Is Defender for Office 365 Plan 1 enough, or do I need Plan 2?
Plan 1 is the minimum any business tenant should run — it covers prevention: Safe Links, Safe Attachments, and advanced anti-phishing. Plan 2 adds the response layer — Automated Investigation and Response, Threat Explorer, Campaign Views, and Attack Simulation Training — and pays for itself wherever someone actually works a security queue. If nobody in the organisation will ever open Threat Explorer, Plan 1 is the right call.
Where each plan sits in licensing
- Plan 1 is included in Microsoft 365 Business Premium.
- Plan 2 is included in Microsoft 365 E5 and Office 365 E5, and available as a standalone add-on for E3.
- E3 and Office 365 E3 on their own include only Exchange Online Protection — no Safe Links or Safe Attachments without adding Plan 1 or Plan 2.
Read next
- Microsoft Defender for Office 365 explained— What Defender for Office 365 adds on top of EOP — Safe Links, Safe Attachments, AIR, attack simulation — plus Plan 1 vs Plan 2 and the settings worth tuning.