Open the Defender portal. If it says Explorer you have Plan 2, if it says Real-time detections you have Plan 1.
Microsoft publishes that as the quick way to tell the plans apart, and it takes ten seconds. Which one you hold decides whether you can investigate a business email compromise properly or only see that it happened. Most UAE organisations have never checked.
- Three tiersBuilt-in, Plan 1, Plan 2
- E3 and Business PremiumBoth land on Plan 1
- Explorer or notThe ten-second check
- BEC is the riskNot volume spam
Eight things to understand about the email protection ladder.
The ten-second check that tells you what you have
Microsoft states it twice in its own documentation. If Email and collaboration in the Defender portal shows Real-time detections, you have Plan 1. If it shows Explorer, you have Plan 2. That is the quickest way to differentiate them and it requires no licensing conversation, no admin centre digging and no supplier. Do that before reading anything else about which plan to buy.
What everybody already has, and what it is for
Every Microsoft 365 subscription with cloud mailboxes includes anti-malware, anti-spam with bulk mail handling, anti-phishing spoofing protection with the spoof intelligence insight, outbound spam protection, connection filtering, quarantine with quarantine policies, the Tenant Allow and Block List, message trace and zero-hour auto purge. Microsoft describes this tier as preventing broad, volume-based, known email attacks. It is genuinely good at that, and volume spam is not what costs UAE businesses money.
What Plan 1 adds: the targeted attack layer
Microsoft describes Plan 1 as protecting against zero-day malware, phishing and business email compromise. Concretely it adds user and domain impersonation protection, mailbox intelligence impersonation using the contact graph, phishing email thresholds, Safe Attachments in email and across SharePoint, OneDrive and Teams, and Safe Links in email, Office clients and Teams. Impersonation protection is the part that matters most here, because impersonation is how invoice fraud actually arrives.
What Plan 2 adds: investigation, hunting and automation
Microsoft summarises Plan 2 as adding phishing simulations, post-breach investigation, hunting, response and automation. Specifically: attack simulation training, priority account protection, Threat Explorer in place of Real-time detections, Threat Trackers, Campaigns, advanced hunting on Teams messages, and Automated Investigation and Response including AIR for compromised users. The automation is the practical difference for a team without a security operations function.
Where the plans sit in the subscriptions you may hold
Microsoft gives Microsoft 365 E3, G3 and Business Premium as examples of subscriptions including Plan 1, and A5, E5 and G5 as examples including Plan 2. Note the contrast with endpoint protection, where Business Premium is ahead of E3. On email they land on the same rung, so a UAE business on either has identical email protection and the same decision in front of it.
Priority accounts, which most organisations never configure
User tags including the Priority account tag are available at Plan 1, and priority account protection itself is a Plan 2 capability. The people most worth protecting differently are the finance team, the executives and anybody who can change payment details, and in most tenants we look at nobody has ever marked them as such. Tagging them costs nothing and improves both alerting and investigation.
Safe Documents is not in either plan
A genuine trap. Microsoft states that Safe Documents is available to users with Microsoft 365 A5 or Microsoft Defender Suite licences and is not included in the Defender for Office 365 plans. So an organisation on Plan 2 does not automatically have it, which surprises people who reasonably assume the top email plan includes every email-adjacent feature.
None of it replaces email authentication
Microsoft notes that SPF, DKIM and DMARC records in DNS allow Microsoft 365 to protect more accurately against spoofing. Those records are about your own domain being impersonated outbound, which no inbound filtering tier addresses. The two are complementary and both are needed, and organisations regularly buy the higher plan while leaving their own domain spoofable.
The attack that empties a bank account does not look like spam.
Every tier of this ladder handles bulk spam well. That is not the risk. The risk is one convincing message about a payment, and where you sit on the ladder decides whether you can see it coming and reconstruct it afterwards.
- Business email compromise usually arrives as a single, well-written message that impersonates somebody the recipient trusts, asking for a payment or a change of bank details. It frequently carries no attachment, no link and no malware, so the volume-based filtering in the built-in tier has very little to work with. Impersonation protection, which starts at Plan 1, is the layer aimed specifically at this.
- The more dangerous variant is not impersonation at all. It is a genuine message from a genuinely compromised mailbox, often at a supplier rather than at you. No filtering tier can mark that as spoofed because nothing is spoofed. What helps is a payment process where a change of bank details is verified by phone to a known number, which costs nothing and is worth more than any licence upgrade.
- Where Plan 2 earns its place is afterwards. When somebody asks what happened, who else received it and whether anything was clicked, Threat Explorer, Campaigns and automated investigation are what answer that. On Plan 1 you have Real-time detections and the Email entity page, which is real capability but a narrower view when you are reconstructing an incident under pressure.
- And separately from all of it, publish and enforce SPF, DKIM and DMARC. Microsoft states directly that those records let it protect more accurately against spoofing. They also stop your domain being used against your own customers, which no inbound plan addresses at any tier.
Four things that matter more than the plan you buy.
We establish which tier you are on before discussing upgrades
The Explorer against Real-time detections check takes ten seconds and settles it. In a meaningful number of cases the organisation already holds Plan 1 and has configured none of it, which means the work is configuration rather than purchase. Recommending Plan 2 to an organisation running Plan 1 at default settings would be selling capacity to somebody not using what they have.
We configure impersonation protection around real people
Impersonation protection works on named users and named domains, so somebody has to decide who and what to protect. That is the finance team, the executives, anybody who can change payment details, plus your own domains and your significant suppliers. It is a short exercise, it is included from Plan 1, and it is left undone in most tenants we assess.
We are honest that some attacks are not a filtering problem
A genuine message from a genuinely compromised supplier mailbox is not spoofed, so no tier flags it. The control that stops the loss is a payment process where bank detail changes are verified by phone to a known number. We say that plainly, including when it means recommending a process change rather than a product, because the alternative is selling a licence against a risk it does not address.
We do the outbound half as well
Microsoft states that SPF, DKIM and DMARC let it protect more accurately against spoofing, and those records also stop your domain being used against your own customers. Inbound plans do nothing for that. We treat the two as one piece of work, because an organisation that has bought Plan 2 and left its domain spoofable has covered one direction and not the other.
Six UAE situations that justify looking at this properly.
Any business that pays or receives invoices
Which is all of them, and it is why this page exists. The impersonation protection that starts at Plan 1 is aimed squarely at the message pretending to be your managing director or your supplier. Configuring it around the specific people who authorise payments is a short piece of work with a direct relationship to the loss it prevents.
A business on Business Premium or E3
Both include Defender for Office 365 Plan 1, so you have impersonation protection, Safe Links and Safe Attachments whether or not you have configured them. Note that this differs from endpoint protection, where Business Premium is ahead of E3. On email they are level, and the useful question for both is whether the capability is switched on.
An organisation that has just had a near miss
A payment nearly went to the wrong account, or somebody received a convincing message from a supplier that turned out to be fraudulent. This is the right moment to look, because the organisation has just experienced the specific risk and the budget conversation is already won. The work is usually configuration plus a payment process change rather than a purchase.
A firm with significant supplier payment flows
Trading companies, contractors, freight and logistics. The exposure here is not your own mailboxes but your suppliers, because a compromise at their end produces a genuine message from a genuine address. Domain impersonation protection covering supplier domains helps with lookalikes, and the out-of-band verification process is what covers the rest.
A business that needs to investigate an incident properly
When somebody asks who else received a message, whether anyone clicked, and what the sender did afterwards, the answer depends on your tier. Threat Explorer, Campaigns and automated investigation are Plan 2. If your obligations or your clients require you to be able to reconstruct an email incident, that is the clearest argument for the higher plan.
An organisation running user awareness training
Attack simulation training is a Plan 2 capability, and running phishing simulations from inside the platform that also filters the mail has practical advantages over a third-party tool. If you are already paying for a separate simulation product and hold or are considering Plan 2, it is worth checking whether you are buying the same capability twice.
What we find when we review email security in UAE tenants.
| Feature | Tier known and configured | Licensed, default settings | Built-in only |
|---|---|---|---|
Knows which plan it holds | Yes | Assumes | Correct by default |
Safe Links and Safe Attachments enabled | Yes | Partly | Not available |
Impersonation protection configured for named people | Yes | No | Not available |
Priority accounts tagged | Yes | No | Not available |
Safe Attachments covers SharePoint and Teams | Yes | Rarely | Not available |
External sender warning in place | Yes | Sometimes | Sometimes |
SPF, DKIM and DMARC enforced | Yes | p=none or absent | Usually absent |
Could reconstruct who else got the message | Yes | Partly | Barely |
Payment changes verified out of band | Yes | Sometimes | Rarely |
Frequency in the UAE market | Uncommon | Very common | Common in SMEs |
Built-in, Plan 1 and Plan 2 side by side.
| Capability | Built-in | Plan 1 | Plan 2 | |
|---|---|---|---|---|
| Anti-malware, anti-spam, anti-spoofing | Yes | Yes | Yes | |
| Quarantine, Tenant Allow/Block List, message trace | Yes | Yes | Yes | |
| Zero-hour auto purge for email | Yes | Yes | Yes | |
| User and domain impersonation protection | No | Yes | Yes | |
| Mailbox intelligence impersonation, contact graph | No | Yes | Yes | |
| Safe Attachments, email and SharePoint, OneDrive, Teams | No | Yes | Yes | |
| Safe Links in email, Office clients and Teams | No | Yes | Yes | |
| Real-time detections | No | Yes | Replaced by Explorer | |
| Email entity page and user tags | No | Yes | Yes | |
| Zero-hour auto purge for Teams | No | Yes | Yes | |
| Threat Explorer | No | No | Yes | |
| Threat Trackers and Campaigns | No | No | Yes | |
| Attack simulation training | No | No | Yes | |
| Automated Investigation and Response | No | No | Yes | |
| Safe Documents | No | No | No, needs A5 or Defender Suite |
Five steps, starting with a ten-second check.
- 1
Establish the tier and what is configured
The Explorer against Real-time detections check, then a review of what is actually enabled: Safe Links, Safe Attachments including the SharePoint, OneDrive and Teams coverage, anti-phishing policies, and whether preset security policies are in use or custom policies nobody has reviewed.
- 2
Configure impersonation protection around named people and domains
Your executives and finance team, anybody who can change payment details, your own domains, and the supplier domains that matter. This requires a decision from the business about who to protect rather than a technical judgement, and it is the single most targeted control against the attack that actually costs money.
- 3
Tag priority accounts and set the surrounding controls
Priority account tagging, external sender warnings, and user reporting so people have a route to flag something suspicious that leads somewhere. Then we test that route end to end, because a report button that goes nowhere trains people to stop using it.
- 4
Fix the outbound half
SPF, DKIM and DMARC for your domains, which Microsoft states improves its own spoofing protection and which separately prevents your domain being used against your customers. Where this is a larger piece of work we scope it separately, since moving to enforcement safely needs its own discovery.
- 5
Decide on Plan 2 with the evidence in front of you
Only after the above, and with a clear question: do you need post-breach investigation, hunting and automation, and would anybody use them. Microsoft offers a ninety-day Plan 2 trial through the Defender portal, so this can be answered by trying it rather than by argument.
What organisations ask about Defender for Office 365.
Fifteen checks, and the first one takes ten seconds.
What you have
- Does Email and collaboration show Explorer, or Real-time detections?Explorer means Plan 2, Real-time detections means Plan 1.
- Are Safe Links and Safe Attachments actually turned on?Included at Plan 1 and frequently never configured.
- Does Safe Attachments cover SharePoint, OneDrive and Teams?A separate setting from email, and often missed.
- Are you using preset security policies, or custom ones nobody reviews?Standard and Strict presets are a reasonable default.
- Have you ever used a Plan 2 trial to see what it adds?Microsoft offers a 90-day trial through the Defender portal.
The payment fraud layer
- Is user impersonation protection configured for your executives?It protects named people, so somebody has to name them.
- Is domain impersonation protection configured for your own domains?And for key partner and supplier domains.
- Are priority accounts tagged?Finance, executives, anyone who can change payment details.
- Do external emails carry a visible warning?Cheap, and effective against display-name tricks.
- Does a bank detail change require phone verification?The control no licence tier can replace.
Could you investigate afterwards
- Could you find everybody else who received a given message?Explorer at Plan 2, more limited at Plan 1.
- Would you know whether a link was clicked?URL trace and the Email entity page start at Plan 1.
- How far back does your audit retention reach?A separate question from your Defender plan.
- Are SPF, DKIM and DMARC published and enforced?Microsoft states these improve its own spoofing protection.
- Has anyone tested reporting a phishing message end to end?User submission, triage, and what happens next.
The pages around this one.
DMARC and email authentication audit
The outbound half, covering whether anyone can send mail as your domain, and the staged route to enforcement without breaking your own mail.
Defender for Endpoint
The device half of the same Defender family, where the licensing pattern is genuinely different and Business Premium comes out ahead of E3.
Microsoft 365 security audit
A full tenant review including mail flow rules, forwarding, and how far back your audit evidence actually reaches.
Open the Defender portal and look at Email and collaboration.
Explorer means Plan 2, Real-time detections means Plan 1. Then check whether impersonation protection has any names in it. Those two answers tell you whether your next move is a purchase or an afternoon of configuration, and it is usually the second.
Related Services
Explore more solutions that work great with this service
DMARC Audit UAE
Stop exact-domain spoofing, and keep your mail delivering
Defender for Endpoint
Business, Plan 1 or Plan 2, and what each actually gives you
Microsoft 365 Security Audit
Tenant review, and how far back your evidence really goes
Microsoft Defender
Advanced endpoint and email threat protection
Microsoft Security Dubai
Entra, Defender, Purview, Sentinel, and what you already own
Outlook & Exchange
Email hosting and Exchange Online management
Security Awareness Training
Phishing simulation and behavior-change training
Entra Conditional Access
The control that decides who reaches your data