Deep Dive into Microsoft Defender for Office 365: Plan 1 vs. Plan 2 - Licensing, Features, Comparison, and Step-by-Step Policy Configuration

Meta Description: Learn about Microsoft Defender for Office 365 Plan 1 and Plan 2, including licensing, features, comparisons, and step-by-step policy configurations for enhancing email security in enterprise environments.

Introduction

As a Senior Cloud Architect, one of the critical components of a secure cloud infrastructure is ensuring robust email security. Microsoft Defender for Office 365 is a cloud-based email filtering service that helps protect organizations against unknown malware and viruses by providing robust zero-day protection and includes features to safeguard against phishing links and malicious URLs. This blog post will delve into two of its main plans—Microsoft Defender for Office 365 Plan 1 and Plan 2—comparing their licensing, features, and providing a step-by-step walkthrough on configuring various policies available within each plan.

Why Email Security is Crucial for Your Business

Email remains one of the most common vectors for cyber attacks such as phishing, malware, and ransomware. Microsoft Defender for Office 365 provides an added layer of security specifically designed to protect your email communications. By understanding the features and capabilities of Plan 1 and Plan 2, you can make an informed decision about which plan best suits your organization’s needs.

Overview of Microsoft Defender for Office 365

Microsoft Defender for Office 365 is part of the broader Microsoft 365 suite designed to protect your email, collaboration tools, and productivity software. It offers two main plans: Plan 1 and Plan 2.

Key Features of Microsoft Defender for Office 365 Plan 1

Safe Links: Provides time-of-click verification for URLs in emails and Office documents, protecting against malicious links.
Safe Attachments: Scans email attachments for malware in a sandbox environment before they reach the user’s inbox.
Anti-Phishing: Protects against phishing attacks through impersonation protection features such as spoof intelligence and impersonation detection.
Reporting and Threat Explorer: Basic reporting tools are available, although Plan 1 does not include the full Threat Explorer functionality available in Plan 2.

Key Features of Microsoft Defender for Office 365 Plan 2

Plan 2 includes all the features of Plan 1, plus:

Threat Trackers: Provides insights into the latest cyber threats and trends.
Threat Explorer: An interactive tool that allows security admins to analyze threats and take action.
Automated Investigation and Response (AIR): Uses machine learning to automatically investigate and respond to threats.
Attack Simulator: Enables you to run simulated phishing attacks to test your organization’s security posture and train your users.
Advanced Threat Protection for SharePoint, OneDrive, and Teams: Provides additional protection for files stored in SharePoint, OneDrive, and Teams.

Licensing Comparison

Licensing for Microsoft Defender for Office 365 can be a bit complex. Plan 1 is typically included in Microsoft 365 E5, Office 365 E5, and Microsoft 365 Business Premium licenses. Plan 2 is included in Microsoft 365 E5 Security, which is a part of the Microsoft 365 E5 suite.

Plan 1: Priced at $2.00 user/month (as of the last update; always check the latest pricing).
Plan 2: Priced at $5.00 user/month (as of the last update; always check the latest pricing).

Plan 2 is typically more expensive because it includes advanced features such as Threat Trackers, Threat Explorer, Automated Investigation and Response (AIR), and the Attack Simulator tool.

Detailed Feature Comparison

Safe Links

Both Plan 1 and Plan 2 include Safe Links, which checks URLs at the time a user clicks on them to ensure that they are not malicious. However, Plan 2 offers more granular control and additional reporting capabilities.

Safe Attachments

Both Plan 1 and Plan 2 include Safe Attachments, which scans email attachments for malware and viruses in a sandbox environment. Plan 2 offers more advanced settings and deeper integration within the Threat Explorer for tracking and investigating malicious attachments.

Anti-Phishing

Both Plan 1 and Plan 2 offer anti-phishing capabilities such as spoof intelligence and impersonation detection. However, Plan 2 provides more advanced anti-phishing policies and capabilities through Attack Simulator.

Reporting and Threat Explorer

Plan 1 provides basic reporting tools such as the Security Dashboard, which provides a high-level view of your organization’s security status. Plan 2 includes the full Threat Explorer, which offers a real-time report that allows you to identify and analyze threats.

Automated Investigation and Response (AIR)

This feature is exclusive to Plan 2. AIR uses machine learning and playbooks to automatically investigate and remediate threats.

Attack Simulator

This feature is exclusive to Plan 2. It allows you to run simulated phishing attacks to test your organization’s security and train your users.

Step-by-Step Policy Configuration for Plan 1

1. Enabling Safe Links

Navigate to the Microsoft 365 Defender portal: Go to https://security.microsoft.com.
Go to Policies & Rules: From the left-hand menu, select “Policies & Rules” and then “Threat policies.”
Select Safe Links: Under “Policies,” click on “Safe Links.”
Create a New Policy: Click on “Create” to make a new Safe Links policy. Name your policy and define the settings such as whether to apply Safe Links to emails sent within the organization and whether to track user clicks.
Define URL Patterns: Set up any custom URLs that should be excluded from Safe Links scanning.
Apply to Users and Groups: Specify which users, groups, or domains the policy should apply to.
Review and Save: Review your settings and save the policy.

2. Enabling Safe Attachments

Navigate to the Microsoft 365 Defender portal: Go to https://security.microsoft.com.
Go to Policies & Rules: From the left-hand menu, select “Policies & Rules” and then “Threat policies.”
Select Safe Attachments: Under “Policies,” click on “Safe Attachments.”
Create a New Policy: Click on “Create” to make a new Safe Attachments policy. Name your policy and define the action for detected malware (such as block, replace, or monitor).
Define Redirect Options: Choose whether to redirect detected malware attachments for further analysis.
Apply to Users and Groups: Specify which users, groups, or domains the policy should apply to.
Review and Save: Review your settings and save the policy.

3. Configuring Anti-Phishing Policies

Navigate to the Microsoft 365 Defender portal: Go to https://security.microsoft.com.
Go to Policies & Rules: From the left-hand menu, select “Policies & Rules” and then “Threat policies.”
Select Anti-Phishing: Under “Policies,” click on “Anti-phishing.”
Create a New Policy: Click on “Create” to make a new anti-phishing policy. Name your policy and enable settings such as impersonation protection for specific domains or users.
Configure Action for Impersonation: Define what action should be taken if impersonation is detected (e.g., quarantine the message, move it to the Junk Email folder).
Apply to Users and Groups: Specify which users, groups, or domains the policy should apply to.
Review and Save: Review your settings and save the policy.

Step-by-Step Policy Configuration for Plan 2

1. Using Threat Explorer

Navigate to the Microsoft 365 Defender portal: Go to https://security.microsoft.com.
Go to Email & Collaboration: From the left-hand menu, select “Email & collaboration” and then “Explorer” (formerly known as Threat Explorer).
Filter and Search: Use the filters to search for specific threats based on various criteria such as email sender, recipient, subject line, or malware type.
Take Action: From the search results, you can take actions such as deleting emails, blocking senders, or investigating further.

2. Automated Investigation and Response (AIR)

Navigate to the Microsoft 365 Defender portal: Go to https://security.microsoft.com.
Go to Incidents: From the left-hand menu, select “Incidents.”
Select an Incident: Click on an incident to view details and see if an automated investigation has been triggered.
Review Automated Actions: Review the actions taken by AIR and approve any pending actions if necessary.

3. Attack Simulator

Navigate to the Microsoft 365 Defender portal: Go to https://security.microsoft.com.
Go to Email & Collaboration: From the left-hand menu, select “Email & collaboration” and then “Attack Simulator.”
Create a New Phishing Campaign: Click on “Launch a simulation” and select the type of phishing campaign you want to run (e.g., credential harvest, malware attachment).
Define Campaign Details: Customize your phishing campaign by specifying the target users, email template, and payload (if applicable).
Launch Simulation: Launch the simulation and monitor the results through the Attack Simulator dashboard.
Review Results and Provide Training: After the simulation, review the results and provide additional training to users who failed the test.

Best Practices for Microsoft Defender for Office 365

Regularly Review Policies: Keep your Safe Links, Safe Attachments, and Anti-Phishing policies up to date with the latest threat intelligence and organizational changes.
Continuous User Training: Use Attack Simulator (Plan 2) to regularly train your users on recognizing phishing attempts and other email threats.
Leverage Automated Investigation and Response: For Plan 2 users, make sure to review and approve actions taken by AIR to ensure that threats are mitigated promptly.
Monitor Threat Explorer: Regularly check Threat Explorer for any new threats and take necessary actions.
Combine with Other Security Products: Integrate Microsoft Defender for Office 365 with other security products such as Microsoft Defender for Endpoint for a holistic security posture.

Conclusion

Microsoft Defender for Office 365 offers robust features for protecting your organization from email threats such as phishing, malware, and malicious links. Plan 1 provides essential features such as Safe Links, Safe Attachments, and Anti-Phishing, which are suitable for many businesses. Plan 2, however, extends these capabilities with advanced features such as Threat Explorer, Automated Investigation and Response, and Attack Simulator, making it ideal for organizations that need a higher level of security and incident response automation. By understanding the differences between Plan 1 and Plan 2 and following the step-by-step configurations provided, you can make an informed decision and implement a robust email security strategy for your organization.

For more in-depth information, always refer to the official Microsoft Defender for Office 365 documentation on Microsoft Docs.

As a Senior Cloud Architect, it is crucial to stay up to date with the latest security features and best practices to protect your organization’s email infrastructure effectively. Whether you opt for Plan 1 or Plan 2, Microsoft Defender for Office 365 is a powerful tool that should be a part of your security arsenal.

Feel free to leave a comment if you have any questions or need further assistance in configuring Microsoft Defender for Office 365 for your organization. Stay secure! 🔒

Search In This Blog

KT Articles For All