Every Microsoft 365 mailbox comes with a baseline bodyguard called Exchange Online Protection, and it stops the obvious junk. The problem is that the attacks that actually cost businesses money, targeted phishing, impersonation, malicious links that turn bad after delivery, are built to walk right past that baseline. That is the job of Microsoft Defender for Office 365, and it comes in two tiers that confuse almost everyone: Plan 1 and Plan 2.
Here is the difference in one sentence, then the details. Plan 1 protects your people from threats. Plan 2 protects your people and gives your security team the tools to hunt, investigate, and respond when something gets through. Prevention versus prevention plus operations.
And a timely note before we compare: Microsoft’s recent licensing changes added Defender for Office 365 Plan 1 to the Office 365 E3 and Microsoft 365 E3 plans, so a lot of organizations just received P1 without asking for it. If that is you, the real question has shifted from “should we buy P1” to “what did we just get, and is P2 worth the jump.”
What each plan includes
| Capability | EOP (baseline) | Plan 1 | Plan 2 |
|---|---|---|---|
| Spam and malware filtering | Yes | Yes | Yes |
| Safe Links (URL scanning at click time) | No | Yes | Yes |
| Safe Attachments (detonation sandbox) | No | Yes | Yes |
| Anti-phishing with impersonation protection | Basic | Advanced | Advanced |
| Protection for SharePoint, OneDrive, Teams | No | Yes | Yes |
| Real-time detections | No | Yes | Yes |
| Threat Explorer (full hunting) | No | No | Yes |
| Automated Investigation and Response (AIR) | No | No | Yes |
| Attack Simulation Training (phishing tests) | No | No | Yes |
| Campaign views and Threat Trackers | No | No | Yes |
| List price (approx., per user/month) | Included | ~$2 | ~$5 |
Plan 1: the protection layer
Plan 1 is the upgrade that closes the gap between “we filter spam” and “we defend against modern phishing.” Safe Links rewrites and checks URLs at the moment of click, which matters because attackers routinely weaponize a link hours after the email lands. Safe Attachments detonates files in a sandbox before delivery. Impersonation protection catches the lookalike CEO and lookalike-vendor emails that drive business email compromise, the crime that drained $2.77 billion from US businesses in 2024 per FBI figures. And the protection extends past the inbox into SharePoint, OneDrive, and Teams, where malicious files increasingly live.
Plan 1 is included in Microsoft 365 Business Premium, and, as of the recent packaging changes, in the E3 plans. For most small and midsize businesses, P1 is the sensible floor.
Plan 2: the security operations layer
Plan 2 includes everything in Plan 1 and adds the tools a security team uses after prevention: Threat Explorer for hunting across your whole mail flow, Automated Investigation and Response that triages and remediates threats without a human clicking through every alert, Attack Simulation Training for running your own phishing tests against your staff, and campaign views that show you an entire attack wave instead of one email at a time.
Read that list again and notice the pattern: every P2 feature assumes someone is operating it. AIR needs its verdicts reviewed. Threat Explorer is only useful if someone hunts. Attack Simulation only helps if someone runs the program. Plan 2 is included in Microsoft 365 E5 and Office 365 E5, and Business Premium customers can reach it through the E5 Security add-on or standalone P2 licenses.
The honest recommendation
For a typical SMB without a security team: Plan 1, properly configured, gets you most of the protection value. Emphasis on properly configured, because Defender’s default policies are conservative, and the difference between default P1 and tuned P1 is significant.
Plan 2 is worth it in three cases. First, if you face frequent targeted attacks or handle wire transfers, client funds, or sensitive data, where the investigation and response capability pays for itself the first time something gets through. Second, if compliance or your cyber insurance carrier expects demonstrated phishing simulation and incident response capability, which is increasingly the case per the controls we covered in our cyber insurance requirements guide. Third, and this is the one most articles skip: if someone will actually operate it. P2 without an operator is shelfware at $5 a seat.
That last point is where a provider changes the math. Our clients get P2-grade outcomes because our in-house 24/7 SOC operates the tooling, hunts the threats, and runs the phishing simulations as part of our email security and phishing protection service. The license is the instrument; the SOC is the musician.
FAQ
Is Defender for Office 365 Plan 1 included in Business Premium? Yes. Business Premium includes Plan 1, and following Microsoft’s recent licensing changes, the E3 plans now include Plan 1 as well. Plan 2 is included in the E5 plans.
Does Plan 2 include everything in Plan 1? Yes. Plan 2 is a superset: all P1 protection features plus the investigation, automation, hunting, and simulation tools.
Can I mix plans across users? Licensing-wise you can, but Microsoft’s guidance and practical experience both point to licensing all mailbox users at the same tier, because threats do not respect your org chart and tenant-wide features behave best when coverage is uniform.
Is Plan 2 worth it for a small business? Only if someone will operate it. The P2 features are operational tools, not set-and-forget protection. If you have no security staff, either stay on a well-tuned P1 or get P2 outcomes through a provider with a real SOC.
How is this different from Defender for Business or Defender for Endpoint? Different product family. Defender for Office 365 protects email and collaboration. Defender for Business and Defender for Endpoint protect devices. A complete defense uses both layers.
Get the licensing right, then the configuration
The wrong license wastes money; the right license badly configured wastes protection. We do both halves for businesses across Los Angeles, Orange County, and San Diego: right-sizing your Microsoft licensing through our licensing and cost optimization service, then tuning Defender so it actually earns its keep. If you are staring at a renewal or just inherited P1 in the E3 changes, reach out and we will map the smart move.