# Threat Explorer vs Real-time detections: how do you investigate email in Microsoft 365?

URL: https://iblockspam.com/blog/microsoft-365-threat-explorer-real-time-detections
Last updated: 2026-10-10
Published: 2026-10-10
Topic: Running email day to day
Author: iBlockSpam Team

> How Threat Explorer (Plan 2) and Real-time detections (Plan 1) differ: views, filters, finding a phishing campaign, soft delete and move actions, 30-day data.

## Short answer

Real-time detections (Defender for Office 365 Plan 1) shows malware, phishing and content malware detections for the last 30 days. Threat Explorer (Plan 2) adds the All email, Campaigns and URL clicks views, more filters, saved queries and remediation: soft delete, hard delete or move messages, and start automated investigations. Plan 1 can only submit messages and create allow or block entries.

When a phishing email gets through, the first questions are always the same: who else got it, did anyone click, and can you pull it out of their mailboxes. In Microsoft 365, the tool that answers them depends on your license. Plan 1 tenants get Real-time detections, Plan 2 tenants get Threat Explorer, and the gap between them is bigger than the similar screens suggest.

## What are Threat Explorer and Real-time detections?

Both live in the Microsoft Defender portal under **Email & collaboration**. Microsoft calls them "near real-time tools to help Security Operations (SecOps) teams investigate and respond to threats" ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/threat-explorer-threat-hunting)).

- **Real-time detections** comes with Defender for Office 365 Plan 1, for example in Microsoft 365 Business Premium. It's at `https://security.microsoft.com/realtimereportsv3`.
- **Threat Explorer** (shown as **Explorer** in the menu) comes with Plan 2, for example in Microsoft 365 E5. It's at `https://security.microsoft.com/threatexplorerv3`.

Microsoft says Threat Explorer "contains the same information and capabilities as Real-time detections" plus more views, more filters including saved queries, and "threat hunting and remediation actions" ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/threat-explorer-threat-hunting)). The menu entry is also the quickest way to tell which plan you have: Real-time detections means Plan 1, Explorer means Plan 2 ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/mdo-about)). Our [Plan 1 vs Plan 2 guide](https://iblockspam.com/blog/defender-for-office-365-plan-1-vs-plan-2) covers the licensing side.

Tenants without either plan, using only the built-in protection described in [what is Exchange Online Protection](https://iblockspam.com/blog/what-is-exchange-online-protection-eop), have neither tool. Their investigation tools are [message trace](https://iblockspam.com/blog/microsoft-365-message-trace), email security reports and the audit log.

## Which views does each tool have?

Both tools are organized into views (tabs). This is the table from [Microsoft's documentation](https://learn.microsoft.com/en-us/defender-office-365/threat-explorer-threat-hunting):

| View | Threat Explorer | Real-time detections | What it shows |
|---|---|---|---|
| All email | Yes (default) | No | All email from external senders and between internal users |
| Malware | Yes | Yes (default) | Messages that contain malware |
| Phish | Yes | Yes | Messages that contain phishing threats |
| Campaigns | Yes | No | Mail that Plan 2 grouped into a coordinated phishing or malware campaign |
| Content malware | Yes | Yes | Malicious files in SharePoint, OneDrive and Teams |
| URL clicks | Yes | No | User clicks on URLs in email, Teams, SharePoint and OneDrive |

The missing All email view matters more than it looks. Microsoft says Real-time detections shows "the malicious email detections at the time of delivery only", while Threat Explorer adds post-delivery activities ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/threat-explorer-real-time-detections-about)). Its email views are Malware and Phish, so a phish that Microsoft scored as clean is unlikely to show up there, and for missed messages a Plan 1 admin usually falls back to message trace.

### How much data do you get?

By default each view shows yesterday and today. You can set start and end dates "up to 30 days ago" ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/threat-explorer-real-time-detections-about)). Microsoft's [data retention page](https://learn.microsoft.com/en-us/defender-office-365/mdo-data-retention) lists these limits at the time of writing (October 2026), and message trace is added for comparison from Microsoft's message trace documentation:

| Data | Retention |
|---|---|
| Real-time detections | 30 days |
| Threat Explorer | 30 days |
| Email entity page | 30 days |
| Campaigns | 30 days |
| Message trace (for comparison) | 90 days |

If an incident might turn into a dispute, insurance claim or legal matter, export what you find. Explorer can export "up to 200,000 filtered or unfiltered results to a CSV file."

## How do you filter results?

Filters are property queries, built as *property*, *equal any of* or *equal none of*, then values. Select **Refresh** after each change. The All email view offers these groups of properties ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/threat-explorer-real-time-detections-about)):

- **Basic:** sender address, sender domain, recipients, subject, sender mail from domain, delivery action, latest and original delivery location, detection technology, directionality, threat type and more.
- **Advanced:** Internet Message ID, Network Message ID, sender IP, attachment SHA256, cluster ID, alert ID and campaign ID.
- **URLs:** URL domain, URL domain and path, full URL, click verdict and URL source (including **QR code**).
- **File:** attachment filename, file type and size.
- **Authentication:** SPF, DKIM, DMARC and composite results.

**Delivery action** tells you what filtering did at arrival: **Blocked**, **Delivered**, **Delivered to junk** or **Replaced**. **Latest delivery location** tells you where the message is now, which can differ if [zero-hour auto purge](https://iblockspam.com/blog/microsoft-365-zero-hour-auto-purge-zap) or an admin moved it later.

Some filters exist only in Explorer, including tags (such as Priority account), Exchange transport rule, connector and context. Saved queries are Explorer-only too.

The fastest way to find one specific message is its Network Message ID, which is in the `X-MS-Exchange-Organization-Network-Message-Id` header. Paste a reported message's headers into the [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer) to pull it out, or see [Microsoft 365 spam headers explained](https://iblockspam.com/blog/microsoft-365-spam-headers-explained).

## How do you find every copy of a phishing campaign?

Start from one known-bad message and widen the search until you've found every variant.

1. **Collect indicators** from the first message: sender address and domain, subject, any URL domain, and the attachment hash if there is one.
2. **Open the right view.** In Threat Explorer, use **All email** so undetected copies show up. In Real-time detections, use **Phish** or **Malware**.
3. **Set the date range** to cover the attack, up to 30 days back.
4. **Filter on one shared indicator**, such as sender domain, sender IP, URL domain or attachment SHA256, then select **Refresh**. Attackers rotate subjects and senders far more often than payload domains.
5. **Pivot the chart** by sender IP, sender domain or URL domain to spot variants, then add them to the filter.
6. **Check Latest delivery location.** Anything still in **Inbox/folder** needs action. Quarantined and junked copies are less urgent.
7. **Check clicks** (Explorer only). The **URL clicks** view shows who clicked and the click verdict, such as **Blocked** or **Block overridden**.
8. **Export** the results before you remediate, so you have a record of what was delivered where.

### Use the Campaigns view in Plan 2

Plan 2 groups related mail for you. Microsoft defines a campaign as "a coordinated email attack against one or many organizations", identified from the attack source, message properties, recipients and payload ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/campaigns)). The **Campaigns** page (`https://security.microsoft.com/campaigns`) lists each campaign with its recipients, how many reached an inbox, how many users clicked and how many reached the payload site.

Open a campaign and use **Explore messages** > **Inboxed messages** to jump into Explorer with the campaign ID and an Inbox filter already set. That's usually the list you need to remediate.

## How do you remove or move messages?

Select messages in the **Email** tab below the chart, or open one message, then choose **Take action**. The options depend on your plan ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/threat-explorer-threat-hunting)):

| Action | Plan 2 (Explorer) | Plan 1 (Real-time detections) |
|---|---|---|
| Move or delete | Yes | No |
| Release quarantined messages to recipients | Yes | No |
| Submit to Microsoft for review | Yes | Yes |
| Allow or block entries in the Tenant Allow/Block List | Yes | Yes |
| Initiate automated investigation | Yes | No |
| Propose remediation | Yes | No |

**Move or delete** offers five destinations:

- **Junk:** moves the message to Junk Email.
- **Inbox:** moves it back, or releases it from quarantine.
- **Deleted items:** moves it to Deleted Items, where the user can still see it.
- **Soft deleted items:** moves it to Recoverable Items\Deletions. Microsoft says the message "is recoverable by the user and admins." For internal senders, **Delete sender's copy** also tries to remove it from their Sent Items.
- **Hard deleted items:** purges it. Admins can still recover it with single item recovery.

For phishing, soft delete is the usual choice. It takes the message out of the user's view but is easy to reverse if you got it wrong. Keep hard delete for messages you're sure about.

**Propose remediation** creates a soft delete that someone else must approve in the Action center. Microsoft calls this "two-step approval", and it lets analysts without delete rights queue a cleanup. [Automated investigation and response](https://iblockspam.com/blog/microsoft-365-automated-investigation-response) uses the same approval queue.

### Limits and permissions

- With up to 100 messages selected, you can combine actions. With 101 to 200,000, Explorer lets you choose either **Move or delete** or **Propose remediation**, not both. Real-time detections only allows submission and Tenant Allow/Block List entries.
- Moving or deleting needs the **Search and Purge** role. By default only the **Data Investigator** and **Organization Management** role groups have it. Previewing or downloading a message needs the **Preview** role.
- Actions are logged in the Action center (`https://security.microsoft.com/action-center/history`), which is where you prove what was removed and when.

### What Plan 1 admins can do instead

Real-time detections can't move mail. In Plan 1 you can still submit the message to Microsoft and block the sender, domain, URL or file in the Tenant Allow/Block List, and ZAP may remove delivered copies once Microsoft's verdict changes. For anything ZAP doesn't catch, removal needs a separate search and purge in Microsoft Purview, or the user deleting it.

## Which tool should you use for which question?

| Question | Best tool |
|---|---|
| Did this one message arrive, and where did it go? | Message trace |
| Which messages did Microsoft flag as phishing or malware this week? | Real-time detections or Explorer |
| Who received a phish that Microsoft didn't catch? | Explorer (All email), or message trace in Plan 1 |
| Who clicked the link? | Explorer (URL clicks) |
| Remove 300 delivered copies now | Explorer (Move or delete) |
| What did the attacker do inside the mailbox afterwards? | [Purview audit log](https://iblockspam.com/blog/microsoft-365-audit-log-email-investigation) |

## What changes if a gateway filters mail first?

If your MX points to a filtering gateway, mail still lands in Exchange Online, so both tools still see it and Explorer can still remediate it. Two things change. Messages arrive through your inbound connector, which Explorer can filter by **Connector**. And Microsoft only sees the original sender IP if you set up [Enhanced Filtering for Connectors](https://iblockspam.com/blog/microsoft-365-third-party-spam-filter-enhanced-filtering). Without it, sender IP pivots show your gateway's addresses. Mail the gateway blocked never reaches Microsoft, so look for it in the gateway's own message history.

## Next steps

1. Check which menu entry your tenant shows under **Email & collaboration**: Real-time detections or Explorer.
2. Give your incident responders the Search and Purge and Preview roles before you need them, not during an incident.
3. Practice the campaign hunt on a recent quarantined phish, so the filters are familiar when it matters.
4. Export evidence within 30 days. After that, Explorer data is gone.
5. Fewer phish reaching inboxes means less to hunt. iBlockSpam filters inbound mail at the MX, with a 30-day message history for every domain; see [how it works](https://iblockspam.com/how-it-works).

Browse our other [email operations guides](https://iblockspam.com/blog/topic/operations).

## Frequently asked questions

### How far back can Threat Explorer search email?

30 days. Microsoft's Defender for Office 365 data retention page lists 30 days for both Threat Explorer and Real-time detections, and the date filter accepts start and end dates up to 30 days ago. For older mail, use message trace, which covers 90 days, or export Explorer results to CSV while the data still exists.

### Can Real-time detections delete phishing emails from user mailboxes?

No. In Defender for Office 365 Plan 1, the Take action wizard only offers Submit to Microsoft for review and the related allow or block entries in the Tenant Allow/Block List. Moving or deleting delivered messages, proposing remediation and starting automated investigations all need Threat Explorer, which comes with Plan 2.

### Which role lets an admin remove messages with Threat Explorer?

The Search and Purge role in Email and collaboration permissions, which Microsoft assigns by default only to the Data Investigator and Organization Management role groups. With Defender XDR unified RBAC, the equivalent is the Email and collaboration advanced actions (manage) permission. Previewing or downloading a message needs the separate Preview role.

### Is a soft delete from Threat Explorer reversible?

Yes. Soft delete moves the message to the Recoverable Items Deletions folder, and Microsoft says it stays recoverable by the user and by admins. You can also move it back to the Inbox from Explorer. Hard delete purges the message, though admins can still recover it through single item recovery.

### Why don't I see an All email view in the Defender portal?

Your tenant probably has Plan 1. The All email view, along with Campaigns and URL clicks, exists only in Threat Explorer. Microsoft says the presence of Real-time detections under Email and collaboration indicates Plan 1, while Explorer indicates Plan 2. Real-time detections opens on the Malware view by default.

## Sources

- [Microsoft Learn: About Threat Explorer and Real-time detections in Microsoft Defender for Office 365](https://learn.microsoft.com/en-us/defender-office-365/threat-explorer-real-time-detections-about)
- [Microsoft Learn: Threat hunting in Threat Explorer and Real-time detections](https://learn.microsoft.com/en-us/defender-office-365/threat-explorer-threat-hunting)
- [Microsoft Learn: Microsoft Defender for Office 365 data retention](https://learn.microsoft.com/en-us/defender-office-365/mdo-data-retention)
- [Microsoft Learn: Campaigns in Microsoft Defender for Office 365](https://learn.microsoft.com/en-us/defender-office-365/campaigns)
- [Microsoft Learn: Why do I need Microsoft Defender for Office 365?](https://learn.microsoft.com/en-us/defender-office-365/mdo-about)

## Free tools for this guide

- [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer): Trace hops and authentication results — runs entirely in your browser.
- [MX Lookup](https://iblockspam.com/tools/mx-lookup): See where your mail is delivered, spot unfiltered backup MX and broken hosts.
- [Email Health Check](https://iblockspam.com/tools/email-health-check): Grade your domain's MX, SPF, DKIM, DMARC and transport security in one scan.

---

Source: iBlockSpam, https://iblockspam.com/blog/microsoft-365-threat-explorer-real-time-detections (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt