Microsoft Defender for Office 365 Reviews

My use case for Microsoft Defender for Office 365 is for email protection, safe links, protection of links, documents, protecting my documents, and protecting attachments. I also use it to conduct phishing email campaign training.

I appreciate the attack simulation feature whereby I get to train users and educate them on how to identify phishing emails and spam emails, as well as the anti-spam protection.

It gives me visibility into my threat environment and threat landscape to ensure that I am one step ahead of any likelihood of threats within my environment. I get to detect it and respond, so the threat intelligence is very effective.

Microsoft security solutions save my time.

It saves money because once I protect my environment, I don't lose money.

It has decreased my detection time and my time to respond.

The inbuilt analysis of false positives can be faster. It's not slow, but it can be faster.

I have been working with Microsoft Defender for Office 365 for five years.

I would rate the stability of Microsoft Defender for Office 365 as 10 over 10 because it's highly available, it works, and it does the job it is meant to do.

The scalability of Microsoft Defender for Office 365 is not applicable because it is dependent on Microsoft for scale.

I would give technical support from Microsoft a 10 over 10 because they provide support 24/7 and there is help from the Microsoft community.

Positive

The deployment process for Microsoft Defender for Office 365 is very simple.

When you say visibility, the meaning is not entirely clear to me.

Microsoft Defender for Office 365 helps me prioritize threats across my enterprise.

I am satisfied with how useful it is.

AI has been embedded in Microsoft Defender for Office 365 and it means admin automation in Defender now.

I bought Microsoft Defender for Office 365 through a partner.

The user interface of Microsoft Defender for Office 365, which I have been using for five years, is easy, so nothing comes to mind regarding documentation improvements.

I am satisfied with the update processes.

I cannot think of any main competitor for Microsoft Defender for Office 365.

The system gives me the option to report an email that was a false positive, and it helps me analyze it, so it's difficult for me to say that emails are false positives because the system analyzes it and lets me know why it was quarantined.

My final rating for Microsoft Defender for Office 365 is 10 over 10.

We are an IT service company, so we do a lot of consultation and have deployed Microsoft Defender for Office 365 for retail and for sure segments, like oil refineries and financial segments.

The insights provided with Microsoft Defender for Office 365 are helpful because it comes with the E5 license, and by default, we can use a lot of capabilities. The insight it gives is good.

Threat intelligence with Microsoft Defender for Office 365 does help prepare for potential threats before they hit, but some are paid features, which hampers investigations because we have to enable it and it might cost; there might be some costs involved.

If you look at other products, such as Wiz or Palo Alto's cloud, because they also have similar components in terms of how they protect cloud infrastructure or enable cloud security, Microsoft Defender for Office 365 is not up to that extent. It is not up to the mark in comparison with Wiz or Palo Alto.

Microsoft Defender for Office 365 can definitely be improved.

I have five years or ten years of experience, or less or more with Microsoft Defender for Office 365.

More than 5,000 employees use Microsoft Defender for Office 365 in our company.

Microsoft traditionally gives good support, which goes with the licensing model that we have. It all depends on the licensing model. If an enterprise is E5, there might be a dedicated TAM who would support us. If not, we will have to depend on the subscription.

If we have paid for the subscription, the support for Microsoft Defender for Office 365 is going to be good. Otherwise, we can expect delays.

With a subscription for Microsoft Defender for Office 365, it is an eight. Without it, it is a six.

Neutral

Considering that Microsoft offers a whole suite of products, and if it is competitive, Microsoft Defender for Office 365 will definitely help save money in the long run.

Microsoft Defender for Office 365 is a little expensive.

We do have experience with Microsoft products, but I am just trying to understand why this is for what. We do have experience with Microsoft products, and I am trying to understand the purpose. I would also to know if there is experience with Microsoft Defender for IoT or Microsoft Defender for Office 365 and what the support options are. My overall rating for this product is six.

Our primary use cases include email protection through Safe Links and Safe Attachments, phishing detection and simulation, message quarantine and investigation workflows, and email authentication controls such as DMARC and DKIM. As a managed service provider, we use the platform both internally and across our customer environments, and we fully leverage the available features wherever licensing allows.

Microsoft Defender for Office 365 has significantly reduced the volume of email-related incidents reaching our service desk while strengthening our overall security posture. We’ve seen improved protection against phishing and malicious links, better visibility into potential threats, and faster response times for investigation and remediation.

The most valuable features are the email protection capabilities, particularly Safe Links and Safe Attachments. These features prevent users from inadvertently clicking on malicious links or opening harmful files by detecting and blocking threats in real time before they can cause any damage.

From a business perspective, this has directly reduced the number of security-related tickets to our service desk. From a security standpoint, it significantly lowers our risk exposure to phishing, malware, and credential theft, both internally and across our customer environments. As a national managed service provider, anything that reduces reactive workload while strengthening protection is a major benefit.

One area for improvement would be broader access to Security Copilot and tighter integration with Defender for Office 365. While recent licensing changes are a step in the right direction, consumption-based pricing and limited security compute units are still a barrier for many smaller organizations.

Expanding availability, lowering cost thresholds, and continuing to enhance AI-driven investigation and response capabilities would make these features more accessible and valuable to a wider range of customers. Increased availability of security-focused agents and automation would further strengthen productivity and threat response maturity for organizations of all sizes.

I’ve been using Microsoft Defender for Office 365 for several years, effectively since it became a core part of Microsoft’s security stack.

Microsoft Defender for Office 365 has been highly stable and reliable in our experience. We rarely encounter service interruptions, and availability has been consistently strong across both our internal environment and customer deployments. When issues do occur, they are typically limited in scope and resolved quickly, which has allowed us to maintain trust in the platform as a core security service.

Microsoft Defender for Office 365 scales very well with the growth of our organization and our customers’ environments. As we have expanded, the platform has continued to meet our needs without requiring significant investment in third-party tools. Most of the functionality we need is available within the Defender ecosystem, which simplifies management and integration.

In a few cases, we supplement with external tools, primarily for security awareness training, where a specialized solution is more cost effective. However, Defender remains the foundational security platform across our environments.

The primary limitation for some customers is access to advanced features that are tied to E5 licensing. While E5 delivers significant value, it is not always feasible for smaller organizations. For many businesses, E3 provides more than enough capability to build a strong security foundation while still allowing room to grow into higher licensing tiers over time.

Overall, Microsoft’s customer service and technical support are solid. The support teams are knowledgeable and typically provide helpful guidance once engaged.

That said, response times can occasionally be slower than expected, particularly for higher-tier escalations, and replies sometimes arrive outside of normal business hours, which can extend resolution timelines. While not a major issue, improving consistency in response times and communication would further strengthen the support experience.

Positive

The initial setup for Microsoft Defender for Office 365 was largely straightforward. Most core features, including policy configuration and general administration, are easy to deploy using the graphical interface, which reduces the need for PowerShell and custom scripting.

Email authentication technologies such as DKIM and DMARC require more planning and coordination with external vendors and DNS providers, but that complexity is expected and not unique to Microsoft. Once configured, however, they are reliable and low-maintenance.

Overall, the deployment experience is user-friendly, and the platform is well-designed from an administrative standpoint. Documentation and ongoing management are also simple to maintain, which helps with long-term operations and governance.

The primary ROI we’ve seen from Microsoft Defender for Office 365 is in time savings and operational efficiency. Automation, threat prioritization, and streamlined investigation workflows have reduced the amount of manual effort required to investigate and remediate incidents. This allows our team to focus on higher-value security initiatives rather than day-to-day triage.

While it’s difficult to assign a precise dollar figure, the cumulative time savings and reduced incident impact translate directly into improved productivity and lower operational risk across both our organization and customer environments.

Overall, the pricing and licensing model for Microsoft Defender for Office 365 is fair and competitive. For organizations on Business Premium and E3, the value aligns well with the cost, particularly given the depth of protection provided.

While E5 represents a higher investment, it also includes a broader set of security and compliance capabilities beyond Defender for Office 365 alone. For larger organizations, the overall value generally justifies the cost, whereas smaller organizations may find the lower-tier licensing options more appropriately scaled to their needs.

Overall Rating I'd give is a 8.5 / 10

Microsoft Defender for Office 365 has had a measurable positive impact on our security operations. It has shifted our team from being largely reactive to operating more strategically through automation, machine-learning-driven detection, and integrated investigation workflows.

The platform does an excellent job of helping us prioritize threats across the enterprise. Defender’s threat intelligence capabilities give us valuable insight into emerging risks, enabling us to prepare in advance and take proactive action rather than responding after an incident occurs. This prioritization also helps our leadership team assign work more effectively, routing critical incidents to senior analysts while allowing lower-risk items to be handled by junior staff or the service desk, which supports team development and operational maturity.

In terms of efficiency, the solution has saved us several hours per week through automation and improved alert correlation. Our time-to-detect and time-to-respond have improved significantly, with faster response times by at least an hour in many cases. This has helped prevent larger incidents such as phishing campaigns, malware spread, and email-based attacks from escalating into larger business impacts.

From a financial perspective, while it’s difficult to quantify exact savings, Defender has clearly reduced risk and prevented more costly security incidents for both our organization and our customers.

Microsoft support is solid but has room for improvement; we would rate it around 7 out of 10, primarily due to delays in communication during emerging incidents when faster proactive notification would be helpful.

Advice to others: If you operate primarily in the Microsoft ecosystem, Defender for Office 365 offers a strong, integrated security platform that covers the majority of most organizations’ needs. While some third-party products may excel in niche areas, Microsoft delivers a well-rounded solution that continues to improve rapidly. For many businesses, sticking with the Microsoft security stack delivers excellent value and operational efficiency without the complexity of managing multiple vendors.

My main use cases with Microsoft Defender for Office 365 are for the email gateway and anti-phishing.

The feature I appreciate the most in Microsoft Defender for Office 365 is anti-impersonation.

I find anti-impersonation to be a smart technology that uses AI and detects anti-impersonation emails.

I also appreciate the threat tracker, which gives good insight into the threats and allows for exploring them.

My impression of the visibility into threats that Microsoft security solution provides is that they are working on it, getting better at it, and showing more and more visibility, which is positive.

I think there can be improvement in prediction, specifically more prediction capabilities.