What it is
Plan 1 plus attack simulation training, automated investigation and response, Threat Explorer, advanced hunting and threat trackers. The natural step for an E3 estate with someone whose job is security.
Included in: Included in Microsoft 365 E5, Office 365 E5 and E5 Security. Plan 1 is in Business Premium and, since July 2026, in the E3 suites.
Who needs it
- Microsoft 365 E3 and Office 365 E3 organisations with a security function, in-house or outsourced.
- Regulated organisations asked to run phishing simulations and show the results.
- Anyone who has had a business-email-compromise incident and wants to see the next one coming.
Buying options, at Microsoft’s list price in EUR
Loading the price list…
List prices for the region chosen at the top of the page; the proposal you build here carries them. Annual-commitment lines are billed as shown; monthly lines can be reduced or cancelled at each renewal.
Asked before buying
We have Plan 1 in E3. Is Plan 2 worth it?
If nobody would open the investigation tools, no. If someone would — or a customer, insurer or regulator asks for simulations — it is far cheaper than E5 for that alone.
Does it cover Teams and SharePoint?
Yes; Safe Links and the investigation tooling extend to links shared in Teams and files in SharePoint and OneDrive.