Microsoft Defender for Office 365 protects email, Teams, SharePoint and OneDrive from phishing, malicious links and malware. It comes in two plans. Plan 1 focuses on prevention. Plan 2 adds tools to investigate, respond and train users.
This guide compares Defender for Office 365 Plan 1 vs Plan 2, explains which Microsoft 365 licences include each, and shows how to configure them well.
Plan 1 vs Plan 2 Feature Comparison
| Capability | EOP (all plans) | Plan 1 | Plan 2 |
|---|---|---|---|
| Spam and malware filtering | Yes | Yes | Yes |
| Safe Attachments (sandboxing) | No | Yes | Yes |
| Safe Links (time-of-click) | No | Yes | Yes |
| Impersonation protection | No | Yes | Yes |
| Real-time detections | No | Yes | Replaced by Threat Explorer |
| Threat Explorer and hunting | No | No | Yes |
| Automated investigation and response | No | No | Yes |
| Attack simulation training | No | No | Yes |
Which Licences Include Each Plan?
- Business Premium: Plan 1. See Business Premium vs E3.
- Microsoft 365 E3: neither, add-on required.
- Microsoft 365 E5 / Office 365 E5: Plan 2. See E3 vs E5.
- Standalone: both plans can be bought as add-ons.
Who Needs Plan 2?
Plan 2 suits organizations with a security team or managed SOC that investigates incidents, and those that want built-in phishing simulations. If nobody will use Threat Explorer or review automated investigations, Plan 1 plus good configuration may be enough.
How to Configure Defender for Office 365
- Apply the Standard or Strict preset security policies.
- Turn on Safe Links and Safe Attachments for Teams, SharePoint and OneDrive.
- Add executives and finance staff to user impersonation protection.
- Add your own and partner domains to domain impersonation protection.
- Honour sender DMARC policies for quarantine and reject.
- Review quarantine policies and user release settings.
Defender works best when your own domains are authenticated. Follow our SPF, DKIM and DMARC setup guide.
Common Configuration Mistakes
- Leaving default policies in place instead of preset or custom policies.
- Allow lists that let attackers bypass filtering.
- Not protecting Teams and SharePoint files.
- No regular review of user-reported messages.
Defender for Office 365 and Defender XDR
Email alerts are most useful when correlated with identity and endpoint signals in Defender XDR. A phishing email, a risky sign-in and a suspicious process on a laptop become one incident. Learn more in Defender for Business vs Defender for Endpoint.
Strengthen Email Security With M365 Enterprise Hub
We configure and tune Defender for Office 365 for organizations in the UAE and Saudi Arabia. See our enterprise email security services, email security hardening and Microsoft Defender XDR experts, or book a free email security review.
Frequently Asked Questions
What is Microsoft Defender for Office 365?
It is Microsoft’s advanced email and collaboration security service. It adds protection against phishing, malicious links and attachments on top of the basic filtering in Exchange Online Protection.
What is the difference between Plan 1 and Plan 2?
Plan 1 provides preventive protection such as Safe Links, Safe Attachments and impersonation protection. Plan 2 adds investigation and response tools, including Threat Explorer, automated investigation and response, and attack simulation training.
Which Microsoft 365 plans include Defender for Office 365?
Business Premium includes Plan 1. Microsoft 365 E5 and Office 365 E5 include Plan 2. E3 needs it as an add-on.
Is Exchange Online Protection enough?
EOP blocks spam and known malware, but it does not provide time-of-click link checks, attachment sandboxing or impersonation protection. Most organizations need at least Plan 1.
What is attack simulation training?
It is a Plan 2 feature that lets you run realistic phishing simulations and assign training to users who fall for them.
Does Defender for Office 365 protect Teams and SharePoint?
Yes. Safe Links and Safe Attachments can extend to Teams, SharePoint, OneDrive and Office apps when enabled.
Should we use preset security policies?
Yes, for most organizations. The Standard or Strict preset policies apply Microsoft’s recommended settings and update automatically.