---
title: Automatic attack disruption needs Defender for Endpoint Plan 2, not Plan 1 | ctxsec
url: https://ctxsec.com/items/mde-attack-disruption
description: ""
status: "tip / practitioner opinion"
published: 2026-10-13
---

> 

[← Tips & Guides](/tips) · [markdown](/items/mde-attack-disruption.md)

tip / practitioner opinion

2026-10-13

### Automatic attack disruption needs Defender for Endpoint Plan 2, not Plan 1

A red-teamer reports MDE P2's automatic attack disruption repeatedly cut off an internal test where other products didn't (opinion, one engagement). The licensing fact is from Microsoft Learn: attack disruption needs MDE Plan 2 (or E5-class / Defender for Business). P1 gives prevention and manual response only. Set device groups to Full or Semi automation and keep the Sense agent current.

Sources: [@techspence on X](https://x.com/techspence/status/2110025535636013080) · [Microsoft Learn: configure attack disruption](https://learn.microsoft.com/en-us/defender-xdr/configure-attack-disruption)