Defender for Office 365 and built-in email protection, explained

Every Microsoft 365 organisation with cloud mailboxes gets some email protection without buying anything extra. Microsoft also sells Defender for Office 365, which adds further layers in two plans: according to Microsoft, Plan 1 adds protections such as Safe Links, Safe Attachments and impersonation protection, and Plan 2 adds attack simulation training, investigation, hunting and automation. The names have changed over the years, so it can be hard to tell what a tenant already has. This page explains how Microsoft’s documentation describes each layer and its main features, including how Defender for Office 365 Plan 1 differs from Plan 2.

Built-in protection (EOP)

For many years Microsoft called its baseline email filtering Exchange Online Protection (EOP). Microsoft’s current page on the topic is titled “Built-in security features for all cloud mailboxes”, and its text no longer uses the EOP name. The older name still shows up in some places, though: the preset security policies setup has a wizard page called Apply Exchange Online Protection, and related PowerShell commands such as Get-EOPProtectionPolicyRule keep “EOP” in their names.

Microsoft states that these protections “help protect your Microsoft 365 organization from spam, malware, phishing and other email threats”, and that they “are included in all organizations with cloud mailboxes”. Microsoft’s Defender for Office 365 overview describes them as preventing “broad, volume-based, known email attacks”.

According to that overview, the built-in layer includes anti-malware, anti-spam (including bulk email protection), anti-phishing (spoofing) protection, outbound spam protection, connection filtering, quarantine, the Tenant Allow/Block List, audit log search, message trace, email security reports, and zero-hour auto purge (ZAP) for email.

Defender for Office 365 Plan 1 and Plan 2

Microsoft’s overview describes Plan 1 as protecting “email and collaboration features from zero-day malware, phishing” and business email compromise. It lists additions including user and domain impersonation protection, Safe Attachments (including for files in SharePoint, OneDrive and Microsoft Teams), Safe Links in email, Office clients and Teams, real-time detections and ZAP for Microsoft Teams.

Microsoft states that Plan 2 “adds phishing simulations, post-breach investigation, hunting, and response, and automation”. Its listed additions include attack simulation training, priority account protection, Threat Explorer (in place of real-time detections), Threat Trackers, campaigns, automated investigation and response (AIR), and advanced hunting on Teams messages.

The licensing note on this page summarises which subscriptions Microsoft says include each plan, and the Microsoft 365 licensing and security features reference compares plans side by side.

Safe Links

Microsoft states that “Safe Links scanning protects your organization from malicious links that are used in phishing and other attacks”. The guide to phishing, smishing and vishing explains how these attacks work. It describes two parts: scanning and rewriting links in inbound email during mail flow, and “time-of-click verification of URLs and links in email messages, Teams, and supported Office 365 apps”.

Checking at the time of click matters because, as Microsoft’s support article explains, attackers “send benign links in messages. After the messages have been delivered, the attackers reconfigure and redirect the benign links to malicious sites.” Microsoft also states that Safe Links “occurs in addition to regular anti-spam and anti-malware protection”, and its documentation lists limits, such as no protection for URLs in rich text format (RTF) email messages. Microsoft notes there’s no default Safe Links policy, but the Built-in protection preset policy gives Safe Links protection to recipients not covered by other Safe Links policies “for customers that have at least one Defender for Office 365 license.”

Safe Attachments

Microsoft explains that Safe Attachments “uses a virtual environment to check attachments in email messages for harmful attachments (for example, malware, ransomware, and phishing) before they’re delivered to recipients (a process known as detonation)”. Microsoft describes it as “an additional layer of protection for email attachments that have already been scanned by Anti-malware protection.”

Microsoft describes an option called Dynamic Delivery, which delivers the message body straight away with placeholders for attachments while they are scanned, and notes it works only for Exchange Online mailboxes. Safe Attachments for files in SharePoint, OneDrive and Microsoft Teams is a separate global setting that Microsoft says doesn’t require Safe Attachments policies.

How to turn on Safe Attachments for SharePoint, OneDrive and Teams

Based on Microsoft’s instructions (checked October 2026). Menus can change; Microsoft’s Safe Attachments for SharePoint, OneDrive and Teams guide has the latest steps. Microsoft’s page applies to Defender for Office 365 Plan 1 and Plan 2.

1. In the Microsoft Defender portal, go to Email & collaboration > Policies & rules > Threat policies > Safe Attachments.
2. Select Global settings.
3. In Protect files in SharePoint, OneDrive, and Microsoft Teams, turn on Turn on Defender for Office 365 for SharePoint, OneDrive, and Microsoft Teams.
4. Select Save.

Anti-phishing and impersonation protection

Microsoft’s anti-phishing documentation draws a line between two kinds of attack:

• Spoofing is “an attacker forging the sender’s email address or domain to make it look like a trusted source”. Microsoft states that protection for all cloud mailboxes includes basic spoofing detection through SPF, DKIM and DMARC checks. The guide to how SPF, DKIM and DMARC work in Microsoft 365 explains these records.
• Impersonation is “an attacker mimicking a trusted user, domain, or brand to trick the recipient into believing the email is genuine”. Microsoft notes that impersonation can pass SPF, DKIM and DMARC if the attacker registers a lookalike domain with valid records.

According to Microsoft, Defender for Office 365 adds user impersonation protection, domain impersonation protection, mailbox intelligence (which “uses artificial intelligence (AI) to determine user email patterns with their frequent contacts”) and adjustable phishing thresholds. Microsoft notes that the default anti-phishing policy in Defender for Office 365 provides spoof protection and mailbox intelligence for all recipients, but the other impersonation protection features and phishing thresholds “aren’t configured in the default policy”; they are turned on by changing that policy, creating other anti-phishing policies or using a preset policy.

Preset security policies

Microsoft describes preset security policies as a way to apply its recommended settings without configuring each policy by hand. It states that “virtually all of the settings in preset security policies aren’t configurable”.

• Standard is described as “a baseline profile that’s suitable for most users”.
• Strict is described as “a more aggressive profile for selected users (high value targets or priority users)”.
• Built-in protection “Gives basic Safe Attachments and Safe Links protection in Defender for Office 365” to users not covered by Standard, Strict or custom Safe Links and Safe Attachments policies.

Microsoft states that “Until you turn on the profiles and assign users to them, the Standard and Strict preset security policies are assigned to no one.” Its documentation also sets out the order in which presets, custom policies and defaults apply when someone is covered by more than one.

How to turn on a Standard or Strict preset policy

Based on Microsoft’s instructions (checked October 2026). Menus can change; Microsoft’s preset security policies guide has the latest steps and the full wizard.

1. In the Microsoft Defender portal, go to Email & collaboration > Policies & rules > Threat policies > Preset Security Policies (in the Templated policies section).
2. Turn the toggle for Standard protection or Strict protection to On, then select Manage protection settings to start the wizard.
3. Work through the wizard pages to choose which recipients the policy applies to (and any exceptions), and the impersonation protection entries.
4. On Review and confirm your changes, check the settings and select Confirm, then select Done.

Quarantine

Microsoft states that “in all organizations with cloud mailboxes, quarantine is available to hold potentially dangerous or unwanted messages”, and that “you can’t completely turn off quarantine in Microsoft 365”. Malware and high-confidence phishing messages are always quarantined. Microsoft’s admin quarantine page gives the location as Email & collaboration > Review > Quarantine in the Microsoft Defender portal, and says taking action on other people’s quarantined messages needs a role such as Quarantine Administrator or Security Administrator.

Quarantine policies decide what recipients can do with their own quarantined messages. Microsoft states that recipients can’t release messages quarantined as malware, as malware or phishing by Safe Attachments, or as high-confidence phishing. At most, they can request release. Microsoft also states that “When messages expire from quarantine after the retention period, the messages are permanently deleted and can’t be recovered.” Its page lists default retention periods of 15 or 30 days depending on the policy that quarantined the message.

Things that change

Microsoft has been renaming parts of this product family. Its built-in protection and preset policy pages no longer use the Exchange Online Protection name in their text, and the features in each plan are updated over time. Microsoft’s Defender for Office 365 overview is the place to check what is current.

Common questions

What is the difference between Defender for Office 365 Plan 1 and Plan 2?

Plan 2 includes everything in Plan 1 and adds tools for investigating and responding to attacks. Microsoft lists Plan 1 additions including Safe Links, Safe Attachments, user and domain impersonation protection and real-time detections. It says Plan 2 “adds phishing simulations, post-breach investigation, hunting, and response, and automation”, including attack simulation training, Threat Explorer and automated investigation and response. Defender for Office 365 Plan 1 and Plan 2 has the comparison table.

Does Microsoft 365 Business Premium include Defender for Office 365?

Microsoft’s Defender for Office 365 overview lists Microsoft 365 Business Premium, along with Microsoft 365 E3/G3, as examples of subscriptions that include Plan 1, as checked in October 2026. It lists Microsoft 365 A5/E5/G5 as examples that include Plan 2, and says Defender for Office 365 is also available as an add-on. In the Microsoft 365 admin center, Billing > Your products lists a tenant’s subscriptions. The licensing and security features reference compares plans.

What is Exchange Online Protection (EOP)?

EOP is the older name for the built-in email filtering that Microsoft says is “included in all organizations with cloud mailboxes”. Microsoft’s current page calls it “Built-in security features for all cloud mailboxes”. It includes anti-malware, anti-spam, spoofing protection, quarantine and zero-hour auto purge for email, and Microsoft describes it as preventing “broad, volume-based, known email attacks”. Built-in protection (EOP) explains where the old name still appears.

What is the difference between Safe Links and Safe Attachments?

Safe Links checks links and Safe Attachments checks attachments. Microsoft describes Safe Links as scanning and rewriting links in inbound email and verifying URLs at the time of click in email, Teams and supported Office apps. Safe Attachments “uses a virtual environment to check attachments” before they’re delivered, a process Microsoft calls detonation. Both are part of Defender for Office 365. Safe Links and Safe Attachments cover each in more detail.

Should I use the Standard or Strict preset security policy?

Microsoft describes Standard as “a baseline profile that’s suitable for most users” and Strict as “a more aggressive profile for selected users (high value targets or priority users)”. Microsoft also states that Standard and Strict are assigned to no one until they’re turned on and users are assigned. This page doesn’t say which suits a particular organisation. How to turn on a Standard or Strict preset policy has Microsoft’s steps.

What happens to emails in quarantine in Microsoft 365?

Microsoft says quarantine holds potentially dangerous or unwanted messages and can’t be completely turned off. Admins review it in the Microsoft Defender portal under Email & collaboration > Review > Quarantine. Recipients can’t release messages quarantined as malware or high-confidence phishing, only request release, and Microsoft says expired messages “are permanently deleted and can’t be recovered”. Quarantine lists the default retention periods.

Related guides

• SPF, DKIM and DMARC explained
• Business email compromise explained
• Microsoft 365 security baseline