Microsoft 365 Atp

admin



Leverage Defender for Office 365 to protect your Office 365 environment against advanced threats. Get started Defender for Office 365 helps organizations secure their enterprise by offering a comprehensive slate of prevention, detection, investigation and hunting, response and remediation, awareness and training, and secure posture features. Office 365 Advanced Threat Protection (ATP) can work integrated with Exchange Online Protection and Office 365 Threat Intelligence. Using ATP in the cloud can offload your mail servers and protections systems on the mail servers including on-premises servers. It is not recommended that you turn off Office 365 Advanced Threat Protection. Here are some of the major features of Microsoft 365 Advanced Threat Protection ATP for you. Safe Attachment Review Files. The functionality of “Safe Attachment” in ATP analyses all attachments. In the first place, ATP isolates the attachment in the detonation chamber for preventing the malicious attack.

Microsoft Defender for Endpoint. So, Microsoft Defender for Office 365 P1 expands on the prevention side of the house, and adds extra forms of detection. Microsoft Defender for Office 365 P1 also adds Real-time detections for investigations. This threat hunting tool's name is in bold because having it is clear means of knowing you have Defender for Office 365 P1. It doesn't appear in Defender for Office 365 P2.

-->

Applies to

This article will introduce you to your new security properties in the Cloud. Whether you're part of a Security Operations Center, you're a Security Administrator new to the space, or you want a refresher, let's get started.

Caution

If you're using Outlook.com, Microsoft 365 Family, or Microsoft 365 Personal, and need Safe Links or Safe Attachments info, click this link: Advanced Outlook.com security for Microsoft 365 subscribers.

Office 365 security spelled out

Every Office 365 subscription comes with security capabilities. The goals and actions that you can take depend on the focus of these different subscriptions. In Office 365 security, there are three main security services (or products) tied to your subscription type:

  1. Exchange Online Protection (EOP)
  2. Microsoft Defender for Office 365 Plan 1 (Defender for Office P1)
  3. Microsoft Defender for Office 365 Plan 2 (Defender for Office P2)

Note

If you bought your subscription and need to roll out security features right now, skip to the steps in the Protect Against Threats article. If you're new to your subscription and would like to know your license before you begin, browse Billing > Your Products in the Microsoft 365 admin center.

Office 365 security builds on the core protections offered by EOP. EOP is present in any subscription where Exchange Online mailboxes can be found (remember, all the security products discussed here are Cloud-based).

You may be accustomed to seeing these three components discussed in this way:

EOPMicrosoft Defender for Office 365 P1Microsoft Defender for Office 365 P2
Prevents broad, volume-based, known attacks.Protects email and collaboration from zero-day malware, phish, and business email compromise.Adds post-breach investigation, hunting, and response, as well as automation, and simulation (for training).

But in terms of architecture, let's start by thinking of each piece as cumulative layers of security, each with a security emphasis. More like this:

Though each of these services emphasizes a goal from among Protect, Detect, Investigate, and Respond, all the services can carry out any of the goals of protecting, detecting, investigating, and responding.

The core of Office 365 security is EOP protection. Microsoft Defender for Office 365 P1 contains EOP in it. Defender for Office 365 P2 contains P1 and EOP. The structure is cumulative. That's why, when configuring this product, you should start with EOP and work to Defender for Office 365.

Though email authentication configuration takes place in public DNS, it's important to configure this feature to help defend against spoofing. If you have EOP,you should configure email authentication.

If you have an Office 365 E3, or below, you have EOP, but with the option to buy standalone Defender for Office 365 P1 through upgrade. If you have Office 365 E5, you already have Defender for Office 365 P2.

Tip

If your subscription is neither Office 365 E3 or E5, you can still check to see if you have the option to upgrade to Microsoft Defender for Office 365 P1. If you're interested, this webpage lists subscriptions eligible for the Microsoft Defender for Office 365 P1 upgrade (check the end of the page for the fine-print).

The Office 365 security ladder from EOP to Microsoft Defender for Office 365

Important

Learn the details on these pages: Exchange Online Protection, and Defender for Office 365.

What makes adding Microsoft Defender for Office 365 plans an advantage to pure EOP threat management can be difficult to tell at first glance. To help sort out if an upgrade path is right for your organization, let's look at the capabilities of each product when it comes to:

  • preventing and detecting threats
  • investigating
  • responding

starting with Exchange Online Protection:

Prevent/DetectInvestigateRespond
Technologies include:
  • spam
  • phish
  • malware
  • bulk mail
  • spoof intelligence
  • impersonation detection
  • Admin Quarantine
  • Admin and user submissions of False Positives and False Negatives
  • Allow/Block for URLs and Files
  • Reports
  • Audit log search
  • Message Trace
  • Zero-hour Auto-Purge (ZAP)
  • Refinement and testing of Allow and Block lists

    • If you want to dig in to EOP, jump to this article.

    Because these products are cumulative, if you evaluate Microsoft Defender for Office 365 P1 and decide to subscribe to it, you'll add these abilities.

    Microsoft 365 Atp

    Gains with Defender for Office 365, Plan 1 (to date):

    Prevent/DetectInvestigateRespond
    Technologies include everything in EOP plus:
  • Safe attachments
  • Safe links
  • Microsoft Defender for Office 365 protection for workloads (ex. SharePoint Online, Teams, OneDrive for Business)
  • Time-of-click protection in email, Office clients, and Teams
  • anti-phishing in Defender for Office 365
  • User and domain impersonation protection
  • Alerts, and SIEM integration API for alerts
  • SIEM integration API for detections
  • Real-time detections tool
  • URL trace
  • Same

    • So, Microsoft Defender for Office 365 P1 expands on the prevention side of the house, and adds extra forms of detection.

    Microsoft Defender for Office 365 P1 also adds Real-time detections for investigations. This threat hunting tool's name is in bold because having it is clear means of knowing you have Defender for Office 365 P1. It doesn't appear in Defender for Office 365 P2.

    Gains with Defender for Office 365, Plan 2 (to date):

    Prevent/DetectInvestigateRespond
    Technologies include everything in EOP, and Microsoft Defender for Office 365 P1 plus:
  • Same
  • Threat Explorer
  • Threat Trackers
  • Campaign views
  • Automated Investigation and Response (AIR)
  • AIR from Threat Explorer
  • AIR for compromised users
  • SIEM Integration API for Automated Investigations

    • So, Microsoft Defender for Office 365 P2 expands on the investigation and response side of the house, and adds a new hunting strength. Automation.

    In Microsoft Defender for Office 365 P2, the primary hunting tool is called Threat Explorer rather than Real-time detections. If you see Threat Explorer when you navigate to the Security center, you're in Microsoft Defender for Office 365 P2.

    Microsoft Office 365 Atp

    To get into the details of Microsoft Defender for Office 365 P1 and P2, jump to this article.

    Tip

    EOP and Microsoft Defender for Office 365 are also different when it comes to end-users. In EOP and Defender for Office 365 P1, the focus is awareness, and so those two services include the Report message Outlook add-in so users can report emails they find suspicious, for further analysis.

    In Defender for Office 365 P2 (which contains everything in EOP and P1), the focus shifts to further training for end-users, and so the Security Operations Center has access to a powerful Threat Simulator tool, and the end-user metrics it provides.

    Microsoft Defender for Office 365 Plan 1 vs. Plan 2 cheat sheet

    This quick-reference will help you understand what capabilities come with each Microsoft Defender for Office 365 subscription. When combined with your knowledge of EOP features, it can help business decision makers determine what Microsoft Defender for Office 365 is best for their needs.

    Defender for Office 365 Plan 1Defender for Office 365 Plan 2
    Configuration, protection, and detection capabilities: Defender for Office 365 Plan 1 capabilities

    --- plus ---

    Automation, investigation, remediation, and education capabilities:

    • Microsoft Defender for Office 365 Plan 2 is included in Office 365 E5, Office 365 A5, and Microsoft 365 E5.

    • Microsoft Defender for Office 365 Plan 1 is included in Microsoft 365 Business Premium.

    • Microsoft Defender for Office 365 Plan 1 and Defender for Office 365 Plan 2 are each available as an add-on for certain subscriptions. To learn more, here's another link Feature availability across Microsoft Defender for Office 365 plans.

    • The Safe Documents feature is only available to users with the Microsoft 365 E5 or Microsoft 365 E5 Security licenses (not included in Microsoft Defender for Office 365 plans).

    • If your current subscription doesn't include Microsoft Defender for Office 365 and you want it, contact sales to start a trial, and find out how Microsoft Defender for Office 365 can work for in your organization.

    Tip

    Insider tip. You can use the docs.microsoft.com table of contents to learn about EOP and Microsoft Defender for Office 365. Navigate back to this page, Office 365 Security overview, and you'll notice that table of contents organization in the side-bar. It begins with Deployment (including migration) and then continues into prevention, detection, investigation, and response.

    This structure is divided so that Security Administration topics are followed by Security Operations topics. If you're a new member of either job role, use the link in this tip, and your knowledge of the table of contents, to help learn the space. Remember to use feedback links and rate articles as you go. Feedback helps us improve what we offer you.

    Where to go next

    If you're a Security Admin, you may need to configure DKIM or DMARC for your mail. You may want to roll out 'Strict' security presets for your priority users, or look for what's new in the product. Or if you're with Security Ops, you may want to leverage Real-time detections or Threat Explorer to investigate and respond, or train end-user detection with Attack Simulator. Either way, here are some additional recommendations for what to look at next.

    See the specific recommended 'golden' configs and use their recommended presets to configure security policies quickly

    Catch up on what's new in Microsoft Defender for Office 365 (including EOP developments)

    Use Attack Simulator in Microsoft Defender for Office 365

    -->

    Applies to:

    Want to experience Microsoft Defender for Endpoint? Sign up for a free trial.

    Microsoft 365 Atp Cost

    For more info about Windows 10 Enterprise Edition features and functionality, see Windows 10 Enterprise edition. Firman rindu serindu rindunya lirik.

    Microsoft Defender for Endpoint is an enterprise endpoint security platform designed to help enterprise networks prevent, detect, investigate, and respond to advanced threats.

    Defender for Endpoint uses the following combination of technology built into Windows 10 and Microsoft's robust cloud service:

    365

    • Endpoint behavioral sensors: Embedded in Windows 10, these sensors collect and process behavioral signals from the operating system and send this sensor data to your private, isolated, cloud instance of Microsoft Defender for Endpoint.

    • Cloud security analytics: Leveraging big-data, device-learning, andunique Microsoft optics across the Windows ecosystem,enterprise cloud products (such as Office 365), and online assets, behavioral signalsare translated into insights, detections, and recommended responsesto advanced threats.

    • Threat intelligence: Generated by Microsoft hunters, security teams,and augmented by threat intelligence provided by partners, threatintelligence enables Defender for Endpoint to identify attackertools, techniques, and procedures, and generate alerts when theyare observed in collected sensor data.

    Microsoft Defender for Endpoint


    Threat & Vulnerability Management

    Attack surface reduction

    Next-generation protection

    Endpoint detection and response

    Automated investigation and remediation

    Microsoft Threat Experts
    Centralized configuration and administration, APIs
    Microsoft 365 Defender

    Tip

    • Learn about the latest enhancements in Defender for Endpoint: What's new in Microsoft Defender for Endpoint.
    • Microsoft Defender for Endpoint demonstrated industry-leading optics and detection capabilities in the recent MITRE evaluation. Read: Insights from the MITRE ATT&CK-based evaluation.

    Internet explorer for mac os x yosemite. Threat & Vulnerability Management
    This built-in capability uses a game-changing risk-based approach to the discovery, prioritization, and remediation of endpoint vulnerabilities and misconfigurations.

    Attack surface reduction
    The attack surface reduction set of capabilities provides the first line of defense in the stack. By ensuring configuration settings are properly set and exploit mitigation techniques are applied, the capabilities resist attacks and exploitation. This set of capabilities also includes network protection and web protection, which regulate access to malicious IP addresses, domains, and URLs.

    Next-generation protection
    To further reinforce the security perimeter of your network, Microsoft Defender for Endpoint uses next-generation protection designed to catch all types of emerging threats.

    Endpoint detection and response
    Endpoint detection and response capabilities are put in place to detect, investigate, and respond to advanced threats that may have made it past the first two security pillars. Advanced hunting provides a query-based threat-hunting tool that lets you proactively find breaches and create custom detections.

    Automated investigation and remediation
    In conjunction with being able to quickly respond to advanced attacks, Microsoft Defender for Endpoint offers automatic investigation and remediation capabilities that help reduce the volume of alerts in minutes at scale.

    Atp Plan 1

    Microsoft Secure Score for Devices

    Defender for Endpoint includes Microsoft Secure Score for Devices to help you dynamically assess the security state of your enterprise network, identify unprotected systems, and take recommended actions to improve the overall security of your organization.

    Microsoft Threat Experts
    Microsoft Defender for Endpoint's new managed threat hunting service provides proactive hunting, prioritization, and additional context and insights that further empower Security operation centers (SOCs) to identify and respond to threats quickly and accurately.

    Important

    Defender for Endpoint customers need to apply for the Microsoft Threat Experts managed threat hunting service to get proactive Targeted Attack Notifications and to collaborate with experts on demand. Experts on Demand is an add-on service. Targeted Attack Notifications are always included after you have been accepted into Microsoft Threat Experts managed threat hunting service.

    If you are not enrolled yet and would like to experience its benefits, go to Settings >General >Advanced features >Microsoft Threat Experts to apply. Once accepted, you will get the benefits of Targeted Attack Notifications, and start a 90-day trial of Experts on Demand. Contact your Microsoft representative to get a full Experts on Demand subscription.

    Centralized configuration and administration, APIs
    Integrate Microsoft Defender for Endpoint into your existing workflows.

    Integration with Microsoft solutions
    Defender for Endpoint directly integrates with various Microsoft solutions, including:

    Microsoft 365 Atp License

    • Azure Defender
    • Azure Sentinel
    • Intune
    • Microsoft Cloud App Security
    • Microsoft Defender for Identity
    • Microsoft Defender for Office
    • Skype for Business

    Defender Atp Microsoft 365

    Microsoft 365 Defender
    With Microsoft 365 Defender, Defender for Endpoint and various Microsoft security solutions form a unified pre- and post-breach enterprise defense suite that natively integrates across endpoint, identity, email, and applications to detect, prevent, investigate, and automatically respond to sophisticated attacks.

    Related topic