
What I like most is that Defender for Office 365 works natively within the Microsoft 365 ecosystem, which is important for us because we manage multiple client tenants in an MSP environment. We don’t need additional gateways or extra infrastructure, and we can deploy policies directly through the Microsoft security portals.
Safe Links and Safe Attachments help reduce phishing risk significantly, and Threat Explorer is especially helpful when we’re investigating suspicious emails that users report. From an admin perspective, having everything connected to Microsoft logs, audit trails, and incident response workflows makes investigations much faster than when using external email security tools. Review collected by and hosted on G2.com.
The biggest challenge is that configuration is spread across multiple portals, which can be confusing even for experienced admins. In MSP scenarios, it also takes time to tune policies correctly—especially anti-phishing and impersonation protection—so you can avoid false positives for clients with different email patterns. Another pain point is licensing complexity: explaining the differences between Defender Plan 1, Plan 2, and E5 security features to clients isn’t always straightforward. Reporting is powerful, but it can still take several clicks to reach the exact information you need during an investigation. Review collected by and hosted on G2.com.
The reviewer uploaded a screenshot or submitted the review in-app verifying them as current user.
Validated through a business email account added to their profile
Organic review. This review was written entirely without invitation or incentive from G2, a seller, or an affiliate.




