Running email day to day

Threat Explorer vs Real-time detections: how do you investigate email in Microsoft 365?

By iBlockSpam Team How we check our guides Updated Oct 10, 2026 9 min read 5 sources

Short answer

Real-time detections (Defender for Office 365 Plan 1) shows malware, phishing and content malware detections for the last 30 days. Threat Explorer (Plan 2) adds the All email, Campaigns and URL clicks views, more filters, saved queries and remediation: soft delete, hard delete or move messages, and start automated investigations. Plan 1 can only submit messages and create allow or block entries.

On this page 8 sections

When a phishing email gets through, the first questions are always the same: who else got it, did anyone click, and can you pull it out of their mailboxes. In Microsoft 365, the tool that answers them depends on your license. Plan 1 tenants get Real-time detections, Plan 2 tenants get Threat Explorer, and the gap between them is bigger than the similar screens suggest.

What are Threat Explorer and Real-time detections?

Both live in the Microsoft Defender portal under Email & collaboration. Microsoft calls them "near real-time tools to help Security Operations (SecOps) teams investigate and respond to threats" (Microsoft Learn).

Real-time detections comes with Defender for Office 365 Plan 1, for example in Microsoft 365 Business Premium. It's at https://security.microsoft.com/realtimereportsv3.
Threat Explorer (shown as Explorer in the menu) comes with Plan 2, for example in Microsoft 365 E5. It's at https://security.microsoft.com/threatexplorerv3.

Microsoft says Threat Explorer "contains the same information and capabilities as Real-time detections" plus more views, more filters including saved queries, and "threat hunting and remediation actions" (Microsoft Learn). The menu entry is also the quickest way to tell which plan you have: Real-time detections means Plan 1, Explorer means Plan 2 (Microsoft Learn). Our Plan 1 vs Plan 2 guide covers the licensing side.

Tenants without either plan, using only the built-in protection described in what is Exchange Online Protection, have neither tool. Their investigation tools are message trace, email security reports and the audit log.

Which views does each tool have?

Both tools are organized into views (tabs). This is the table from Microsoft's documentation:

View	Threat Explorer	Real-time detections	What it shows
All email	Yes (default)	No	All email from external senders and between internal users
Malware	Yes	Yes (default)	Messages that contain malware
Phish	Yes	Yes	Messages that contain phishing threats
Campaigns	Yes	No	Mail that Plan 2 grouped into a coordinated phishing or malware campaign
Content malware	Yes	Yes	Malicious files in SharePoint, OneDrive and Teams
URL clicks	Yes	No	User clicks on URLs in email, Teams, SharePoint and OneDrive

The missing All email view matters more than it looks. Microsoft says Real-time detections shows "the malicious email detections at the time of delivery only", while Threat Explorer adds post-delivery activities (Microsoft Learn). Its email views are Malware and Phish, so a phish that Microsoft scored as clean is unlikely to show up there, and for missed messages a Plan 1 admin usually falls back to message trace.

How much data do you get?

By default each view shows yesterday and today. You can set start and end dates "up to 30 days ago" (Microsoft Learn). Microsoft's data retention page lists these limits at the time of writing (October 2026), and message trace is added for comparison from Microsoft's message trace documentation:

Data	Retention
Real-time detections	30 days
Threat Explorer	30 days
Email entity page	30 days
Campaigns	30 days
Message trace (for comparison)	90 days

If an incident might turn into a dispute, insurance claim or legal matter, export what you find. Explorer can export "up to 200,000 filtered or unfiltered results to a CSV file."

How do you filter results?

Filters are property queries, built as property, equal any of or equal none of, then values. Select Refresh after each change. The All email view offers these groups of properties (Microsoft Learn):

Basic: sender address, sender domain, recipients, subject, sender mail from domain, delivery action, latest and original delivery location, detection technology, directionality, threat type and more.
Advanced: Internet Message ID, Network Message ID, sender IP, attachment SHA256, cluster ID, alert ID and campaign ID.
URLs: URL domain, URL domain and path, full URL, click verdict and URL source (including QR code).
File: attachment filename, file type and size.
Authentication: SPF, DKIM, DMARC and composite results.

Delivery action tells you what filtering did at arrival: Blocked, Delivered, Delivered to junk or Replaced. Latest delivery location tells you where the message is now, which can differ if zero-hour auto purge or an admin moved it later.

Some filters exist only in Explorer, including tags (such as Priority account), Exchange transport rule, connector and context. Saved queries are Explorer-only too.

The fastest way to find one specific message is its Network Message ID, which is in the X-MS-Exchange-Organization-Network-Message-Id header. Paste a reported message's headers into the Email Header Analyzer to pull it out, or see Microsoft 365 spam headers explained.

How do you find every copy of a phishing campaign?

Start from one known-bad message and widen the search until you've found every variant.

Collect indicators from the first message: sender address and domain, subject, any URL domain, and the attachment hash if there is one.
Open the right view. In Threat Explorer, use All email so undetected copies show up. In Real-time detections, use Phish or Malware.
Set the date range to cover the attack, up to 30 days back.
Filter on one shared indicator, such as sender domain, sender IP, URL domain or attachment SHA256, then select Refresh. Attackers rotate subjects and senders far more often than payload domains.
Pivot the chart by sender IP, sender domain or URL domain to spot variants, then add them to the filter.
Check Latest delivery location. Anything still in Inbox/folder needs action. Quarantined and junked copies are less urgent.
Check clicks (Explorer only). The URL clicks view shows who clicked and the click verdict, such as Blocked or Block overridden.
Export the results before you remediate, so you have a record of what was delivered where.

Use the Campaigns view in Plan 2

Plan 2 groups related mail for you. Microsoft defines a campaign as "a coordinated email attack against one or many organizations", identified from the attack source, message properties, recipients and payload (Microsoft Learn). The Campaigns page (https://security.microsoft.com/campaigns) lists each campaign with its recipients, how many reached an inbox, how many users clicked and how many reached the payload site.

Open a campaign and use Explore messages > Inboxed messages to jump into Explorer with the campaign ID and an Inbox filter already set. That's usually the list you need to remediate.

How do you remove or move messages?

Select messages in the Email tab below the chart, or open one message, then choose Take action. The options depend on your plan (Microsoft Learn):

Action	Plan 2 (Explorer)	Plan 1 (Real-time detections)
Move or delete	Yes	No
Release quarantined messages to recipients	Yes	No
Submit to Microsoft for review	Yes	Yes
Allow or block entries in the Tenant Allow/Block List	Yes	Yes
Initiate automated investigation	Yes	No
Propose remediation	Yes	No

Move or delete offers five destinations:

Junk: moves the message to Junk Email.
Inbox: moves it back, or releases it from quarantine.
Deleted items: moves it to Deleted Items, where the user can still see it.
Soft deleted items: moves it to Recoverable Items\Deletions. Microsoft says the message "is recoverable by the user and admins." For internal senders, Delete sender's copy also tries to remove it from their Sent Items.
Hard deleted items: purges it. Admins can still recover it with single item recovery.

For phishing, soft delete is the usual choice. It takes the message out of the user's view but is easy to reverse if you got it wrong. Keep hard delete for messages you're sure about.

Propose remediation creates a soft delete that someone else must approve in the Action center. Microsoft calls this "two-step approval", and it lets analysts without delete rights queue a cleanup. Automated investigation and response uses the same approval queue.

Limits and permissions

With up to 100 messages selected, you can combine actions. With 101 to 200,000, Explorer lets you choose either Move or delete or Propose remediation, not both. Real-time detections only allows submission and Tenant Allow/Block List entries.
Moving or deleting needs the Search and Purge role. By default only the Data Investigator and Organization Management role groups have it. Previewing or downloading a message needs the Preview role.
Actions are logged in the Action center (https://security.microsoft.com/action-center/history), which is where you prove what was removed and when.

What Plan 1 admins can do instead

Real-time detections can't move mail. In Plan 1 you can still submit the message to Microsoft and block the sender, domain, URL or file in the Tenant Allow/Block List, and ZAP may remove delivered copies once Microsoft's verdict changes. For anything ZAP doesn't catch, removal needs a separate search and purge in Microsoft Purview, or the user deleting it.

Which tool should you use for which question?

Question	Best tool
Did this one message arrive, and where did it go?	Message trace
Which messages did Microsoft flag as phishing or malware this week?	Real-time detections or Explorer
Who received a phish that Microsoft didn't catch?	Explorer (All email), or message trace in Plan 1
Who clicked the link?	Explorer (URL clicks)
Remove 300 delivered copies now	Explorer (Move or delete)
What did the attacker do inside the mailbox afterwards?	Purview audit log

What changes if a gateway filters mail first?

If your MX points to a filtering gateway, mail still lands in Exchange Online, so both tools still see it and Explorer can still remediate it. Two things change. Messages arrive through your inbound connector, which Explorer can filter by Connector. And Microsoft only sees the original sender IP if you set up Enhanced Filtering for Connectors. Without it, sender IP pivots show your gateway's addresses. Mail the gateway blocked never reaches Microsoft, so look for it in the gateway's own message history.

Next steps

Check which menu entry your tenant shows under Email & collaboration: Real-time detections or Explorer.
Give your incident responders the Search and Purge and Preview roles before you need them, not during an incident.
Practice the campaign hunt on a recent quarantined phish, so the filters are familiar when it matters.
Export evidence within 30 days. After that, Explorer data is gone.
Fewer phish reaching inboxes means less to hunt. iBlockSpam filters inbound mail at the MX, with a 30-day message history for every domain; see how it works.

Browse our other email operations guides.

Frequently asked questions

How far back can Threat Explorer search email?

30 days. Microsoft's Defender for Office 365 data retention page lists 30 days for both Threat Explorer and Real-time detections, and the date filter accepts start and end dates up to 30 days ago. For older mail, use message trace, which covers 90 days, or export Explorer results to CSV while the data still exists.

Can Real-time detections delete phishing emails from user mailboxes?

No. In Defender for Office 365 Plan 1, the Take action wizard only offers Submit to Microsoft for review and the related allow or block entries in the Tenant Allow/Block List. Moving or deleting delivered messages, proposing remediation and starting automated investigations all need Threat Explorer, which comes with Plan 2.

Which role lets an admin remove messages with Threat Explorer?

The Search and Purge role in Email and collaboration permissions, which Microsoft assigns by default only to the Data Investigator and Organization Management role groups. With Defender XDR unified RBAC, the equivalent is the Email and collaboration advanced actions (manage) permission. Previewing or downloading a message needs the separate Preview role.

Is a soft delete from Threat Explorer reversible?

Yes. Soft delete moves the message to the Recoverable Items Deletions folder, and Microsoft says it stays recoverable by the user and by admins. You can also move it back to the Inbox from Explorer. Hard delete purges the message, though admins can still recover it through single item recovery.

Why don't I see an All email view in the Defender portal?

Your tenant probably has Plan 1. The All email view, along with Campaigns and URL clicks, exists only in Threat Explorer. Microsoft says the presence of Real-time detections under Email and collaboration indicates Plan 1, while Explorer indicates Plan 2. Real-time detections opens on the Malware view by default.

Sources

See how your domain measures up

Run a free Email Health Check: MX, SPF, DKIM, DMARC and transport security in one scan, with the raw records shown. No sign-up.

Keep reading