About Microsoft
Microsoft Defender for Office 365 is a Gartner Magic Quadrant Leader (December 2025) providing native email security for Microsoft 365 environments. Plan 1 offers Safe Links, Safe Attachments, and real-time threat detection. Plan 2 adds AIR (Automated Investigation and Response), Threat Explorer, Attack Simulation Training, and 30-day advanced hunting with KQL. Zero-Hour Auto Purge (ZAP) extended to Teams in January 2026. Integrates with Microsoft Defender XDR for cross-domain protection. E3/E5 plans receive Plan 1/2 respectively starting July 2026. Best for organizations standardized on Microsoft 365 seeking native integration.
Why Notable
Microsoft Entra ID (Azure AD); enterprise IAM leader
Email Security: Evaluation & Deployment
| Gartner MQ Position (Dec 2025) |
Leader |
| Gartner Peer Insights Score |
4.3 |
| Deployment Model |
Native/Cloud |
| Pre-Delivery Blocking |
Yes |
| MX Record Required |
No (native) |
| Deployment Speed |
Minutes (native to M365) |
| Supported Platforms |
Microsoft 365, Exchange Online, SharePoint, OneDrive, Teams |
| Data Residency Regions |
Global Microsoft data centers |
| Admin Console |
Microsoft 365 Defender Portal |
| Licensing Model |
Per-user included with M365 or standalone |
| Licensing Notes |
Plan 1: /user/month standalone or included in Business Premium/E3. Plan 2: /user/month standalone or included in E5 |
| Primary Market |
All segments (SMB to Enterprise) |
| MSP Support |
Yes - CSP and Partner programs |
| FedRAMP Status |
FedRAMP High |
Feature Coverage
2026 Updates
| E3 includes Plan 1 (July 2026) |
full |
Plan 1 included in E3 subscriptions |
| E5 includes Plan 2 |
full |
Plan 2 included in E5 subscriptions |
| Business Basic URL filtering |
full |
Basic URL protection for lower tiers |
| July 2026 pricing changes |
full |
Global commercial pricing adjustments |
Collaboration Protection
| Teams protection |
full |
Message and file security for Teams |
| SharePoint protection |
full |
Document library security |
| OneDrive protection |
full |
Personal storage security |
| Outlook protection |
full |
Email client integration |
Partner Integrations
| Darktrace integration |
full |
Third-party ICES vendor integration |
| KnowBe4 integration |
full |
Third-party ICES vendor integration |
| Cisco integration |
full |
Third-party ICES vendor integration |
| VIPRE integration |
full |
Third-party ICES vendor integration |
Plan 1 Features
| Anti-phishing protection |
full |
AI-powered phishing detection |
| Anti-malware protection |
full |
Multi-engine malware scanning |
| Anti-spam filtering |
full |
Advanced spam detection and filtering |
| Real-time detections |
full |
7-day threat visibility dashboard |
| Quarantine management |
full |
Admin quarantine review and release |
| User reported messages |
full |
PhishAlert button for user reporting |
Plan 2 Features
| Automated Investigation and Response (AIR) |
full |
Machine-speed threat investigation and remediation |
| Threat Explorer |
full |
Real-time threat hunting and analysis interface |
| 30-day advanced hunting |
full |
Extended threat data retention for hunting |
| KQL query support |
full |
Kusto Query Language for threat correlation |
| Attack Simulation Training |
full |
Phishing simulations with targeted training |
| Campaign views |
full |
Attack campaign tracking and correlation |
| Threat Trackers |
full |
Proactive threat monitoring dashboards |
Safe Attachments
| Attachment sandboxing |
full |
Virtual environment detonation of suspicious attachments |
| Dynamic Delivery |
full |
Delivers email body while attachments are scanned |
| Safe Attachments for SharePoint |
full |
File scanning in SharePoint document libraries |
| Safe Attachments for OneDrive |
full |
File protection in OneDrive storage |
| Safe Attachments for Teams |
full |
File scanning in Teams file sharing |
| 15-minute typical scan time |
full |
Fast attachment analysis with detonation |
Safe Links
| URL scanning at click-time |
full |
Real-time URL analysis when users click links |
| URL rewriting |
full |
Rewrites URLs to route through Microsoft protection |
| Time-of-click verification |
full |
Re-checks URLs at time of click for delayed attacks |
| Safe Links for Office apps |
full |
URL protection in Word, Excel, PowerPoint documents |
| Safe Links for Teams |
full |
URL scanning in Teams messages and channels |
| Detonation chambers |
full |
Virtual environment URL analysis |
XDR Integration
| Microsoft Defender XDR |
full |
Cross-domain detection and response |
| Identity correlation |
full |
Integration with Entra ID protection |
| Endpoint correlation |
full |
Integration with Defender for Endpoint |
| Cloud Apps correlation |
full |
Integration with Defender for Cloud Apps |
| Unified security portal |
full |
Single pane of glass for all Defender products |
Zero-Hour Auto Purge
| ZAP for email |
full |
Post-delivery removal of malicious emails |
| ZAP for Teams (Jan 2026) |
full |
Auto-purge of malicious Teams messages |
| ZAP for phishing |
full |
Automatic removal of phishing emails |
| ZAP for malware |
full |
Automatic removal of malware attachments |
| 70.8% post-delivery removal rate |
full |
Industry-leading post-delivery protection |
Related Endpoint Security Vendors
