Office 365 threat investigation and response

Threat investigation and response capabilities in Office 365 Advanced Threat Protection help security analysts and administrators protect their organization's Office 365 users by:

  1. Making it easy to identify, monitor and understand attacks

  2. Helping to quickly address threats in Exchange Online, SharePoint Online, OneDrive for Business and Microsoft Teams

  3. Providing insights and knowledge to help prevent attacks against their organization

  4. Automated investigation and response for critical email based threats

What's changing?

Formerly, Office 365 Threat Intelligence was included in subscriptions, such as Office 365 E5. This is still the case, as threat investigation and response capabilities are now part of Office 365 Advanced Threat Protection Plan 2 (and this is included in Office 365 E5).

In addition, Office 365 Threat Intelligence was formerly available for purchase as an add-on for Office 365 for business customers. Now, these capabilities are included in Office 365 Advanced Threat Protection Plan 2 (along with all the features in Office 365 Advanced Threat Protection Plan 1). To learn more, see Office 365 Advanced Threat Protection plans and pricing.

Here's what all this means:

  • If your organization already has Office 365 E5, then you already have Advanced Threat Protection Plan 2, and this includes threat investigation and response capabilities.

  • If your organization previously had Office 365 Threat Intelligence (but not Office 365 Advanced Threat Protection) as an add-on to another Office 365 subscription, then you will now have Office 365 Advanced Threat Protection Plan 2, and this includes threat investigation and response capabilities.

  • If your organization previously had Office 365 Advanced Threat Protection (but not Office 365 Threat Intelligence) as an add-on to another Office 365 subscription, then you will now have Office 365 Advanced Threat Protection Plan 1. This includes Office 365 Advanced Threat Protection Plan 1, (but not threat investigation and response capabilities).

For more information, see Office 365 Advanced Threat Protection plans and pricing and the Office 365 Advanced Threat Protection Service Description

Get started with threat investigation and response capabilities

Use the following resources to learn more about threat investigation and response capabilities in Office 365, and how you can use it to keep people in your organization safer.

Threat Explorer views

Protect against threats in Office 365

Office 365 Advanced Threat Protection

Permissions in the Office 365 Security & Compliance Center