Skip to content

Defender for Office 365 Licensing Guide

Microsoft Defender for Office 365 Licensing Guide

Section titled “Microsoft Defender for Office 365 Licensing Guide”

Microsoft Defender for Office 365 provides advanced threat protection for email and collaboration tools, helping organizations defend against sophisticated cyber attacks. The solution is available in two tiers—Plan 1 (P1) and Plan 2 (P2)—each offering different levels of protection and security capabilities.


Ideal for: Organizations needing essential email and collaboration security with core threat protection features.

Plan 1 provides essential security features focused on protecting your organization from email-based threats.

FeatureCapabilityBusiness Value
Safe AttachmentsScans attachments in sandboxed environment before deliveryPrevents malicious file delivery to users
Safe LinksReal-time URL scanning at time of clickProtects users from malicious websites
Anti-phishing PoliciesDetection of spoofed emails and impersonation attemptsSafeguards against social engineering attacks
Real-time Threat DetectionImmediate alerts for suspicious activitiesRapid threat identification and response
Internal and External Email ProtectionScans both inbound and outbound emailsComprehensive email security coverage
Microsoft Teams Safe LinksExtends Safe Links to Teams chatsProtects collaboration communications

Ideal for: Organizations with higher security requirements needing advanced threat detection, investigation, and response capabilities.

In addition to all the features provided in P1, Plan 2 introduces several advanced threat detection, investigation, and response capabilities.

FeatureCapabilityBusiness Value
Threat ExplorerReal-time threat investigation across email and collaborationDeep threat analysis and tracking
Automated Investigation and Response (AIR)AI-powered threat investigation and remediationReduces manual security work
Threat TrackerGlobal cyber threat monitoring and insightsProactive defense capabilities
Attack Simulation TrainingPhishing attack simulations for employee trainingImproves user security awareness
Microsoft 365 Defender (XDR)Cross-domain threat correlationHolistic security visibility
Advanced Threat AnalyticsDetailed threat analytics and reportingComprehensive security insights

CapabilityPlan 1Plan 2
Safe Attachments
Safe Links
Anti-phishing Protection
Real-time Threat Detection
Teams Safe Links
Threat Explorer
Automated Investigation & Response
Threat Tracker
Attack Simulation Training
XDR Capabilities
Advanced Threat Analytics

Key Insight: Plan 1 focuses on essential email protection, while Plan 2 adds advanced threat investigation and response capabilities, making it more suitable for organizations with higher risk profiles.


PlanPrice per User/MonthCommitment Type
Defender for Office 365 Plan 1 (P1)$2.00Annual commitment
Defender for Office 365 Plan 2 (P2)$5.00Annual commitment

These plans can be purchased as standalone licenses or as part of Microsoft 365 subscriptions.


Microsoft 365 Plans Including Defender for Office 365 Plan 1 (P1)

Section titled “Microsoft 365 Plans Including Defender for Office 365 Plan 1 (P1)”
Microsoft 365 PlanInclusion Details
Microsoft 365 Business PremiumP1 bundled as part of the plan for SMBs
Microsoft 365 E3P1 included for enterprise email protection

Microsoft 365 Plans Including Defender for Office 365 Plan 2 (P2)

Section titled “Microsoft 365 Plans Including Defender for Office 365 Plan 2 (P2)”
Microsoft 365 PlanInclusion Details
Microsoft 365 E5P2 bundled with advanced threat protection
Office 365 E5P2 included for email and collaboration security
Microsoft 365 E5 Security Add-onP2 available as add-on to E3 plans

Plan 1 is suitable for organizations that:

  • Need essential email and collaboration protection
  • Have basic security requirements
  • Want protection against common email threats
  • Require cost-effective security solution

Plan 2 is ideal for organizations that:

  • Have higher security requirements
  • Need advanced threat investigation capabilities
  • Require automated security response
  • Want comprehensive threat analytics
  • Need to train employees on security awareness

Key Takeaway: Microsoft Defender for Office 365 offers flexible licensing options to meet different organizational security needs. Plan 1 provides essential protection for most businesses, while Plan 2 delivers advanced capabilities for organizations with sophisticated security requirements.

The choice between plans depends on your organization’s risk profile, security maturity, and budget considerations. Both plans can be purchased standalone or as part of broader Microsoft 365 subscriptions, providing flexibility in how you implement email and collaboration security.