Microsoft Defender for Office 365 Overview

Summary

The document provides an overview of Microsoft Defender for Office 365, outlining the protection "ladder" from default security features to advanced threat protection plans, specifically Plan 1 and Plan 2.
Key differences between default protections, Plan 1, and Plan 2 are described, including the types of threats addressed, investigative tools available, and response capabilities.
The article emphasizes the cumulative and layered approach to security, encourages proper email authentication setup, and highlights both availability and feature distinctions between plans.
Intended for SecOps personnel, Microsoft 365 admins, and decision makers considering Defender for Office 365 adoption or upgrades.

All Microsoft 365 cloud mailbox users receive default email protections, including anti-malware, anti-spam, and anti-phishing.
Defender for Office 365 Plan 1 builds on this foundation, offering enhanced protection against zero-day malware, phishing, and business email compromise (BEC).
Defender for Office 365 Plan 2 adds advanced features such as phishing simulations, post-breach investigation, hunting, response, and automation.
Defender for Office 365 is available as an add-on or included in certain Microsoft 365 subscriptions.

Security is structured as cumulative layers, with each tier adding more features and automation.
Proper email authentication (SPF, DKIM, DMARC) is recommended for all domains to help prevent spoofing attacks; configuration guidance is provided.

Prevents broad, known email attacks with baseline anti-spam, anti-malware, anti-phishing, outbound spam protection, and quarantine features.
Investigation tools include audit log search, message trace, and email security reports.
Response actions involve zero-hour auto-purge (ZAP) and allow/block list management.

Adds additional anti-phishing policies (impersonation protection, mailbox intelligence, phishing thresholds).
Introduces Safe Attachments (for emails, files in SharePoint, OneDrive, Teams), Safe Links, and enhanced alerting.
Investigation improvements: real-time detections, user tags (including for priority accounts), entity pages, and SIEM integration APIs.
Presence of real-time detections in the Defender portal differentiates Plan 1 from default protections.

Adds attack simulation training and priority account protection.
Investigation capabilities expanded with Threat Explorer, Threat Trackers, and campaign analysis.
Response automation introduced via Automated Investigation and Response (AIR), including SIEM API integration.
Explorer in the Defender portal is a distinguishing feature for Plan 2.

Plan 1 extends default protections with impersonation detection, Safe Attachments/Links, real-time detections, and basic priority account protection.
Plan 2 includes everything in Plan 1 plus attack simulation, advanced threat hunting, automated response, and deep incident investigation tools.
Plan 2 also allows integration with Microsoft Defender Extended Detection and Response (XDR).

Recommendations include using preset or custom threat policies as appropriate.
Guidance provided for trialing Defender for Office 365, migration from non-Microsoft protection solutions, and links to deployment and security operations guides.
The Microsoft 365 Roadmap offers updates on new features for Defender for Office 365.