Defender for Office 365 Plan 1 vs Plan 2: which do you need?

Every Microsoft 365 mailbox in the cloud already gets spam, malware and spoofing protection. Microsoft Defender for Office 365 adds two paid tiers on top: Plan 1 for prevention, Plan 2 for investigation and response. This guide explains what each layer adds, which subscriptions include them, what they cost at list price, and when a filtering gateway in front still makes sense.

What do you get without Defender for Office 365?

Microsoft calls the base layer the "built-in security features for all cloud mailboxes", often still called Exchange Online Protection (EOP). Microsoft Learn says this layer is "included in all Microsoft 365 subscriptions with cloud mailboxes" and that it prevents "broad, volume-based, known email attacks".

It includes:

• Anti-malware, anti-spam (with bulk email protection) and anti-phishing spoof protection, including spoof intelligence.
• Outbound spam protection and connection filtering.
• Quarantine and quarantine policies.
• Admin and user submissions for false positives and false negatives.
• The Tenant Allow/Block List for domains, addresses, spoofed senders, URLs and files.
• Message trace, audit log search and email security reports.
• Zero-hour auto purge (ZAP) for email, which removes threats found after delivery.

That is a solid baseline. What it lacks is protection against new and targeted attacks: links checked at the moment of the click, attachments opened in a sandbox, and impersonation of your own executives or partner domains. If you only have this layer, our Microsoft 365 built-in vs gateway comparison covers your options.

What does Defender for Office 365 Plan 1 add?

Microsoft says Plan 1 "protects email and collaboration features from zero-day malware, phishing, and business email compromise (BEC)". The main additions on Microsoft's feature list are:

• Safe Attachments in email, and for files in SharePoint, OneDrive and Microsoft Teams.
• Safe Links in email, Office clients and Teams.
• Impersonation protection in anti-phishing policies: user and domain impersonation, mailbox intelligence (contact graph) and adjustable phishing email thresholds.
• Real-time detections, a lighter investigation view, plus the email entity page and user tags, including Priority account.
• Teams coverage: ZAP for Teams, Teams messages in quarantine and user-reported Teams items.
• Email and collaboration alerts, and SIEM integration for alerts and detections.

The service description also lists preset security policies, Configuration Analyzer, the Report Message add-in and advanced protection for internal mail under Plan 1.

For a small business, Plan 1 is where most of the protective value is. Impersonation protection targets the fake-CEO and fake-supplier messages behind business email compromise. Safe Links and Safe Attachments deal with links and files that were clean when the message arrived but turn malicious later.

What does Plan 2 add over Plan 1?

Microsoft describes Plan 2 as adding "phishing simulations, post-breach investigation, hunting, and response, and automation". Everything in Plan 1 is included, plus:

• Threat Explorer, which replaces Real-time detections with a fuller hunting and investigation view.
• Threat Trackers and Campaigns views, which group related attacks.
• Automated investigation and response (AIR), including AIR for compromised users.
• Attack simulation training, for running phishing simulations and assigning training.
• Priority account protection for executives and other high-value users.
• Microsoft Defender XDR integration: advanced hunting, incidents and alerts across Microsoft's security products, including advanced hunting on Teams messages.

Microsoft gives a quick way to tell the plans apart. In the Defender portal under Email & collaboration, Plan 1 tenants see Real-time detections and Plan 2 tenants see Explorer.

Plan 1 vs Plan 2 side by side

Sources: Microsoft's protection ladder and service description. Microsoft notes its table "may change without notice", so check the live version before you buy.

Which Microsoft 365 plans include Plan 1 or Plan 2?

According to the Defender for Office 365 service description:

• Plan 1 is included in Microsoft 365 Business Premium and, effective July 1, 2026, in Office 365 E3 and Microsoft 365 E3.
• Plan 2 is included in enterprise subscriptions "such as Microsoft 365 E5, A5, and GCC G5".

Microsoft's licensing guidance also lists Office 365 E5 as granting Plan 2 rights. Microsoft 365 Business Basic and Business Standard don't include either plan, but Microsoft says Defender for Office 365 "is also available as an add-on subscription to many Microsoft 365 subscriptions with cloud mailboxes".

To check what your tenant has today, open Your products in the Microsoft 365 admin center.

How much do Plan 1 and Plan 2 cost?

These are Microsoft's US list prices at the time of writing (October 2026), excluding tax. Your price may differ by country, channel, agreement or promotion, and Microsoft says existing customers stay on current pricing until renewal.

The suite prices cover far more than email security, so compare them with care. For a 25-person business on Business Standard, adding Plan 1 at list price is 25 × $2.00 = $50 a month. For the full cost picture, including per-domain pricing and admin time, see how much email security costs a small business.

Licensing is per user, and that includes shared mailboxes

Microsoft's licensing terms say licenses are needed for:

• Any user who accesses a mailbox that benefits from Defender for Office 365 protections.
• Shared mailboxes that benefit from those protections.
• All users of SharePoint, OneDrive or Teams, if Safe Attachments for those services is on.
• Any user of Microsoft 365 apps or Teams when Safe Links protections are on.

Microsoft also notes that Defender features are "enabled at the tenant level for all users within the tenant" by default. If you buy the add-on for only some users, scope your policies to those licensed users.

Which plan should a small business choose?

1. Check what you already own. If you have Business Premium, you have Plan 1. Many businesses pay for it and leave it at defaults.
2. Turn on the preset security policies. Microsoft's Standard or Strict presets switch on Safe Links, Safe Attachments and impersonation protection with recommended settings. Add your executives and key partner domains to impersonation protection.
3. Choose Plan 1 if you're on Business Basic or Standard and want link, attachment and impersonation protection without changing suites.
4. Consider Plan 2 only if someone will actually use Threat Explorer and AIR, or you want Microsoft's built-in phishing simulations. Without that person, Plan 2's extra features mostly sit unused. Our guide to security awareness training covers other ways to train staff.
5. Review quarantine and alerts on a schedule, whichever plan you pick. See releasing quarantined email in Microsoft 365.

Microsoft offers a 90-day trial of Plan 2 from the Defender portal trials hub, which is a low-risk way to see whether you'd use the extra tools.

When is a gateway in front of Microsoft 365 still useful?

Defender for Office 365 works inside Microsoft 365, including after delivery, on internal mail and in Teams, SharePoint and OneDrive. An MX-level gateway can't do any of that. A gateway does something different: it filters inbound mail before it reaches Microsoft at all. That's useful when you want:

• One filtering policy across platforms, for example some domains on Google Workspace or cPanel.
• Per-domain rather than per-user pricing, where shared mailboxes and role addresses don't add cost.
• A personal quarantine digest for every user, independent of Microsoft's quarantine policies.
• Mail held during an outage. iBlockSpam spools inbound mail for up to 5 days if your server is unreachable.
• A second, independent layer in front of Defender.

Microsoft fully supports this layout with Enhanced Filtering for Connectors, but it lists the trade-offs plainly: "More cost", "More complexity" and more false positives "as more products are added". It also advises against double link wrapping when Safe Links is on. Our Defender for Office 365 vs email gateway comparison covers how to run both. For tools that scan mailboxes by API instead, read secure email gateway vs API email security.

Next steps

• Check Your products in the Microsoft 365 admin center, and look for Real-time detections or Explorer in the Defender portal.
• If you have Plan 1 or Plan 2, apply the Standard or Strict preset security policy and add impersonation protection for key people and partner domains.
• Run the free Email Health Check to confirm your MX, SPF and DMARC records before changing anything.
• If you're weighing a gateway in front of Microsoft 365, compare costs on our pricing page and read the Microsoft 365 platform guide.