Defender for Office 365 works on the mail: checking what a message carries, on top of the standard spam and malware filtering. Defender for Business works on the machine, catching something that has already started running. They are separate products, at $3 and $4 a seat.