AD0.3 The M365 Security Stack You Already Have

The naming chaos

Microsoft’s security product naming has gone through enough changes that keeping track of it has become a discipline in itself. Azure Active Directory became Entra ID. Office 365 ATP became Defender for Office 365. Microsoft Defender ATP became Defender for Endpoint. Windows Defender became Microsoft Defender Antivirus. Azure Security Center merged with Azure Defender to become Defender for Cloud. If you find the naming confusing, you’re in good company — so does everyone else, including Microsoft’s own documentation teams, who sometimes use old and new names on the same page.

For practical purposes, here’s what matters. The security stack is organised around what it protects, not what it’s called. There are tools that protect identity (Entra ID, with its conditional access and MFA capabilities). There are tools that protect email (Defender for Office 365, with its anti-phishing policies, Safe Links, and Safe Attachments). There are tools that protect endpoints (Defender for Endpoint, with its antivirus, EDR, and attack surface reduction). There are tools that protect data (Purview, with its sensitivity labels and DLP policies). And there are tools that tie everything together for monitoring and investigation (the Defender XDR portal, and optionally Microsoft Sentinel for SIEM).

You don’t need to know every product name or every feature. You need to know which ones are in your license, which ones protect against the attacks you’re most likely to face, and which ones require configuration beyond the defaults. That’s what this subsection covers.

Checking your license with PowerShell

The portal shows your licenses, but PowerShell gives you the programmatic detail that tells you exactly which security features are available. Run these commands to build your license inventory:

1
2
3

Connect-MgGraph -Scopes "Organization.Read.All"
Get-MgSubscribedSku | Select-Object SkuPartNumber, ConsumedUnits,
    @{N="Total";E={$_.PrepaidUnits.Enabled}} | Format-Table -AutoSize

Look for these SKU part numbers in the output:

SPE_E3 — Microsoft 365 E3 (includes Entra ID P1, Defender for Office 365 P1, Intune, basic Purview). SPE_E5 — Microsoft 365 E5 (adds Entra ID P2, Defender for Endpoint P2, Defender for Identity, Defender for Cloud Apps). AAD_PREMIUM — Entra ID P1 standalone add-on. AAD_PREMIUM_P2 — Entra ID P2 standalone add-on.

If you see SPE_E3 with 210 consumed units, your entire organisation is on E3 and every feature taught in this course is available without additional licensing. If you see a mix of SPE_E3 and SPE_E5, check which users have which license — you may have E5 on admin accounts and E3 on everyone else, which gives you P2 risk-based policies for admins while the rest of the tenant uses E3 capabilities.

To check a specific user’s license:

1
2

Get-MgUserLicenseDetail -UserId "admin@northgateeng.com" |
    Select-Object SkuPartNumber | Format-Table

This is the definitive answer to “do we have X feature?” — not the portal, not Microsoft documentation, not a sales rep. Your license assignment determines what’s available.

What E3 gives you — and what’s actually turned on

M365 E3 is the most common enterprise license tier for organisations that aren’t security-focused. It includes a substantial set of security tools, but the default configuration uses almost none of them effectively.

Entra ID P1 is included in E3. This gives you conditional access — the policy engine that controls who can access what, from where, on which devices. It also gives you full MFA capabilities beyond security defaults, self-service password reset, and application proxy for publishing on-premises apps. By default, none of these are configured. Security defaults provide basic MFA, but conditional access policies require manual creation.

Exchange Online Protection (EOP) is included in every M365 subscription, not just E3. EOP provides basic email filtering — anti-malware, anti-spam, and basic anti-phishing. It catches obvious threats but misses sophisticated phishing, especially credential phishing with new domains. EOP is on by default, which is why you already catch some spam, but its default settings are not tuned for targeted attacks.

Defender for Office 365 Plan 1 is included in E3. This adds Safe Links (URL rewriting and click-time scanning) and Safe Attachments (sandboxed attachment detonation). These are powerful protections against phishing links and malicious documents, and they’re the single biggest upgrade over EOP’s basic filtering. By default, Safe Links and Safe Attachments require policy configuration — they’re not active until you create and assign policies.

Intune is included in E3 for device management. From a security perspective, Intune’s value is device compliance policies — rules that check whether devices meet security standards (encrypted, up to date, antivirus running) — and the integration with conditional access that blocks non-compliant devices from accessing corporate data. By default, no compliance policies exist.

Purview Information Protection provides basic sensitivity labels in E3. You can classify documents as Confidential, Internal, or Public and apply protection (encryption, access restrictions) based on the label. By default, no labels are configured.

What’s turned on by default — the dangerous assumptions

The most dangerous aspect of M365’s security model is that it gives you a false sense of coverage. When you look at your license, you see “Defender for Office 365” and assume email is protected. When you see “Entra ID P1” you assume identity is secure. When you see “Intune” you assume devices are managed. But “included in the license” and “configured and active” are two very different things.

Here’s what’s actually running with a default M365 E3 configuration. Security defaults are enabled, which means users are prompted for MFA registration and MFA is required for admin actions and when Microsoft detects a risky sign-in. EOP is filtering email at a basic level — catching known malware and obvious spam. Microsoft Defender Antivirus is running on Windows endpoints with default settings. That’s it.

Here’s what’s not running. No conditional access policies beyond security defaults. No Safe Links or Safe Attachments policies (even though Defender for Office 365 P1 is in your license). No device compliance policies in Intune. No sensitivity labels on documents. No audit log review process. No sign-in log monitoring. No Secure Score tracking. No incident response procedure.

The gap between “included” and “active” is where most M365 breaches happen. The attacker doesn’t need to find a vulnerability — they just need to find the control that’s included in the license but never configured. And with a default E3 deployment, that’s almost every security control beyond basic MFA.

Mapping tools to threats

Rather than memorising product names, map each security tool to the threat it addresses. This makes the product landscape immediately practical.

When an attacker tries to log in with stolen credentials, Entra ID with conditional access is what stops them. Conditional access checks the device, the location, the risk level, and the authentication method. If any of those conditions fail, the sign-in is blocked — even if the password and MFA are correct. This is your primary defense against credential-based attacks, which account for the vast majority of M365 compromises.

When an attacker sends a phishing email with a malicious link, Defender for Office 365 is what catches it. Safe Links rewrites URLs and checks them at click time — so even if a URL was clean when the email arrived, Safe Links catches it if the destination becomes malicious later. Safe Attachments opens attachments in a sandbox and checks for malicious behaviour before delivering them to the user’s inbox. These controls dramatically reduce the volume of phishing that reaches users.

When an attacker gains access and tries to download files from SharePoint or forward email externally, Purview DLP and session controls are what limit the damage. Conditional access can restrict a risky session to browser-only access with no downloads. DLP policies can block sensitive files from being shared externally. These are your last-line controls — they contain the blast radius when the identity and email controls fail.

When something goes wrong and you need to understand what happened, the Defender XDR portal is where you investigate. It correlates alerts across identity, email, and endpoint into unified incidents, shows you the timeline of what the attacker did, and provides response actions (isolate a device, revoke a session, quarantine an email). You won’t use this daily, but when you need it, you need to know where it is and how to read it.