Defender for Office 365 P1 plus threat hunting, automated investigation and response, and attack simulation training.
Included products
Derived from the service plans Microsoft provisions with this SKU — Microsoft publishes no product-in-bundle mapping.
Included in
Derived from the service plans Microsoft provisions with each SKU — Microsoft publishes no product-in-bundle mapping.
Commercial
- Microsoft 365 E5 +10 variants
- Microsoft 365 E5 Developer (without Windows and Audio Conferencing)
- Microsoft 365 E5 Security
- Microsoft 365 E5 Security for EMS E5
- Microsoft 365 E7
- Microsoft 365 F5 Security + Compliance Add-on
- Microsoft 365 F5 Security Add-on
- Microsoft 365 Security and Compliance for Firstline Workers
- Office 365 E5 +3 variants
GCC
- Microsoft 365 GCC G5
- Microsoft 365 GCC G5 w/o WDATP/CAS Unified
- Microsoft Defender for Office 365 (Plan 2) GCC
- Office 365 G5 GCC
- Office 365 GCC G5 without Audio Conferencing
- Office 365 GCC G5 without Power BI and Phone System
Education
What's included
Curated capability groupings first, then every remaining service plan Microsoft provisions with this SKU — together they're the complete list, nothing is hidden.
| Security |
|---|
| Defender for Office 365 Plan 2 Protects email and collaboration content from phishing, malware, and malicious links via Safe Links and Safe Attachments. Protects mail and collaboration content from phishing and malware: Safe Links, Safe Attachments, and anti-phishing at Plan 1; adds automated investigation/response, attack simulation, and threat hunting at Plan 2. |
| Other service plans |
| Microsoft 365 Defender A unified cross-product incident view and automated investigation/response across the Microsoft Defender security products. |
Defender for Office 365