Microsoft Defender for Office 365: What It Protects and What It Doesn’t

Microsoft 365 security can feel a bit like buying a decent alarm system.

It helps. A lot.

But only if it’s switched on properly, configured well, and checked when something doesn’t look right.

That’s a useful way to think about Microsoft Defender for Office 365.

It gives organisations stronger protection against email and collaboration threats, including phishing, malicious links, unsafe attachments, impersonation attempts, and suspicious activity across Microsoft 365. But it doesn’t remove the need for good administration, user training, device control, or wider Microsoft 365 governance.

This article explains what Microsoft Defender for Office 365 protects, where its limits are, and why it works best as part of a properly managed Microsoft 365 environment.

Microsoft Defender for Office 365

Quick summary

Microsoft Defender for Office 365 helps protect against:

  • phishing and impersonation attempts
  • malicious links
  • unsafe attachments
  • email-based malware
  • suspicious mailbox activity
  • threats in Teams, SharePoint, and OneDrive
  • post-delivery threats that appear after an email has already arrived

But it doesn’t fix every security problem.

You still need good identity controls, clean offboarding, device management, user awareness, and day-to-day support.

What is Microsoft Defender for Office 365?

Microsoft Defender for Office 365 is Microsoft’s email and collaboration security solution for Microsoft 365.

It sits above the built-in security features that come with cloud mailboxes and gives organisations stronger protection, detection, investigation, and response capabilities.

Microsoft describes Defender for Office 365 as the primary email and collaboration security solution for Microsoft 365. It includes capabilities such as Safe Links, Safe Attachments, anti-phishing protection, impersonation protection, alerts, investigations, and response features depending on the plan used.

In plain English, it helps stop dangerous messages, links, and files from becoming bigger business problems.

Is Microsoft Defender for Office 365 the same as Microsoft 365 Defender?

Not quite.

This is where the naming gets a bit messy.

Microsoft Defender for Office 365 focuses on email and collaboration threats. That means things like Outlook, Exchange Online, Teams, SharePoint, and OneDrive.

Microsoft Defender XDR, previously referred to as Microsoft 365 Defender, brings signals together across different security products so teams can detect, investigate, and respond to incidents across identities, endpoints, email, apps, and data.

So, if Defender for Office 365 is one important layer, Defender XDR is the broader security picture.

For most small and growing organisations, the important thing isn’t memorising the naming. It’s understanding which risks are being covered and which ones still need attention.

What does Microsoft Defender for Office 365 protect?

Defender for Office 365 is designed to protect against the threats that usually arrive through email and collaboration tools.

That matters because attackers often start where people are busiest: the inbox.

1. Phishing emails

Phishing is still one of the most common ways attackers get into Microsoft 365 environments.

A message looks believable. Someone clicks. Credentials are entered. The attacker now has a route into the organisation.

Defender for Office 365 helps detect and block phishing attempts, including more targeted attacks where someone is trying to impersonate a person, brand, domain, or trusted contact.

This is especially important for finance teams, leadership, HR, and anyone regularly dealing with payments, personal data, or external suppliers.

2. Malicious links

A dangerous link isn’t always dangerous when the email first arrives.

Sometimes attackers change the destination later.

That’s why Safe Links matter. They help check links at the point of click, not just when the email is delivered.

This gives organisations better protection against links that appear harmless at first but later redirect users to credential-harvesting pages, malware, or fake login screens.

3. Unsafe attachments

Attachments are still a common delivery route for malware.

Safe Attachments helps by scanning files before users open them. In many cases, suspicious files can be held back, detonated, or checked in a safer environment before they reach the user.

That doesn’t mean people can stop thinking.

But it does reduce the chance of one rushed click turning into a wider incident.

4. Business email compromise

Business email compromise is one of the nastier risks because it often doesn’t look technical.

It might be a fake invoice request.

A supplier bank detail change.

A message pretending to come from a director.

Defender for Office 365 can help detect impersonation and suspicious patter

ns, but business email compromise is rarely solved by technology alone. Finance processes, approvals, user awareness, and good internal controls still matter.

5. Threats in Teams, SharePoint, and OneDrive

Email isn’t the only place people collaborate anymore.

Files move through Teams. Documents sit in SharePoint. People share links from OneDrive. Attackers know this.

Defender for Office 365 includes protection that can extend into collaboration areas such as Teams, SharePoint, and OneDrive depending on licensing and configuration.

That matters because a malicious file doesn’t become safe just because it wasn’t sent as an email attachment.

6. Post-delivery threats

Sometimes a message gets delivered and only later becomes known as malicious.

That’s where post-delivery protection becomes useful.

Microsoft Defender for Office 365 includes capabilities such as Zero-hour auto purge, often shortened to ZAP, which can help remove harmful messages after delivery when Microsoft later identifies them as malicious.

That matters because security isn’t a single moment at delivery. It’s ongoing.

What Defender for Office 365 doesn’t protect by itself

This is the bit that gets missed.

Defender for Office 365 is important, but it doesn’t make Microsoft 365 automatically secure.

It won’t solve every problem around users, devices, permissions, data, and admin habits.

It doesn’t fix weak identity controls

If MFA is inconsistent, admin accounts are over-permissioned, or shared accounts still exist, your environment is still exposed.

Defender can reduce email and collaboration threats, but identity security still needs proper attention.

If you’re already reviewing that area, Microsoft Secure Score can help highlight wider improvement areas across the tenant.

It doesn’t replace user training

Good protection reduces risk.

It doesn’t remove human judgement.

People still need to know what suspicious messages look like, how to report them, and why certain requests should be challenged.

This is especially true for payment changes, password reset requests, urgent messages, and anything that asks someone to bypass a normal process.

It doesn’t clean up poor offboarding

A former employee with lingering access is still a risk.

So is a mailbox that nobody owns.

So is a device with saved sessions.

Defender for Office 365 isn’t a substitute for a clean leaver process. If access removal is inconsistent, it’s worth tightening your Microsoft 365 offboarding process as part of the same security review.

It doesn’t manage devices

A compromised or unmanaged device can still create exposure.

That’s where Intune and device compliance policies come in.

Defender for Office 365 helps with email and collaboration threats, but device control still needs its own layer.

It doesn’t decide your governance model

Defender can surface problems.

It can help block, detect, investigate, and respond.

But it won’t decide who should own mailboxes, how long data should be retained, which users need privileged access, or how security policies should be managed.

Some security issues don’t start in the inbox. They start with weak ownership, inconsistent access, and poor governance across Microsoft 365.

Defender for Office 365 Plan 1 vs Plan 2

Microsoft Defender for Office 365 is available in different plans.

The exact features depend on licensing, but a simple way to think about it is this:

Defender for Office 365 Plan 1

Plan 1 focuses more on prevention and detection.

This can include protection such as:

  • Safe Links
  • Safe Attachments
  • anti-phishing policies
  • impersonation protection
  • real-time detections
  • user-reported messages
  • alerts and reporting

For many organisations, this is the practical protection layer that helps reduce everyday email and collaboration risk.

Defender for Office 365 Plan 2

Plan 2 adds more investigation, response, and automation.

This can include:

  • Threat Explorer
  • attack simulation training
  • advanced hunting
  • automated investigation and response
  • campaign views
  • deeper investigation tools

Plan 2 tends to matter more when the organisation needs stronger security operations capability or has people actively reviewing, investigating, and responding to threats.

When does Defender for Office 365 become worth it?

Defender for Office 365 becomes more important when email risk is no longer theoretical.

That usually happens when:

  • phishing attempts are increasing
  • staff deal with sensitive or financial information
  • users regularly receive external attachments
  • Teams and SharePoint are heavily used
  • leadership accounts are targeted
  • your team needs better visibility of threats
  • security incidents are taking too long to investigate
  • you want more control than built-in email protection gives you

The tipping point is often simple.

If one compromised account would cause a serious problem, stronger protection is worth reviewing.

A practical checklist for Microsoft 365 admins

If you’re reviewing Defender for Office 365, start with these questions.

1. Do we know which plan we have?

Licensing matters.

Some organisations assume they have certain protections because they use Microsoft 365, only to find that the features they need depend on the plan.

Start by checking what’s actually included.

2. Are Safe Links and Safe Attachments configured properly?

Having the feature available isn’t the same as using it well.

Check whether policies are applied to the right users, whether priority accounts are covered, and whether exceptions have crept in.

3. Are phishing and impersonation policies set up?

This is especially important for senior leaders, finance users, HR, and anyone commonly impersonated.

Attackers often target the people whose names carry authority.

4. Do users know how to report suspicious messages?

Reporting needs to be simple.

If people don’t know what to do, suspicious messages either get ignored or forwarded informally, which makes investigation harder.

5. Are alerts actually being reviewed?

Alerts only help if someone sees them, understands them, and acts.

This is one of the common support gaps. The tool is there, but nobody owns the ongoing review.

6. Is this connected to wider Microsoft 365 security?

Defender for Office 365 should not sit in isolation.

It should connect with:

  • Secure Score
  • Intune
  • Purview
  • offboarding
  • identity controls
  • user training
  • Cyber Essentials

That’s where security becomes joined up rather than reactive.

Common mistakes with Defender for Office 365

Assuming Microsoft has already configured everything

Microsoft provides strong tools, but every tenant still needs review.

Default settings may not match your risk profile, licensing, users, or business processes.

Ignoring priority accounts

Some accounts need extra attention.

Directors, finance teams, HR, IT admins, and senior managers are often more attractive targets.

They should not always be treated the same as every other mailbox.

Not reviewing false positives and false negatives

Sometimes legitimate email is blocked.

Sometimes dangerous email gets through.

Admin submissions, user reports, allow/block entries, and policy tuning all matter if you want the system to improve over time.

Treating email security as separate from everything else

Email security is tied to identity, devices, permissions, data, and user behaviour.

If those areas are weak, attackers still have room to move.

How Defender for Office 365 fits with your wider Microsoft 365 security stack

It’s useful to think of Microsoft 365 security in layers.

  • Email security helps reduce inbox-based threats
  • Defender for Office 365 improves protection, detection, and response around email and collaboration
  • Secure Score helps show where the wider tenant needs improvement
  • Intune helps control device access
  • Purview helps protect and govern data
  • Offboarding helps close access when people leave

None of these works best alone.

Together, they create a more controlled Microsoft 365 environment.

Need help configuring Microsoft Defender for Office 365?

If Defender for Office 365 is switched on but nobody is quite sure whether it’s configured properly, that’s a support problem waiting to happen.

Our Microsoft 365 Support service helps organisations improve day-to-day control across Microsoft 365 security, users, devices, permissions, email protection, and administration.

If you’re also reviewing baseline controls more broadly, Cyber Essentials is a sensible place to start.

And if your internal team needs more confidence managing Microsoft 365 security, identity, compliance, and tenant administration, Microsoft 365 Administrator training can help close those gaps.

Frequently Asked Questions

What is Microsoft Defender for Office 365?

Microsoft Defender for Office 365 is Microsoft’s email and collaboration security solution for Microsoft 365. It helps protect against threats such as phishing, malicious links, unsafe attachments, impersonation, and suspicious activity.

Is Microsoft Defender for Office 365 included with Microsoft 365?

It depends on your Microsoft 365 licence. Some plans include Defender for Office 365 Plan 1 or Plan 2, while others may require it as an add-on.

What is the difference between Defender for Office 365 and Microsoft Defender XDR?

Defender for Office 365 focuses on email and collaboration threats. Microsoft Defender XDR brings security signals together across identities, endpoints, email, apps, and data to support wider detection, investigation, and response.

Does Defender for Office 365 stop all phishing emails?

No security tool stops everything. Defender for Office 365 reduces risk significantly, but users still need training, reporting routes, and good internal processes.

Does Defender for Office 365 protect Teams and SharePoint?

Some Defender for Office 365 capabilities extend into Teams, SharePoint, and OneDrive depending on licensing and configuration.

Do we still need Cyber Essentials if we use Defender for Office 365?

Yes. Defender for Office 365 helps with email and collaboration threats, while Cyber Essentials looks at broader baseline security controls. They solve different parts of the problem.