The entry tier of Defender for Office 365. Safe Links, Safe Attachments and impersonation protection guard mail and collaboration tools against phishing, business email compromise and zero-day malware. Bundled with Microsoft 365 Business Premium, and from 1 July 2026 with Office 365 E3 and Microsoft 365 E3 too.
Read more: Microsoft Learn
In the Ultra Transcenders books
Each book explains Defender for Office 365 Plan 1 in context, with comparison tables and the common traps.
Terms in this definition
- Archive
Offline access tier for blobs, cheapest to store yet dearest to access. Reading a blob means rehydrating it first, which can take as long as 15 hours.
- Microsoft 365
Formerly Office 365, Microsoft's software-as-a-service productivity suite. A Microsoft Entra tenant provides its identity, and its data is not governed by Azure RBAC.
- Safe Links
Part of Microsoft Defender for Office 365: whenever someone selects a web address in an email, a Teams message or an Office document, it checks that address at that moment and stops access to harmful sites.
- Safe Attachments
Part of Microsoft Defender for Office 365: before delivering a message, it detonates attached files in a sandbox to catch previously unseen malware, and it also scans files stored in SharePoint, OneDrive and Teams.
- Impersonation protection
Guards against senders posing as known people or domains using lookalikes, and draws on mailbox intelligence. Part of anti-phishing in Defender for Office 365, it isn't enabled in the default policy.
- BEC
Business email compromise is a scam where criminals pretend to be someone trusted, perhaps a finance officer, customer or partner, so that money is moved, payments signed off or data handed over. Plan 1 of Defender for Office 365 defends against it.
- Premium
Hosting plan for Azure Functions that keeps instances pre-warmed to avoid cold starts and supports VNet integration. Executions time out after 30 minutes by default, which host.json can extend.
- E3
An enterprise bundle from Microsoft. Since 1 July 2026, Defender for Office 365 Plan 1 has come with it, alongside Microsoft Entra ID P1 and the core of Microsoft Purview.
Related terms
- Safe Documents
Office files that users open in Protected View, or in Application Guard for Office, can be checked by this premium feature of Defender for Office 365, using the Defender for Endpoint cloud from Microsoft. It requires the SafeDocs plan for Office 365, bundled in Microsoft 365 A5, E5 and G5 and in Microsoft Defender Suite; Defender for Office 365 Plan 1 and Plan 2 lack it.