Defender for Office 365 Plan 1 or Plan 2: what is the difference?

Key facts

• Exchange Online Protection is the baseline filter in every Exchange Online plan.
• Business Premium includes Defender for Office 365 Plan 1.
• Microsoft 365 E5 and Office 365 E5 include Plan 2.
• Plan 2 includes everything in Plan 1.
• Preset security policies are the fastest way to apply recommended settings in either plan.

The three layers

Email protection in Microsoft 365 builds in layers. Exchange Online Protection (EOP) filters spam, malware and basic phishing for every Exchange Online mailbox. Defender for Office 365 Plan 1 adds protections aimed at targeted attacks. Plan 2 adds tools for security teams to hunt, investigate, remediate and train users.

Plan 1 also extends Safe Links and Safe Attachments beyond email to Teams and to files in SharePoint and OneDrive, and to Office apps for Safe Links.

Feature comparison

Plan 1 stops more threats. Plan 2 helps people find and clean up the threats that got through, and test whether users would fall for them.

Which Microsoft 365 plans include which

Microsoft 365 Business Premium includes Plan 1, which is why it is the common choice for small and mid-size businesses. Microsoft 365 E3 and Office 365 E3 do not include Defender for Office 365 by default, so many E3 customers add Plan 1 or Plan 2. Microsoft 365 E5, Office 365 E5 and the Microsoft 365 E5 Security add-on include Plan 2.

Defender for Office 365 Plan 1 and Plan 2 are also sold as standalone add-ons. Licensing rules generally expect every user who benefits from the protection to be licensed, so check current Microsoft product terms before licensing only part of the organization.

How to decide

Choose Plan 1 if your goal is strong protection and you do not have staff or a partner who reviews email threats every week. Configured properly with preset security policies, it blocks most phishing and malware that targets SMBs.

Choose Plan 2 if you have a security team, a managed detection provider or a partner that will use Threat Explorer and automated investigation, if you want built-in phishing simulations, or if you already plan to move to E5 for other reasons such as Entra ID P2 or Purview features.

• Who will look at email threats, and how often?
• Do you need phishing simulation, or do you already have a training tool?
• Would automated remediation of reported messages save real staff time?
• Are other E5 features also on the roadmap?

Configuration matters more than plan

Many tenants own Plan 1 or Plan 2 but run with defaults or partial policies. Apply the Standard or Strict preset security policies, add your executives and finance staff as protected users for impersonation, add your own domains and key partner domains, and turn on Safe Attachments for SharePoint, OneDrive and Teams.

Then pair the email layer with DMARC enforcement on your own domains, blocked automatic external forwarding and the built-in Report button in Outlook. These steps often matter more than the jump from Plan 1 to Plan 2.

How Accred Consulting approaches it

Accred Consulting reviews which Defender for Office 365 plan you already own, how it is configured and who will act on alerts before recommending any license change. Discovery looks at mail flow, current policies and reported phishing. The proposal sets a clear scope, fixed price and timeline. US-based specialists apply preset security policies to a pilot group, tune impersonation protection, enforce DMARC and set up user reporting, with structured check-ins. Handover includes documentation and knowledge transfer, and optional support retainers can cover ongoing review of threats.

Track record: 475+ client projects, 2,000+ migration workstreams and 210,000+ users migrated by a US-based team. Company facts · Case studies

Related questions