interested in learning something new. It should be clearer and easier to understand. Microsoft is still working on machine learning and AI components. They're constantly updating the product. However, from my experience, most of my customers are not ready or able to use the AI solution. They are creating some project plans and specific policies. They don't want to see dozens of alerts when they use Microsoft's recommendations or the AI-based solution.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"What I found most valuable in Microsoft Defender for Endpoint is that it's out-of-the-box, which brings more value to the customer. The technical support for the product is also one of the best parts, because it's good, in terms of the product knowledge of the technical engineers."
"Easy to understand and easy to set up endpoint security solution. It's a multifeatured product with web content filtering and automated investigation features. It also has a fantastic vulnerability management dashboard."
"The best thing I like about it is its interaction with the other Defender products. It provides the ability to push telemetry up. It gives me endpoint visibility and allows me to take automated actions."
"Investigators can trace back to find the root cause."
"Its real-time security is the most valuable."
"Endpoint's most valuable feature is deep analysis."
"Defender provides useful alerts and groups them. It sends an alert to your portal if it detects any malicious activity, and you can group multiple alerts to form an incident."
"Defender is stable, I haven't had any problems with viruses when using it, and it's easy to update."
"The best thing about Purview is that it's easy to integrate with our day-to-day environment. We have Active Directory, and Word and Excel. Using a third-party vendor and trying to integrate with our existing environment would be much more challenging."
"Microsoft Purview Insider Risk Management was helpful in performing investigations after alerts were received."
"Insider Risk Management's graphing is highly specific and useful. You can see the last six months of data for the Microsoft tenant. You can easily find what you need. For example, you can filter for alerts about devices, emails, etc."
 

Cons

"We need better support to learn about the product. Documentation is available, but we need some kind of training program so that we can get a better understanding of the product."
"The scanning is slow when it is working with incoming emails."
"Sometimes, there are difficulties in downloading a file considered as malicious."
"The central management console should be improved because it provides limited options to configure Windows Defender."
"I would like to see better integration with their other security products to give better visibility from a higher level."
"They can improve it on the online protection front since people nowadays are moving online and working from home."
"I would like to see integrations with other products, such as Spunk and other CM solutions. That would create possibilities for me, and for a SOC, to consolidate all events in an older console, not one provided by Microsoft but provided by a third party, and use it to create more insights."
"Microsoft Defender for Endpoint should include better automation that will make it faster to detect the latest threats happening across the world."
"For certain things, you need to install an agent. I understand it's for integrity, but if there could be a clientless solution for certain aspects, it would make life easier."
"The user interface also isn't user-friendly. When we introduce Insider Risk Management to our clients, they often find it difficult to understand. There is too much information, and the UI is not scalable. Also, entry-level IT technicians are not always interested in learning something new. It should be clearer and easier to understand."
"The reporting capabilities sometimes leave a little to be desired. It could be improved in terms of producing reports to provide information to the C-suite or others."
 

Pricing and Cost Advice

"Given our extensive Microsoft licensing, transitioning to Defender for Endpoint did not affect licensing costs."
"The product is free of charge and comes integrated into Windows."
"Most people don't realize M365/E5 licenses are an amazing deal. They think "Oh, it's expensive," and I'll ask, "Compared to what?" If you don't have it you will have to buy licenses for multiple products to fill the same security space that you would have gotten with the Microsoft product. Go figure out how much it costs you per product, per user, and then come back and tell me how things add up financially."
"This solution is part of an enterprise license we have."
"You just pay Windows 10 prices, then you have antivirus software. As a price comparison, Defender's costs are very low."
"For most people, the price of the license is not something that they have to worry about."
"Licensing options vary. Some customers buy it as an enterprise agreement and pay yearly. Others buy it as a CSP, so they pay per month. It completely depends on the customer's needs."
"Microsoft Defender for Endpoint comes with Windows 10, and it's free. But for you to be able to manage it in the cloud and use the console, you need to have either an Office 365 E5 subscription or a Microsoft M365 subscription. You need to buy an extra license."
Information not available
report
Use our free recommendation engine to learn which Microsoft Security Suite solutions are best for your needs.
846,617 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Educational Organization
27%
Computer Software Company
11%
Government
7%
Financial Services Firm
7%
Computer Software Company
29%
Financial Services Firm
12%
Government
8%
Manufacturing Company
6%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
No data available
 

Questions from the Community

How is Cortex XDR compared with Microsoft Defender?
Microsoft Defender for Endpoint is a cloud-delivered endpoint security solution. The tool reduces the attack surface, applies behavioral-based endpoint protection and response, and includes risk-ba...
Which offers better endpoint security - Symantec or Microsoft Defender?
We use Symantec because we do not use MS Enterprise products, but in my opinion, Microsoft Defender is a superior solution. Microsoft Defender for Endpoint is a cloud-delivered endpoint security s...
How does Microsoft Defender for Endpoint compare with Crowdstrike Falcon?
The CrowdStrike solution delivers a lot of information about incidents. It has a very light sensor that will never push your machine hardware to "test", you don't have the usual "scan now" feature ...
What needs improvement with Microsoft Purview Insider Risk Management?
The reporting capabilities sometimes leave a little to be desired. It could be improved in terms of producing reports to provide information to the C-suite or others.
What is your primary use case for Microsoft Purview Insider Risk Management?
The primary use case for Microsoft Purview Insider Risk Management was data loss prevention. This was my main objective.
What advice do you have for others considering Microsoft Purview Insider Risk Management?
I would recommend Microsoft Purview Insider Risk Management to others. I would rate the overall solution as a nine.
 

Also Known As

Microsoft Defender ATP, Microsoft Defender Advanced Threat Protection, MS Defender for Endpoint, Microsoft Defender Antivirus
Microsoft Insider Risk Management
 

Interactive Demo

Demo not available
 

Overview

 

Sample Customers

Petrofrac, Metro CSG, Christus Health
Information Not Available
Find out what your peers are saying about Microsoft Defender for Endpoint vs. Microsoft Purview Insider Risk Management and other solutions. Updated: March 2025.
846,617 professionals have used our research since 2012.