Defender for Office 365 Plan 1 vs Plan 2: Features, Licences Included and Which to Buy

The short version: Plan 1 is about prevention: Safe Links, Safe Attachments and stronger anti-phishing for email, Teams, SharePoint and OneDrive. Plan 2 includes everything in Plan 1 and adds investigation and response: Threat Explorer, automated investigation and response, attack simulation training and advanced hunting. Buy Plan 1 if you need the protection and nobody will investigate alerts. Buy Plan 2 if someone will actually use the investigation and training tools. Check your current licences first: Business Premium and, since 1 July 2026, Microsoft 365 E3 and Office 365 E3 already include Plan 1.

This guide is for the Microsoft 365 administrator or business owner who has been asked to decide between Plan 1 and Plan 2, or who wants to know what their existing subscription already covers. You will get the feature differences as a list, the licences that include each plan, and a rule for choosing. Checked against Microsoft Learn on 28 October 2026. Microsoft prices change, so this article gives none; use Microsoft's Defender for Office 365 page for current prices.

Where the plans sit

Microsoft describes a protection ladder with three steps:

1. Built-in security features for all cloud mailboxes (commonly called Exchange Online Protection, or EOP): anti-malware, anti-spam, anti-phishing for spoofing, connection filtering, quarantine, and the Tenant Allow/Block List. Included with every Microsoft 365 subscription that has cloud mailboxes.
2. Defender for Office 365 Plan 1: adds prevention and detection for zero-day malware, phishing and business email compromise.
3. Defender for Office 365 Plan 2: adds phishing simulation, post-breach investigation, hunting, response and automation.

If you have not tuned the built-in layer yet, do that first. See Exchange Online Protection settings.

Feature by feature

Each line shows what Microsoft lists for Plan 1 and Plan 2, in the same order.

Prevention and detection

• Safe Attachments in email: Plan 1 yes; Plan 2 yes.
• Safe Attachments for SharePoint, OneDrive and Microsoft Teams: Plan 1 yes; Plan 2 yes.
• Safe Links in email, Office apps and Teams: Plan 1 yes; Plan 2 yes.
• Anti-phishing with user and domain impersonation protection, mailbox intelligence and phishing email thresholds: Plan 1 yes; Plan 2 yes.
• Tenant Allow/Block List for Teams domains and addresses, and user-reported Teams items: Plan 1 yes; Plan 2 yes.
• Attack simulation training (phishing simulations for staff): Plan 1 no; Plan 2 yes.
• Priority account protection: Plan 1 no; Plan 2 yes. (Plan 1 includes user tags, including the Priority account tag.)

Investigation

• Real-time detections: Plan 1 yes; Plan 2 replaced by Threat Explorer.
• Threat Explorer: Plan 1 no; Plan 2 yes.
• Threat Trackers and Campaigns: Plan 1 no; Plan 2 yes.
• Email entity page, URL trace and Defender for Office 365 reports: Plan 1 yes; Plan 2 yes.
• Advanced hunting, including Teams messages: Plan 1 no; Plan 2 yes.

Response and automation

• Zero-hour auto purge for Teams: Plan 1 yes; Plan 2 yes.
• Automated investigation and response (AIR): Plan 1 no; Plan 2 yes.
• Remove users from Teams chats in the Teams message entity panel: Plan 1 no; Plan 2 yes.
• Alerts and incidents: Plan 1 includes Email & collaboration alerts; Plan 2 adds investigating incidents and alerts in Microsoft Defender XDR.

Safe Documents is a separate feature. Microsoft states it is available with Microsoft 365 E5/A5 or Microsoft Defender Suite licences, not in either Defender for Office 365 plan.

A quick way to tell which plan a tenant has: in the Defender portal, Email & collaboration shows Real-time detections with Plan 1 and Explorer with Plan 2.

Which licences already include them

Microsoft's service description lists these:

• Plan 1: the standalone Plan 1 licence, Microsoft 365 Business Premium, Microsoft 365 E3/G3 and Office 365 E3/G3 (from 1 July 2026, with rollout completing by 1 August 2026), Microsoft 365 E5/A5/G5, Office 365 E5/A5/G5, Microsoft Defender Suite, and Microsoft Defender plus Purview Suite for frontline workers.
• Plan 2: the standalone Plan 2 licence, Microsoft 365 E5/A5/G5, Office 365 E5/A5/G5, Microsoft Defender Suite, and Microsoft Defender plus Purview Suite for frontline workers.

Defender for Office 365 is also sold as an add-on to many Microsoft 365 subscriptions with cloud mailboxes.

Microsoft Defender for Business, which Business Premium includes, is endpoint protection. It is a different product from Defender for Office 365.

Licensing rules to know

Microsoft's licensing terms say licences are needed for:

• every user who accesses a mailbox that benefits from Defender for Office 365 protection, and shared mailboxes that benefit;
• all users of SharePoint, OneDrive and Teams, if Safe Attachments protection for those is on;
• every user of Microsoft 365 apps or Teams when Safe Links is enabled.

You can scope policies to licensed users. Microsoft also describes a Built-in protection preset policy that gives basic Safe Attachments and Safe Links protection to users in organisations with Defender for Office 365 licences, but recommends buying enough licences to cover all users.

How to choose

1. Check what you own. Business Premium and, from 1 July 2026, Microsoft 365 E3 and Office 365 E3 include Plan 1. E5 plans include Plan 2. If you are on E3, the decision is whether to add Plan 2.
2. Business Premium or a similar plan, mainly stopping bad email: Plan 1 is usually enough. Turn on the Standard preset security policy and use what you already have.
3. Someone will investigate and respond: Plan 2 adds Threat Explorer, AIR and hunting, but those only pay off if a person or your managed security provider opens them. Without that, you are paying for tools no one uses.
4. You want to train staff with phishing simulations: Plan 2 is the plan that includes attack simulation training.
5. A small group is targeted constantly (finance, executives): Plan 2 brings priority account protection. Check the licensing terms above to see who must be licensed before you license only that group.
6. Not sure yet: Microsoft offers a 90-day Plan 2 trial from the Defender portal trials hub, so you can see Threat Explorer and AIR with your own mail before you buy.

Common mistakes

1. Buying a plan before tuning the built-in protection. SPF, DKIM, DMARC and anti-phishing settings should be done first.
2. Buying Plan 2 and never opening Threat Explorer. The extra cost is for investigation and response. Assign an owner.
3. Assuming Safe Links and Safe Attachments are on. Check Email & collaboration > Policies & rules > Threat policies > Preset Security Policies and switch on Standard protection.
4. Confusing Defender for Business with Defender for Office 365. One covers endpoints, the other covers email and collaboration.
5. Licensing a few users but protecting everyone. Microsoft's licensing terms say who needs a licence. Scope policies to licensed users or license everyone covered.
6. Believing a published comparison without checking your tenant. Licence bundles change. Check Your products.

How to check it worked

1. In the Microsoft Defender portal (security.microsoft.com) open Email & collaboration and note whether you see Real-time detections or Explorer.
2. Go to Email & collaboration > Policies & rules > Threat policies > Preset Security Policies and confirm Standard protection is on and assigned to the right recipients.
3. Open Safe Links and Safe Attachments under Threat policies and confirm a policy applies to your licensed users.
4. After a month, check whether anyone opened Threat Explorer or AIR. If not, revisit the Plan 2 decision.

FAQ

What is the difference between Defender for Office 365 Plan 1 and Plan 2?

Plan 1 provides prevention and detection: Safe Attachments, Safe Links, anti-phishing with impersonation protection and Real-time detections. Plan 2 includes all of that and adds Threat Explorer, Threat Trackers, Campaigns, automated investigation and response, attack simulation training, priority account protection and advanced hunting.

Is Defender for Office 365 Plan 1 included in E3?

Yes, since 1 July 2026. Microsoft's Defender for Office 365 features service description states that Plan 1 is included with Office 365 E3 and Microsoft 365 E3, and that E3 customers receive Plan 1 capabilities only. Microsoft says the rollout completes by 1 August 2026, with at least 30 days' notice in Message Center, so check Your products if your tenant has not received it yet.

Is Defender for Office 365 Plan 2 included in Business Premium?

Microsoft's service description lists Business Premium under Plan 1 only. Plan 2 is included in the E5/A5/G5 plans and the Defender Suite, and is also sold standalone and as an add-on to many subscriptions.

How much does Defender for Office 365 cost?

Prices vary by plan, region and agreement and change over time, so check Microsoft's official Defender for Office 365 page or ask your Microsoft partner for a quote.

Do I still need EOP if I buy Defender for Office 365?

Yes. The built-in cloud mailbox protection is the base of the ladder, and Defender for Office 365 builds on it. Tune the built-in settings regardless of which plan you hold.

Next step

If you want help deciding which plan fits your users and who would operate it, see our security services, and read the Microsoft Defender portal guide and Microsoft 365 E3 vs E5 vs EMS security.

If you would rather know the price of a full review before you start, what a Microsoft 365 security audit costs sets out the fixed prices by headcount.