What each license includes
| Level | What it includes | Where it’s included |
|---|---|---|
| Built-in protection (formerly EOP) | Spam, malware and basic phishing filtering, and user reporting | Every cloud mailbox |
| Plan 1 | Safe Links, Safe Attachments, impersonation protection, Real-time detections and Teams protections | Business Premium, and since July 2026 Microsoft 365 E3 and Office 365 E3 |
| Plan 2 | Everything in Plan 1, plus Threat Explorer, AIR, Attack simulation training, Campaigns and advanced hunting | Microsoft 365 E5, or Business Premium with Defender Suite for Business Premium |
A quick way to tell what you have: if the Defender portal shows Explorer, you have Plan 2. If it shows Real-time detections, you have Plan 1.
The settings that matter
- Preset policies. There are three: Built-in protection, Standard and Strict. Only Built-in protection is on by default, and it’s the weakest: users can click through a warning, and internal senders aren’t covered. Standard and Strict are tighter, and Microsoft recommends applying them to all users.
- Safe Links. Checks links at the time of click, in email, Teams and the Office apps. There’s nothing to "turn on" for click-time checking; that’s how it works. What to check: that it applies to all users, internal senders included, and that users can’t click through the warning.
- Safe Attachments. The recommended action is Block. If delivery delays are a problem, Dynamic Delivery delivers the message body right away and adds the attachments after scanning. A separate setting protects files in SharePoint, OneDrive and Teams.
- Impersonation protection. Mailbox intelligence is on by default. But protection for specific people, such as your CEO and CFO, doesn’t work until you add them to the list, up to 350 users per policy. In a custom policy, the default action is also "don’t apply any action".
- Priority accounts. Tag up to 250 sensitive users as priority accounts. With Plan 2 they get extra protection, and either way their alerts and reports are easier to filter.
- Configuration analyzer. Compares your policies with the Standard and Strict settings and shows where yours are weaker. The tab that tracks changes over time requires auditing to be on.
Common mistakes
- Custom policies nobody reviews. A custom policy beats Built-in protection, but a preset policy beats a custom one. Whoever built policies a few years ago usually doesn’t know what actually applies to each user.
- Impersonation protection with no protected users. The license is there and the setting is on, but the list is empty.
- Expecting Plan 2 features. Threat Explorer, AIR and Attack simulation training aren’t included in Business Premium or E3.
- AIR actions waiting for approval. Even with Plan 2, most AIR remediation actions wait for security team approval and expire after a week. Someone has to go through them.
A KnowBe4, Hoxhunt or Cofense report button: connect it to Microsoft
If you use another vendor’s report button, you can send the messages users report to Microsoft as well. They then show up on the User reported page in the Defender portal, generate alerts and, with Plan 2, trigger AIR. Setup:
- A reporting mailbox. The button must send reports to an Exchange Online mailbox. Not a distribution group, and not a mailbox outside the organization.
- Portal settings. In Settings > Email & collaboration > User reported settings, choose Use a non-Microsoft add-in button, and under Reported item destinations choose Microsoft and my reporting mailbox.
- Report format. The original message is attached as an EML or MSG file, unchanged and uncompressed, one message per report. The report subject starts with 1| (Junk), 2| (Not junk) or 3| (Phishing). A report with no prefix is treated as phishing.
- Exclusions. Set the mailbox as a SecOps mailbox in the advanced delivery policy, and exclude it from DLP, so messages arrive as they are.
Note: simulation messages reported through another vendor’s button won’t show up in Attack simulation training reports.
Want to know what’s configured in your Defender for Office 365? Griffin31 checks your Microsoft 365 tenant’s security settings continuously, including Safe Links, Safe Attachments and preset policies, and shows you what to fix first.
Sources
- Microsoft: Microsoft Defender for Office 365 overview
- Microsoft: Preset security policies
- Microsoft: Safe Links
- Microsoft: Safe Attachments
- Microsoft: Anti-phishing policies
- Microsoft: Priority account protection
- Microsoft: Configuration analyzer
- Microsoft: Use a reporting mailbox with non-Microsoft add-ins (user reported settings)
- Microsoft: Automated investigation and response (AIR)
- Microsoft: Defender for Office 365 service description (plans and licensing)
- Microsoft: What’s new in Defender for Office 365