Microsoft Defender for Office 365: Plan 1 vs Plan 2

Email remains the most common way into an organisation, and collaboration tools such as Teams carry the same risks. Defender for Office 365 is the primary email and collaboration security solution for Microsoft 365.

Microsoft describes a protection ladder with three rungs:

1. Built-in security features for all cloud mailboxes: included with every Microsoft 365 subscription that has cloud mailboxes, and long known as Exchange Online Protection (EOP). They stop broad, volume-based, known email attacks with anti-malware, anti-spam, anti-phishing (spoofing) protection, connection filtering, quarantine and zero-hour auto purge (ZAP), which removes malicious messages after delivery. The default policies are on for all recipients and can’t be turned off, only overridden.
2. Defender for Office 365 Plan 1: protects email and collaboration from zero-day malware, phishing and business email compromise (BEC). Included in Microsoft 365 Business Premium and, since 1 July 2026, in Microsoft 365 E3 and Office 365 E3.
3. Defender for Office 365 Plan 2: adds phishing simulation, post-breach investigation, hunting, response and automation. Included in Microsoft 365 E5 (and A5 and G5).

Either plan can also be bought as an add-on.

Key Plan 1 features:

• Safe Attachments scans email attachments for malware, including new (zero-day) malware. A separate setting extends it to files in SharePoint, OneDrive and Teams.
• Safe Links protects users from malicious URLs in email, Office apps and Teams.
• Anti-phishing with impersonation protection detects messages pretending to come from protected users or domains, using mailbox intelligence.
• Real-time detections, an investigation tool for reviewing detected email threats.

Attack simulation training runs phishing simulations against the organisation’s own users so that awareness can be measured and improved. Threat Explorer is the Plan 2 investigation tool that replaces Real-time detections, and seeing Explorer rather than Real-time detections in the portal is a quick way to tell the plans apart. Threat Trackers and Campaigns views add further post-breach investigation in Plan 2.

Common trap: Expecting Attack simulation training or Threat Explorer with Plan 1 - both are Plan 2 features. Plan 1 gives prevention (Safe Attachments, Safe Links, impersonation protection) plus Real-time detections; Plan 2 adds investigation, simulation and automation.

Get the whole book

This note is one section of Ultra Transcenders SC-900: Microsoft Security, Compliance, and Identity Fundamentals, an independent study guide that explains every topic the exam covers by technology, with comparison tables, diagrams and the common traps, plus a glossary linked to Microsoft Learn.

About the book · SC-900 terms in the glossary · All SC-900 study notes