What is Microsoft Defender for Office 365 Plan 1 / Plan 2? Understanding E3/E5 Email Protection
About this article
This article was created using an automated generation workflow leveraging generative AI. Microsoft's official information was re-verified on September 18, 2026, incorporating the E3 changes starting from July 2026.Verification Status: 📘 Microsoft Official Information Verified / Live Environment Not Tested
Microsoft Defender for Office 365 (MDO) is a service that protects email and collaboration tools like Teams from phishing, malicious URLs, and attachments.Safe Linksis a protection that scans link destinations,Safe Attachmentsis a protection that scans attachments.
E3 Changes in July 2026
According to the Microsoft official service description,starting July 1, 2026, Defender for Office 365 Plan 1 will be included in Office 365 E3 and Microsoft 365 E3. Microsoft 365 E5 includes Plan 2. The old notion that "MDO is only available in E5" no longer applies to the current E3.
| Tier | Key Role |
|---|---|
| Basic Protection | Foundational defense such as Exchange Online Protection |
| Plan 1 | Safe Links, Safe Attachments, anti-phishing, real-time detections, etc. |
| Plan 2 | P1 + advanced investigation and response such as Threat Explorer, Attack Simulation Training, and AIR |
flowchart LR MSG[メール/リンク/添付] --> EOP[基本保護] EOP --> P1[P1: 予防・検知] P1 --> P2[P2: 調査・自動対応・訓練] P2 --> XDR[Defender XDR]
First Step: View Detection Status Without Making Changes
Open the screens available under your current license in the Defender portal, such as Explorer or Real-time detections, and check phishing/malware/spam, target users, detection times, and determination reasons. Do not perform deletion or remediation during this initial check.
Success criteriais to read the detection status for the target period and be able to explain whether you are looking at P1 or P2 features. If you change one thing, change only the time filter to the last 24 hours.
Perspectives of General Users, Administrative Staff, and IT Departments
General users learn how to report suspicious emails. Administrative staff establish procedures to identify phishing attempts that mimic daily tasks, such as invoices and sharing notifications. IT departments design Preset security policies, Safe Links/Attachments, exceptions, user reporting, and SOC investigations as a single workflow.
Adding P1 to E3 Does Not Automatically Complete the Design
Even if licenses are added, you still need to verify policies, scope, exceptions, coexistence with third-party gateways, and reporting flows. In P2, it is crucial to determine who will use AIR (Automated Investigation and Response) and to what extent automated actions are permitted.
Checklist for Administrators
Whether the E3 = P1 change starting July 1, 2026 is reflected
Whether the differences with E5 = P2 have been verified in the latest service description
Scope of Safe Links / Safe Attachments
Preset security policies and custom policies
Permissions and approvals for AIR/remediation
Double processing with third-party email security
For Teams SKU differences, verify the Teams usage rights and MDO protection scope separately
Microsoft Official Primary Sources
With the 2026 E3 changes, assuming "Defender for Office 365 is only for E5" is no longer safe. Review P1/P2 along with your current operations.
