Tools
Microsoft 365 email security: when the built-in tier is not enough
Exchange Online Protection is included and is genuinely decent. What the paid tiers add, and the specific attack it is worth paying to stop.
Microsoft
Hornetsecurity
Start from what you already have
Every Microsoft 365 mailbox includes Exchange Online Protection. It filters spam, it filters known malware, and for a large number of organisations it is adequate on its own. Anyone selling you email security whose first move is to disparage EOP is selling rather than advising.
What EOP does not do well is the attack that is now most expensive: a targeted message with no attachment, no malicious link at the time of delivery, and a payload that is entirely social. Business email compromise does not look like spam because it is not spam.
| EOP | Defender P1 | Defender P2 | |
|---|---|---|---|
| Anti-spam and anti-malware | |||
| Safe Links and Safe Attachments | |||
| Impersonation protection | |||
| Automated investigation and response | |||
| Attack simulation training | |||
| Threat explorer and hunting |
Capability boundaries move. Confirm on Microsoft Learn before purchasing, particularly around what P1 includes in Threat Explorer.
The decision that actually matters
Safe Links rewrites URLs so they are checked at click time rather than delivery time. This is the single most valuable thing in P1, because the standard technique is to send a clean link and weaponise the destination afterwards, once the message has passed inspection.
If you buy nothing else, buy the tier that gives you time-of-click checking. Everything above that is about investigation capability, which is only worth paying for if somebody is going to investigate.
Where email security budget earns its place
Our weighting for this category, published before testing.
- Time-of-click protection35%
- Impersonation controls25%
- Investigation tooling20%
- Admin overhead20%
Commission rate is not an input.
The third-party option
Worth pricing only if you have a specific reason to sit filtering outside the tenant.
Email security and 365 backup from one vendor
- Best for
- Organisations who want filtering outside the tenant, or who want backup and email security on one contract
- Watch out for
- You are now running two filtering layers. Decide which one owns quarantine before you deploy, not after
Links above go to the vendor. Where a link is marked as an affiliate link, a purchase may earn this site a commission at no cost to you, and it played no part in the ranking.
The verdict
Defender for Office 365 Plan 1, for most organisations
Time-of-click link checking and impersonation protection cover the attacks that actually cost money, and it is frequently already included in the licence you hold.
Plan 2
Worth it when you have someone whose job includes investigating email incidents, and when attack simulation training will genuinely be run rather than bought.
Skip both if you hold Microsoft 365 E5 or Business Premium, which already include a Defender tier. Check your licence before buying anything.
Disclosure. Some links on this site are affiliate links. Scoring weights are published before any programme is joined, and commission is never a ranking input. Full policy, and the method behind this guide.