Microsoft Defender for Office 365 protects email and collaboration tools in Microsoft 365 against phishing, malware and business email compromise. Plan 1 adds Safe Links, Safe Attachments and impersonation protection to the filtering built into every cloud mailbox. Plan 2 adds attack simulation training, Threat Explorer, automated investigation and response, and advanced hunting. It is a cloud service managed in the Microsoft Defender portal, included in some Microsoft 365 subscriptions or sold as an add-on.
Microsoft is a US company headquartered in Redmond, Washington, and the product is proprietary. Its EU Data Boundary commits to storing and processing customer data for enterprise online services, including Microsoft 365, within the EU and EFTA, with limited documented exceptions. As a US provider, Microsoft is subject to the US CLOUD Act, which lets US authorities compel it to produce data it controls, even when stored in Europe. European organisations should weigh that alongside the residency commitments.