What's included
Curated capability groupings first, then every remaining service plan Microsoft provisions with this SKU — together they're the complete list, nothing is hidden.
| Security |
|---|
| Defender for Identity Monitors on-premises Active Directory signals to detect compromised identities and malicious insider actions. Monitors on-premises Active Directory signals (via a lightweight sensor on domain controllers) to detect compromised identities and lateral-movement/privilege-escalation attacks. |
| Other service plans |
| Exchange Foundation The baseline Exchange Online mailbox service included in most Microsoft 365 plans — hosted email, calendar, and contacts. |
| SecOps Investigation for MDI |
Defender for Identity