Integrate Office 365 Advanced Threat Protection with Microsoft Defender Advanced Threat Protection

Office 365 Advanced Threat Protection (Office 365 ATP) can be configured to work with Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP).

Integrating Office 365 ATP with Microsoft Defender ATP can help your security operations team monitor and take action quickly if users' devices are at risk. For example, once integration is enabled, your security operations team will be able to see the devices that are potentially affected by a detected email message, as well as how many recent alerts those devices have in Microsoft Defender ATP.

The following image depicts what the Devices tab looks like have Microsoft Defender ATP integration enabled:

When Microsoft Defender ATP is enabled, you can see a list of devices with alerts.

In this example, you can see that the recipients of the detected email message have four devices and one has an alert. Clicking the link for a device opens its page in the Microsoft Defender Security Center (https://securitycenter.windows.com).

Tip

Learn more about the Microsoft Defender Security Center (also referred to as the Microsoft Defender ATP portal.)

Requirements

To integrate Office 365 ATP with Microsoft Defender ATP

Integrating Office 365 ATP with Microsoft Defender ATP is set up by using both the Security & Compliance Center AND the Microsoft Defender Security Center.

  1. As a global administrator or a security administrator, go to https://protection.office.com and sign in. (This takes you to the Office 365 Security & Compliance Center.)

  2. In the navigation pane, choose Threat management > Explorer.
    Explorer in Threat Management menu

  3. In the upper right corner of the screen, choose WDATP Settings.

  4. In the Microsoft Defender ATP connection dialog box, turn on Connect to Windows ATP.
    Microsoft Defender ATP connection

  5. Go to the Microsoft Defender Security Center (https://securitycenter.windows.com).

  6. In the navigation bar, choose Settings. Then, under General, choose Advanced features.

  7. Scroll down to Office 365 Threat Intelligence connection, and turn the connection on.
    Office 365 threat intelligence connection

Threat investigation and response capabilities in Office 365

Office 365 Advanced Threat Protection

Microsoft Defender ATP