Microsoft Defender for Office 365

Microsoft Defender for Office 365 protects organizations against advanced threats targeting email, documents, and collaboration tools within the Microsoft 365 environment. Available in Plan 1 and Plan 2 tiers, it layers AI-powered detection, detonation-based analysis, and post-delivery protections on top of Exchange Online Protection to stop phishing, business email compromise, malware, and zero-day threats.

Plan 1 provides Safe Attachments, which detonates email attachments and linked files in isolated sandbox environments to detect malicious behavior before delivery; Safe Links, which rewrites and checks URLs at time-of-click to block access to newly weaponized sites; and anti-phishing policies powered by machine learning that detect impersonation attempts targeting specific users, domains, or brands. These protections extend beyond email to SharePoint, OneDrive, and Teams, securing the collaboration surface where files and links are routinely shared.

Plan 2 builds on Plan 1 with Threat Trackers that give security teams real-time visibility into trending threat campaigns and their impact on the organization. Threat Explorer provides a detailed investigation interface for searching, filtering, and analyzing email threats across the tenant—including post-delivery actions like soft deletes or zero-hour auto purge (ZAP) remediation. Automated Investigation and Response (AIR) playbooks automatically investigate suspicious emails, determine scope, and recommend or execute remediation actions.

Plan 2 also includes Attack Simulation Training, which allows organizations to run realistic phishing simulations against their own users, measure susceptibility, and assign targeted training to improve security awareness. Integration with the broader Microsoft 365 Defender suite correlates email-based signals with endpoint, identity, and cloud application telemetry, providing unified incident views and cross-domain automated response across the full attack chain.