Microsoft Defender
Microsoft Defender for SMEs: distinguish endpoint and email protection, choose licences, plan deployment and define who investigates alerts and follows incidents.
Suitable tools. Local support. A team close to you.
Geneva
Lausanne
Fribourg
Neuchâtel
Valais
Microsoft Defender covers several products. Defender for Business addresses device protection for SMEs; Defender for Office 365 focuses on threats involving email and collaboration. They are not interchangeable.
Before choosing, inventory endpoints, servers, mailboxes and existing protection. A cybersecurity review helps identify coverage and responsibilities that have not been assigned. A product name in a subscription does not confirm that devices are onboarded or that someone is handling alerts. Start with the exposure you need to address and the people who will operate the chosen controls.
Assess Defender for Business for the company’s devices, check supported platforms and available functions, then prepare a pilot that verifies normal operation and confirms that the devices actually appear in the management console.
Review the servers to protect with Defender separately, identify additional licences and application constraints, then include that equipment in the coverage matrix instead of assuming it is covered by existing device licences.
Assess Defender for Office 365 for email and collaboration threats, check the expected functions for links and attachments against the licence, and assign responsibility for handling the alerts produced by the selected protection.
Prepare device onboarding into Defender alongside existing protection, justified exclusions and configurations that may be distributed through Intune, then distinguish equipment already onboarded from devices awaiting integration or excluded from the agreed scope.
Organise receipt and investigation of Defender alerts with an identified contact, information useful for diagnosis and escalation rules suited to the hours and responsibilities agreed for your organisation and the protection service.
Define who can authorise a containment action within the selected Defender scope, assess its impact on business operations and coordinate device recovery with the protection of the accounts and data involved.
From initial scoping to ongoing support, the agreed work and each party’s responsibilities are defined with you before implementation.
A review of your environment, identification of vulnerabilities and a prioritised action plan.
Securing identities, MFA, permissions and workstations.
Workstations, email, Microsoft 365, networks and backups.
Workshops and training to build good everyday habits.
Alert monitoring and a prompt response to incidents.
Follow-up, optimisation and support from a dedicated contact.
We start with your teams’ needs, business applications and organisational constraints.
Share client files between colleagues, with appropriate access and documents that are easy to find.
Protect patient records and maintain the tools needed for consultations.
Find plans and files on site while keeping control of access for everyone involved.
Organise access for employees, elected representatives and volunteers, and make handovers easier when teams change.
Tools alone are not enough. Ongoing management, access and documentation need to remain clear over time.
Roles, permissions and protections suited to the agreed scope.
Identified dependencies, with backup and recovery arrangements to prepare.
Documented joiners, leavers and changes in responsibility.
Accessible configuration, licence and upcoming renewal records.
Uses, limitations and frequently asked questions: the points to clarify when preparing your project.
The Defender for Business FAQ explains that servers require additional licences. Capabilities also vary between offerings and platforms; an accurate inventory avoids applying an assumption about one workstation to the whole infrastructure.
For email, Defender for Office 365 documentation distinguishes protection levels and their capabilities. We recommend a matrix linking each equipment or usage category to a product, licence and operational owner. Review potential overlap with existing tools before purchasing, and include any devices that cannot yet move to the proposed setup.
A transition should plan for any coexistence with existing tools, justified exclusions and business application constraints. The pilot checks device operation, visibility in the management console and delivery of expected notifications.
Microsoft Intune can help distribute configurations in a suitable environment. Keep a list of devices that are onboarded, pending or excluded, with a reason and a planned action. Purchased licence numbers do not replace this coverage check. Agree the order of changes so that removing an old tool does not create an unnoticed protection gap.
Operational value depends on what happens after a detection. Define who receives the alert, who investigates and who may approve action on a device or account. Understand the business consequences before applying containment.
Sunitech can scope configuration and handling procedures. The engagement defines service hours, escalation and responsibilities; this page does not promise continuous monitoring. Identity protection with Microsoft Entra ID and recovery arrangements need coordination with endpoint protection. Record the investigation and the decision taken so that recurring issues can be understood and follow-up actions assigned.
Protection being present on a device does not explain how it is configured, monitored or connected to the wider environment. Check its status and the service actually in use. Inventory, investigation and response needs may go beyond local protection. Base the choice on the risks and the resources available to address them, rather than the product icon alone.
That depends on the product and licence. Endpoint protection and email protection are different scopes, even where information is brought together in a managed environment. Check the capabilities required for links, attachments and impersonation attempts, as well as who will investigate related alerts. Buying endpoint protection should not be treated as confirmation of email coverage.
No. Protection software reduces certain risks but does not remove mistakes, excessive permissions or every attack scenario. Updates, staff guidance, access controls and recovery preparation remain necessary. Project objectives should be measurable without promising absolute security. Useful checks include confirmed device coverage and tested alert handling, rather than an unsupported claim that the organisation is fully protected.
Review of your needs, comparison of options and clearly explained priorities.
Preparation, configuration, testing and coordination with the relevant providers.
Agreed support scope, documentation, licences and next steps.
A project? A question?
An initial conversation to understand your situation and decide on the next steps together.
Contact us
