Microsoft Defender for Office 365
The BEC baseline you may already be paying for inside Microsoft 365
score
Visiting through this link may earn us a commission if you sign up, at no extra cost to you. It doesn't change our review, our lowest editorial scores go to vendors who pay us the most for placement just as often as ones who pay us nothing.
Before you buy a dedicated BEC tool, find out whether you already own one. If you're on Microsoft 365 Business Premium, you have Defender for Office 365 Plan 1 in the box, and a lot of SMBs have never turned on the parts that matter. It's Microsoft's email and collaboration security: Safe Links and Safe Attachments, anti-phishing and impersonation policies, and AI-based containment that can auto-disable a compromised account across Outlook and Teams.
Be clear-eyed about what it is, though. This is a broad email-security platform, not a purpose-built behavioral payroll-diversion tool. Its impersonation and anti-phishing policies will catch a real share of BEC, but its center of gravity is malware, malicious URLs, and phishing across the Microsoft stack, not the payload-free 'change my direct deposit' email that's pure social engineering. That specific attack is exactly where a behavioral specialist like Sublime or Abnormal still catches more. So the honest sequence is: switch on and tune Defender's anti-phishing and impersonation policies first, because you're already paying for them, then decide whether a behavioral layer on top is worth it.
Standalone, Plan 1 runs about $2/user/month and Plan 2 about $5 (Plan 2 adds attack-simulation training and automated investigation and response). But the number most SMBs should care about is $22/user/month, the price of Business Premium that already bundles Plan 1. It's not a pick, it's the baseline every Microsoft shop should confirm before spending on anything else.
Pricing
Bundled into Microsoft 365 Business Premium ($22/user/mo), so many SMBs already own Plan 1. Standalone it's about $2/user/mo for Plan 1 and $5/user/mo for Plan 2 (which adds attack-simulation training plus automated investigation and response), billed annually. The real question isn't the price, it's whether you've turned on the anti-phishing and impersonation policies you already have.
| In Business Premium | Included in $22/user/mo Plan 1 bundled with M365 Business Premium |
| Plan 1 standalone | ~$2/user/mo annual; Safe Links, Safe Attachments, anti-phishing |
| Plan 2 standalone | ~$5/user/mo annual; adds attack simulation + automated investigation/response |
Features
- Anti-phishing and impersonation-protection policies (the BEC-relevant piece)
- Safe Links and Safe Attachments across Outlook, Teams, SharePoint, and OneDrive
- AI-based containment that auto-disables compromised accounts
- Attack-simulation training (Plan 2)
- Automated investigation and response with threat reporting (Plan 2)
- Plan 1 bundled into Microsoft 365 Business Premium
- You may already own Plan 1 inside Business Premium, protection you've paid for and can simply switch on
- Native to Microsoft 365, so there's no third-party routing or MX change to deploy
- Covers the broad email threat surface (malware, malicious URLs, impersonation), not only BEC
- A broad email-security add-on, not a purpose-built behavioral payroll-diversion tool
- The payload-free 'change my direct deposit' email is where behavioral specialists (Sublime, Abnormal) still catch more
- Real value takes configuring the anti-phishing and impersonation policies, the defaults alone leave gaps
Microsoft 365 shops that should turn on and tune the BEC-relevant protection they already own before buying anything dedicated.
Google Workspace organizations, and teams whose main worry is pure social-engineering payroll diversion, where a behavioral layer earns its keep.
Screenshots
Supported countries
Available anywhere Microsoft 365 is sold; the countries above are illustrative, not a limit.
Integrations
Microsoft Defender for Office 365 alternatives
Tools worth comparing before you commit.
