MDO P1 vs P2.
Compare Defender for Office 365 Plan 1 and Plan 2 by capability, with links back to related tables, APIs, and capability records.
P2 Adds or Upgrades
Explorer and Real-time Detections
Full Explorer is included; Plan 1 has Real-time detections.
ResponseOffice 365 Automated Investigation and Response
Included for automated investigation and remediation workflows.
EducationAttack Simulation Training
Included for phishing simulation and end-user training workflows.
HuntingMDO Advanced Hunting
Included through Defender XDR hunting over email and collaboration tables.
IntegrationMicrosoft Defender XDR Integration
Included for broader Defender XDR investigation and incident integration.
MDO P1 vs P2
| Capability | MDO P1 | MDO P2 | Tables | APIs |
|---|---|---|---|---|
| Preset Security Policies Configuration | Included Included for Standard and Strict protection baselines. | Included Included. | None recorded | None recorded |
| Safe Links Protection | Included Included for email, supported Office apps, and Teams where applicable. | Included Included. | EmailUrlInfo, UrlClickEvents, MessageUrlInfo | None recorded |
| Safe Attachments Protection | Included Included for email and collaboration workloads where applicable. | Included Included. | EmailAttachmentInfo, FileMaliciousContentInfo | None recorded |
| Threat Submissions Investigation | Included Included for reporting messages, URLs, and files for analysis. | Included Included. | EmailEvents, EmailUrlInfo, EmailAttachmentInfo | Microsoft Graph Security API |
| Explorer and Real-time Detections Investigation | Limited Plan 1 has Real-time detections rather than the full Explorer experience. | Included Full Explorer is included; Plan 1 has Real-time detections. | EmailEvents, EmailUrlInfo, EmailAttachmentInfo, EmailPostDeliveryEvents, UrlClickEvents, CampaignInfo, MessageEvents, MessageUrlInfo, MessagePostDeliveryEvents | Microsoft Graph Security API |
| Office 365 Automated Investigation and Response Response | Not included Plan 2 capability. | Included Included for automated investigation and remediation workflows. | EmailPostDeliveryEvents, MessagePostDeliveryEvents, EmailEvents | Microsoft Graph Security API |
| Attack Simulation Training Education | Not included Plan 2 capability. | Included Included for phishing simulation and end-user training workflows. | None recorded | None recorded |
| MDO Advanced Hunting Hunting | Not included Plan 2 capability through Defender XDR integration. | Included Included through Defender XDR hunting over email and collaboration tables. | EmailEvents, EmailUrlInfo, EmailAttachmentInfo, EmailPostDeliveryEvents, UrlClickEvents, CampaignInfo, FileMaliciousContentInfo, MessageEvents, MessageUrlInfo, MessagePostDeliveryEvents | Microsoft Graph Security API, Legacy Microsoft Defender XDR APIs |
| Microsoft Defender XDR Integration Integration | Not included Plan 2 capability. | Included Included for broader Defender XDR investigation and incident integration. | EmailEvents, UrlClickEvents, MessageEvents, MessagePostDeliveryEvents | Microsoft Graph Security API, Legacy Microsoft Defender XDR APIs |