The higher tier of Defender for Office 365: everything Plan 1 offers, plus advanced hunting, AIR, Threat Explorer, Threat Trackers and Attack simulation training. Microsoft 365 E5 bundles it.
Read more: Microsoft Learn
In the Ultra Transcenders books
Each book explains Defender for Office 365 Plan 2 in context, with comparison tables and the common traps.
Terms in this definition
- Archive
Offline access tier for blobs, cheapest to store yet dearest to access. Reading a blob means rehydrating it first, which can take as long as 15 hours.
- Microsoft 365
Formerly Office 365, Microsoft's software-as-a-service productivity suite. A Microsoft Entra tenant provides its identity, and its data is not governed by Azure RBAC.
- Advanced hunting
Threat-hunting feature of the Microsoft Defender portal that runs KQL over 30 days of raw Defender XDR data, plus onboarded Sentinel data, and supports custom detections. It finds activity after it happens rather than blocking it.
- AIR
Automated investigation and response in Microsoft Defender: alerts are examined without an analyst, each item of evidence gets a verdict, and fixes are carried out or suggested in the Action center. For Office 365 protection it requires Defender for Office 365 Plan 2.
- Threat Explorer
Organisations licensed for Plan 2 of Microsoft Defender for Office 365 use this tool to find and deal with email and collaboration threats almost as they happen. Plan 1 includes a cut-down version called Real-time detections.
- Attack simulation training
A Defender for Office 365 Plan 2 tool, also part of Microsoft 365 E5, that runs safe but convincing phishing exercises against staff and enrols anyone who falls for them in training.
- E5
Top-tier Microsoft 365 licensing bundle that includes Entra ID P2 together with ID Governance capabilities.
Related terms
- Priority account
A built-in tag you can apply to as many as 250 important users, letting you filter reports, alerts and Threat Explorer by them and, with Defender for Office 365 Plan 2, give them priority account protection.