Protection for email and collaboration tools (Teams, SharePoint, OneDrive) against phishing, malware, and business email compromise. It includes Safe Links (checks URLs at click time) and Safe Attachments (analyzes attachments in an isolated environment).
In SC-900 you are asked the difference between plans: Plan 1 brings the protections; Plan 2 adds investigation and response, such as Threat Explorer, automated investigation and response (AIR), and attack simulation training.
Microsoft Defender for Office 365 is a concept that can show up on the exam. Check the full guide to see it in context.