# Defender for Office 365 Plan 1 vs Plan 2: which do you need?

URL: https://iblockspam.com/blog/defender-for-office-365-plan-1-vs-plan-2
Last updated: 2026-10-10
Published: 2026-10-10
Topic: Choosing a filter
Author: iBlockSpam Team

> What Exchange Online Protection includes, what Defender for Office 365 Plan 1 and Plan 2 add, which Microsoft 365 plans include each, and list prices.

## Short answer

Plan 1 adds prevention to the built-in protection every cloud mailbox gets: Safe Links, Safe Attachments, impersonation protection and real-time detections. Plan 2 adds investigation and response: Threat Explorer, automated investigation and response, and attack simulation training. Business Premium includes Plan 1; Microsoft 365 E5 includes Plan 2. Most small businesses need Plan 1.

Every Microsoft 365 mailbox in the cloud already gets spam, malware and spoofing protection. Microsoft Defender for Office 365 adds two paid tiers on top: Plan 1 for prevention, Plan 2 for investigation and response. This guide explains what each layer adds, which subscriptions include them, what they cost at list price, and when a filtering gateway in front still makes sense.

## What do you get without Defender for Office 365?

Microsoft calls the base layer the "built-in security features for all cloud mailboxes", often still called Exchange Online Protection (EOP). [Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/mdo-about) says this layer is "included in all Microsoft 365 subscriptions with cloud mailboxes" and that it prevents "broad, volume-based, known email attacks".

It includes:

- Anti-malware, anti-spam (with bulk email protection) and anti-phishing spoof protection, including spoof intelligence.
- Outbound spam protection and connection filtering.
- Quarantine and quarantine policies.
- Admin and user submissions for false positives and false negatives.
- The Tenant Allow/Block List for domains, addresses, spoofed senders, URLs and files.
- Message trace, audit log search and email security reports.
- Zero-hour auto purge (ZAP) for email, which removes threats found after delivery.

That is a solid baseline. What it lacks is protection against new and targeted attacks: links checked at the moment of the click, attachments opened in a sandbox, and impersonation of your own executives or partner domains. If you only have this layer, our [Microsoft 365 built-in vs gateway comparison](https://iblockspam.com/compare/microsoft-365-built-in-vs-gateway) covers your options.

## What does Defender for Office 365 Plan 1 add?

Microsoft says Plan 1 "protects email and collaboration features from zero-day malware, phishing, and business email compromise (BEC)". The main additions on [Microsoft's feature list](https://learn.microsoft.com/en-us/defender-office-365/mdo-about) are:

- **Safe Attachments** in email, and for files in SharePoint, OneDrive and Microsoft Teams.
- **Safe Links** in email, Office clients and Teams.
- **Impersonation protection** in anti-phishing policies: user and domain impersonation, mailbox intelligence (contact graph) and adjustable phishing email thresholds.
- **Real-time detections**, a lighter investigation view, plus the email entity page and user tags, including Priority account.
- **Teams coverage:** ZAP for Teams, Teams messages in quarantine and user-reported Teams items.
- Email and collaboration alerts, and SIEM integration for alerts and detections.

The [service description](https://learn.microsoft.com/en-us/office365/servicedescriptions/office-365-advanced-threat-protection-service-description) also lists preset security policies, Configuration Analyzer, the Report Message add-in and advanced protection for internal mail under Plan 1.

For a small business, Plan 1 is where most of the protective value is. Impersonation protection targets the fake-CEO and fake-supplier messages behind [business email compromise](https://iblockspam.com/blog/business-email-compromise-prevention). Safe Links and Safe Attachments deal with links and files that were clean when the message arrived but turn malicious later.

## What does Plan 2 add over Plan 1?

Microsoft describes Plan 2 as adding "phishing simulations, post-breach investigation, hunting, and response, and automation". Everything in Plan 1 is included, plus:

- **Threat Explorer**, which replaces Real-time detections with a fuller hunting and investigation view.
- **Threat Trackers** and **Campaigns** views, which group related attacks.
- **Automated investigation and response (AIR)**, including AIR for compromised users.
- **Attack simulation training**, for running phishing simulations and assigning training.
- **Priority account protection** for executives and other high-value users.
- **Microsoft Defender XDR integration**: advanced hunting, incidents and alerts across Microsoft's security products, including advanced hunting on Teams messages.

Microsoft gives a quick way to tell the plans apart. In the Defender portal under **Email & collaboration**, Plan 1 tenants see **Real-time detections** and Plan 2 tenants see **Explorer**.

## Plan 1 vs Plan 2 side by side

| Feature | Built-in (EOP) | Plan 1 | Plan 2 |
|---|---|---|---|
| Anti-spam, anti-malware, spoof protection | Yes | Yes | Yes |
| Quarantine and ZAP for email | Yes | Yes | Yes |
| Safe Links (email, Office, Teams) | No | Yes | Yes |
| Safe Attachments (email, SharePoint, OneDrive, Teams) | No | Yes | Yes |
| User and domain impersonation protection | No | Yes | Yes |
| ZAP for Teams | No | Yes | Yes |
| Investigation view | Message trace, reports | Real-time detections | Threat Explorer |
| Threat Trackers and Campaigns | No | No | Yes |
| Automated investigation and response | No | No | Yes |
| Attack simulation training | No | No | Yes |
| Priority account protection | No | No | Yes |
| Defender XDR integration | No | No | Yes |

Sources: Microsoft's [protection ladder](https://learn.microsoft.com/en-us/defender-office-365/mdo-about) and [service description](https://learn.microsoft.com/en-us/office365/servicedescriptions/office-365-advanced-threat-protection-service-description). Microsoft notes its table "may change without notice", so check the live version before you buy.

## Which Microsoft 365 plans include Plan 1 or Plan 2?

According to the [Defender for Office 365 service description](https://learn.microsoft.com/en-us/office365/servicedescriptions/office-365-advanced-threat-protection-service-description):

- **Plan 1** is included in Microsoft 365 Business Premium and, effective July 1, 2026, in Office 365 E3 and Microsoft 365 E3.
- **Plan 2** is included in enterprise subscriptions "such as Microsoft 365 E5, A5, and GCC G5".

Microsoft's [licensing guidance](https://learn.microsoft.com/en-us/office365/servicedescriptions/microsoft-365-service-descriptions/microsoft-365-tenantlevel-services-licensing-guidance/microsoft-defender-service-description) also lists Office 365 E5 as granting Plan 2 rights. Microsoft 365 Business Basic and Business Standard don't include either plan, but Microsoft says Defender for Office 365 "is also available as an add-on subscription to many Microsoft 365 subscriptions with cloud mailboxes".

To check what your tenant has today, open **Your products** in the Microsoft 365 admin center.

## How much do Plan 1 and Plan 2 cost?

These are Microsoft's US list prices at the time of writing (October 2026), excluding tax. Your price may differ by country, channel, agreement or promotion, and Microsoft says existing customers stay on current pricing until renewal.

| Product | List price | Defender for Office 365 included | Source |
|---|---|---|---|
| Defender for Office 365 Plan 1 (add-on) | $2.00 per user/month, paid yearly | Plan 1 | [Microsoft product page](https://www.microsoft.com/en-us/security/business/siem-and-xdr/microsoft-defender-office-365) |
| Defender for Office 365 Plan 2 (add-on) | $5.00 per user/month, paid yearly | Plan 2 | [Microsoft product page](https://www.microsoft.com/en-us/security/business/siem-and-xdr/microsoft-defender-office-365) |
| Microsoft 365 Business Premium | $22.00 per user/month | Plan 1 | [July 2026 price list](https://www.microsoft.com/en-us/licensing/news/2026-m365-packaging-pricing-updates) |
| Microsoft 365 E3 | $39.00 per user/month | Plan 1 (from July 1, 2026) | [July 2026 price list](https://www.microsoft.com/en-us/licensing/news/2026-m365-packaging-pricing-updates) |
| Microsoft 365 E5 | $60.00 per user/month | Plan 2 | [July 2026 price list](https://www.microsoft.com/en-us/licensing/news/2026-m365-packaging-pricing-updates) |

The suite prices cover far more than email security, so compare them with care. For a 25-person business on Business Standard, adding Plan 1 at list price is 25 × $2.00 = $50 a month. For the full cost picture, including per-domain pricing and admin time, see [how much email security costs a small business](https://iblockspam.com/blog/email-security-cost-small-business).

### Licensing is per user, and that includes shared mailboxes

Microsoft's [licensing terms](https://learn.microsoft.com/en-us/office365/servicedescriptions/microsoft-365-service-descriptions/microsoft-365-tenantlevel-services-licensing-guidance/microsoft-defender-service-description) say licenses are needed for:

- Any user who accesses a mailbox that benefits from Defender for Office 365 protections.
- Shared mailboxes that benefit from those protections.
- All users of SharePoint, OneDrive or Teams, if Safe Attachments for those services is on.
- Any user of Microsoft 365 apps or Teams when Safe Links protections are on.

Microsoft also notes that Defender features are "enabled at the tenant level for all users within the tenant" by default. If you buy the add-on for only some users, scope your policies to those licensed users.

## Which plan should a small business choose?

1. **Check what you already own.** If you have Business Premium, you have Plan 1. Many businesses pay for it and leave it at defaults.
2. **Turn on the preset security policies.** Microsoft's Standard or Strict presets switch on Safe Links, Safe Attachments and impersonation protection with recommended settings. Add your executives and key partner domains to impersonation protection.
3. **Choose Plan 1** if you're on Business Basic or Standard and want link, attachment and impersonation protection without changing suites.
4. **Consider Plan 2** only if someone will actually use Threat Explorer and AIR, or you want Microsoft's built-in phishing simulations. Without that person, Plan 2's extra features mostly sit unused. Our guide to [security awareness training](https://iblockspam.com/blog/email-security-awareness-training-small-business) covers other ways to train staff.
5. **Review quarantine and alerts** on a schedule, whichever plan you pick. See [releasing quarantined email in Microsoft 365](https://iblockspam.com/blog/release-quarantined-email-microsoft-365).

Microsoft offers a 90-day trial of Plan 2 from the Defender portal trials hub, which is a low-risk way to see whether you'd use the extra tools.

## When is a gateway in front of Microsoft 365 still useful?

Defender for Office 365 works inside Microsoft 365, including after delivery, on internal mail and in Teams, SharePoint and OneDrive. An MX-level gateway can't do any of that. A gateway does something different: it filters inbound mail before it reaches Microsoft at all. That's useful when you want:

- **One filtering policy across platforms**, for example some domains on Google Workspace or cPanel.
- **Per-domain rather than per-user pricing**, where shared mailboxes and role addresses don't add cost.
- **A personal quarantine digest for every user**, independent of Microsoft's quarantine policies.
- **Mail held during an outage.** iBlockSpam spools inbound mail for up to 5 days if your server is unreachable.
- **A second, independent layer** in front of Defender.

Microsoft fully supports this layout with [Enhanced Filtering for Connectors](https://iblockspam.com/blog/microsoft-365-third-party-spam-filter-enhanced-filtering), but [it lists the trade-offs](https://learn.microsoft.com/en-us/defender-office-365/mdo-integrate-security-service) plainly: "More cost", "More complexity" and more false positives "as more products are added". It also advises against double link wrapping when Safe Links is on. Our [Defender for Office 365 vs email gateway comparison](https://iblockspam.com/compare/defender-for-office-365-vs-email-gateway) covers how to run both. For tools that scan mailboxes by API instead, read [secure email gateway vs API email security](https://iblockspam.com/blog/secure-email-gateway-vs-api-email-security).

## Next steps

- Check **Your products** in the Microsoft 365 admin center, and look for Real-time detections or Explorer in the Defender portal.
- If you have Plan 1 or Plan 2, apply the Standard or Strict preset security policy and add impersonation protection for key people and partner domains.
- Run the free [Email Health Check](https://iblockspam.com/tools/email-health-check) to confirm your MX, SPF and DMARC records before changing anything.
- If you're weighing a gateway in front of Microsoft 365, compare costs on our [pricing page](https://iblockspam.com/pricing) and read the [Microsoft 365 platform guide](https://iblockspam.com/platforms/microsoft-365).

## Frequently asked questions

### Is Defender for Office 365 Plan 1 included in Microsoft 365 Business Premium?

Yes. Microsoft's service description lists Plan 1 as included in Microsoft 365 Business Premium. Business Basic and Business Standard don't include it, but Microsoft sells Defender for Office 365 as an add-on to many subscriptions with cloud mailboxes. Check the Your products page in the Microsoft 365 admin center to see what you have.

### Is Defender for Office 365 Plan 2 worth it for a small business?

Usually only if someone will use it. Plan 2's main additions are Threat Explorer, automated investigation and response, campaign views and attack simulation training. They help a person who investigates incidents and runs phishing simulations. If nobody has that role, Plan 1 configured well covers the prevention features that stop most attacks.

### How can I tell whether my tenant has Plan 1 or Plan 2?

Look in the Microsoft Defender portal under Email & collaboration. Microsoft says Real-time detections appears with Plan 1, and Explorer appears with Plan 2 instead. The Your products page in the Microsoft 365 admin center also lists your subscriptions and add-ons.

### Does Microsoft 365 E3 include Defender for Office 365?

From July 1, 2026, yes for Plan 1. Microsoft's service description says Plan 1 is included in Office 365 E3 and Microsoft 365 E3 from that date. It adds Safe Links, Safe Attachments, anti-phishing and real-time detections, but not Plan 2 features such as Threat Explorer or automated investigation.

### Do shared mailboxes need a Defender for Office 365 license?

Microsoft's licensing terms say licenses are required for shared mailboxes that benefit from Defender for Office 365 protections, as well as for every user who accesses a protected mailbox. Count shared mailboxes when you budget, and confirm the current terms with Microsoft or your reseller.

## Sources

- [Microsoft Learn: Why do I need Microsoft Defender for Office 365?](https://learn.microsoft.com/en-us/defender-office-365/mdo-about)
- [Microsoft Learn: Microsoft Defender for Office 365 service description](https://learn.microsoft.com/en-us/office365/servicedescriptions/office-365-advanced-threat-protection-service-description)
- [Microsoft Learn: Microsoft Defender service description (licensing terms)](https://learn.microsoft.com/en-us/office365/servicedescriptions/microsoft-365-service-descriptions/microsoft-365-tenantlevel-services-licensing-guidance/microsoft-defender-service-description)
- [Microsoft: Microsoft Defender for Office 365 plans and pricing](https://www.microsoft.com/en-us/security/business/siem-and-xdr/microsoft-defender-office-365)
- [Microsoft Licensing: Microsoft 365 pricing and packaging updates (effective July 1, 2026)](https://www.microsoft.com/en-us/licensing/news/2026-m365-packaging-pricing-updates)
- [Microsoft Learn: Integrate non-Microsoft security services with Microsoft 365](https://learn.microsoft.com/en-us/defender-office-365/mdo-integrate-security-service)

## Free tools for this guide

- [Email Health Check](https://iblockspam.com/tools/email-health-check): Grade your domain's MX, SPF, DKIM, DMARC and transport security in one scan.
- [MX Lookup](https://iblockspam.com/tools/mx-lookup): See where your mail is delivered, spot unfiltered backup MX and broken hosts.
- [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer): Trace hops and authentication results — runs entirely in your browser.
- [DMARC Checker](https://iblockspam.com/tools/dmarc-checker): Check your policy, reporting and the safe path from p=none to reject.

---

Source: iBlockSpam, https://iblockspam.com/blog/defender-for-office-365-plan-1-vs-plan-2 (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt