Topic 6 of 8
Defender for Office 365 and Defender for Endpoint
Email and devices are the two entry points attackers use most: a phishing email lands in the mailbox and malware runs on the laptop. These two Defender XDR products protect those doors. The exam asks what each feature does and, above all, what each plan includes.
Contents
Defender for Office 365
It protects the organization against threats that arrive through email, links (URLs), and collaboration tools like Teams, SharePoint, and OneDrive. In the Defender portal it appears under Email & collaboration.
Phishing
Emails that imitate someone trusted to steal data
Malware
Attachments with malicious code
Malicious links
URLs leading to credential theft sites
BEC
Business email compromise for fraud
Built-in protection (EOP)
Every Microsoft 365 cloud mailbox already has a free base layer: Exchange Online Protection (EOP). Defender for Office 365 adds on top of it; it doesn't replace it.
Anti-malware and anti-spam
Filters inbound malware and spam, and also outbound spam from your own compromised accounts.
Anti-phishing and anti-spoofing
Identifies messages with forged senders (spoofing) using spoof intelligence.
Connection filtering
Blocks or allows mail servers by IP address.
Quarantine
Holds suspicious messages for an admin or the user to review.
Submissions and block list
Send misclassified messages to Microsoft and manage the Tenant Allow/Block List.
Message trace and auditing
Follow an email's path and log activity.
Plan 1 and Plan 2
The rule to remember: Plan 1 = prevention (more protection layers), Plan 2 = Plan 1 + investigation, response, and training.
| Feature | EOP | Plan 1 | Plan 2 |
|---|---|---|---|
| Anti-malware, anti-spam, anti-phishing, and anti-spoofing | ✓ | ✓ | ✓ |
| Connection filtering, quarantine, message trace | ✓ | ✓ | ✓ |
| ZAP for email | ✓ | ✓ | ✓ |
| Impersonation protection | — | ✓ | ✓ |
| Safe Attachments and Safe Links | — | ✓ | ✓ |
| Real-time detections | — | ✓ | Threat Explorer |
| ZAP for Teams | — | ✓ | ✓ |
| Attack simulation training | — | — | ✓ |
| Priority account protection | — | — | ✓ |
| Threat Explorer, threat trackers, and campaigns | — | — | ✓ |
| Automated investigation and response (AIR) | — | — | ✓ |
| Advanced hunting | — | — | ✓ |
Licensing
Plan 1 comes with Microsoft 365 E3 and Business Premium (or as an add-on). Plan 2 comes with Microsoft 365 E5.
Attack simulation training
Runs simulated phishing campaigns and assigns training to whoever falls for them. It targets the human link, only in Plan 2.
Safe Attachments, Safe Links, and ZAP
Safe Attachments
Opens (detonates) attachments in an isolated virtual environment before delivering them and watches their behavior. That way it detects new malware that signatures don't know. It also protects files in SharePoint, OneDrive, and Teams.
Safe Links
Checks URLs at the time of click. An attacker can send a clean link and make it malicious hours later; Safe Links still catches it.
ZAP (zero-hour auto purge)
If an already-delivered message turns out to be malicious, it removes it from the mailbox retroactively. For email it's in EOP; for Teams, from Plan 1.
Other pieces: priority account protection (Plan 2) gives extra attention to executives and people with sensitive access, and AIR investigates alerts and proposes or runs remediation actions.
Defender for Endpoint
An enterprise platform to prevent, detect, investigate, and respond to advanced threats on devices. Endpoints include laptops, phones, tablets, PCs, access points, routers, and firewalls.
Sensors
Built into Windows 10 and 11: they collect behavioral signals from the operating system, with no separate agent to install on Windows.
Cloud analytics
Turns those signals into detections and recommendations using big data and machine learning.
Threat intelligence
Identifies attacker tools and techniques and alerts when they show up on your devices.
It supports Windows, macOS, Linux, Android, and iOS, and integrates with Intune (device compliance for Conditional Access) and Defender for Cloud (server protection).
Defender for Endpoint components
Core vulnerability management
Discovers, prioritizes, and remediates device vulnerabilities and misconfigurations.
Attack surface reduction
ASR rules (for example, block Office from creating child processes), controlled folder access against ransomware, network and web protection, device control.
Next-generation protection
Microsoft Defender Antivirus with cloud-delivered protection and machine learning to block new malware.
EDR
Endpoint detection and response: detects advanced attacks in near real time and lets you respond on the device.
Automated investigation and response
Examines alerts and remediates automatically, reducing the volume that reaches the SOC.
Secure Score for Devices
Measures device security posture and suggests improvements.
Defender Experts for Hunting
A proactive hunting service by Microsoft experts.
APIs and integration
Automate workflows and connect to other tools.
EDR and response actions
Antivirus tries to keep malware out. EDR assumes something may get through and watches behavior: a Word process launching PowerShell, a tool dumping credentials from memory. Alerts are grouped into incidents, and the analyst can act on the device:
Isolate
Cut the device off the network while keeping its connection to Defender
Collect package
Gather forensic evidence from the device
Scan
Run an antivirus scan
Restrict apps
Allow only Microsoft-signed apps
| Antivirus (next generation) | EDR | |
|---|---|---|
| Goal | Prevent: block malware on arrival | Detect and respond to what's already inside |
| Looks at | Files and signatures, with help from the cloud | Behavior and sequences of activity |
| Result | File blocked or quarantined | Alert, incident, and response actions |
Defender for Endpoint plans
Plan 1
Prevention: next-generation antivirus, attack surface reduction, manual response actions, and centralized management.
Plan 2
Everything in Plan 1 plus EDR, automated investigation and response, advanced hunting, core vulnerability management, and threat analytics. Included in Microsoft 365 E5.
Defender for Business
A version for small and medium businesses (up to 300 users) with enterprise-grade protection and simplified setup. Included in Microsoft 365 Business Premium.
Exam scenarios
| Situation | Answer | Why |
|---|---|---|
| Analyze attachments in an isolated environment before delivering them | Safe Attachments | It detonates the file in a sandbox. |
| Check a link at the moment the user clicks it | Safe Links | It checks the URL at click time, not only on arrival. |
| Remove an already-delivered malicious email from mailboxes | ZAP (zero-hour auto purge) | It acts after delivery. |
| Teach employees to recognize phishing with fake campaigns | Attack simulation training | Only in Defender for Office 365 Plan 2. |
| Detect someone posing as the CEO from a lookalike domain | Impersonation protection (Plan 1) | Impersonation protection. |
| Isolate a compromised laptop from the network | Defender for Endpoint (EDR) | A response action on the device. |
| Stop Office macros from launching suspicious processes | Attack surface reduction rules | They block behaviors typical of malware. |
| Protect the devices of a 100-employee small business | Defender for Business | Built for SMBs, included in Business Premium. |
Common exam traps
❓ Which Defender for Office 365 plan includes attack simulation training?
Only Plan 2 (included in Microsoft 365 E5).
❓ Does Safe Links only check the URL when the email arrives?
No. It checks it at the time of click, in case the link became malicious later.
❓ Does Safe Attachments only protect email?
No. It also protects files in SharePoint, OneDrive, and Teams.
❓ Do you need Defender for Office 365 to get anti-spam and anti-malware?
No. Exchange Online Protection provides them by default for every cloud mailbox.
❓ What does ZAP do?
It removes malicious messages that were already delivered from mailboxes.
❓ Does Defender for Endpoint only work on Windows?
No. It supports Windows, macOS, Linux, Android, and iOS.
❓ Are EDR and antivirus the same thing?
No. Antivirus prevents; EDR detects suspicious behavior and lets you respond, for example by isolating the device.
❓ Which Defender for Endpoint plan includes EDR?
Plan 2. Plan 1 focuses on prevention.
Did you get this topic?
Test what you just learned
An attacker sends an email with a link pointing to a harmless page. Two hours later, they swap the page for a credential theft site. Which feature protects the user who clicks later?
Ready to test "Defender for Office 365 and Defender for Endpoint"?
Original questions, each with a full explanation.
Start a mock exam