- Every Microsoft 365 business plan filters spam, malware and spoofed email. Business Premium adds Defender for Office 365 Plan 1, with Safe Links and Safe Attachments.
- Microsoft's phishing simulator, Attack simulation training, needs Defender for Office 365 Plan 2 or Microsoft 365 E5. Business Premium doesn't include it as standard.
- The built-in Report button in Outlook works on every plan with Exchange Online, but an admin has to set it up and decide who sees the reports.
- Filters stop email. Only practice teaches people to handle what gets through, including scams with no link at all.
Microsoft 365 protects small businesses well at the filter level, but it doesn't train your staff unless you pay for more. As of November 2026, Microsoft's phishing simulations (Attack simulation training) need Microsoft Defender for Office 365 Plan 2 or Microsoft 365 E5, which most small businesses on Business Basic, Standard or Premium don't have. So you'll usually need to add regular practice yourself, whether through a Plan 2 add-on or another tool.
Below is what Microsoft's own documentation says each plan includes. Licences change often, so treat this as a starting point and check your licence before you buy anything.
What does each Microsoft 365 business plan include for phishing?
Microsoft describes email security in Microsoft 365 as a ladder with three rungs, and your licence decides which rung you're on.
- Built-in protection for all cloud mailboxes. Every plan with Exchange Online mailboxes gets anti-spam, anti-malware and anti-spoofing filtering, quarantine, and user reporting. Microsoft says this layer stops broad, volume-based, known attacks. Business Basic and Business Standard sit here.
- Defender for Office 365 Plan 1. Microsoft's service description says Plan 1 is included in Microsoft 365 Business Premium. It adds protection against new (zero-day) phishing and malware, impersonation protection, Safe Links and Safe Attachments.
- Defender for Office 365 Plan 2. Included in enterprise plans such as Microsoft 365 E5. It adds Attack simulation training plus investigation, hunting and automated response tools.
Microsoft also sells Defender for Office 365 as an add-on to many subscriptions, so a Business Standard or Business Premium organisation can buy its way up. Details are in the Defender for Office 365 service description. To see what you actually have, open the Your products page in the Microsoft 365 admin center.
Safe Links and Safe Attachments, in plain English
Safe Links checks a link when someone clicks it, not just when the email arrives, so a page that turns malicious after delivery can still be blocked. Safe Attachments opens attachments in a safe, isolated environment to see what they do before they reach the inbox. Both are part of Plan 1, so they're in Business Premium but not in Basic or Standard unless you add Defender.
They only work on links and files, though. A message that simply asks your accounts person to update a supplier's bank details has nothing for them to check.
Is Attack simulation training included in Microsoft 365 Business Premium?
No, not as standard: Microsoft's documentation says Attack simulation training requires a Microsoft 365 E5 or Defender for Office 365 Plan 2 licence, and Business Premium includes Plan 1.
Attack simulation training lives in the Microsoft Defender portal under Email and collaboration > Attack simulation training. It sends harmless practice phishing emails (credential harvesting, malicious attachments, links in attachments, QR codes and more), assigns training to people who click, and reports who reported, opened or entered details. It can also run training-only campaigns without a simulation. You can read Microsoft's overview in Get started using Attack simulation training.
If you're on Business Premium or Business Standard and want to try it, you have three routes:
- The free trial. Microsoft offers a 90-day Defender for Office 365 Plan 2 trial from the trials page in the Defender portal. For Business Premium organisations, the Plan 2 extras, including simulations, stop after 90 days. Microsoft says an organisation can use the trial at most twice.
- A Plan 2 add-on. Ask your Microsoft partner or reseller for current pricing.
- A separate training tool that works alongside Microsoft 365.
How do staff report phishing in Outlook?
Microsoft provides a built-in Report button in Outlook that lets staff report phishing, junk, and good email wrongly sent to Junk, on every Microsoft 365 plan with Exchange Online mailboxes.
For staff, it's two clicks: select the message, select Report, then choose Report phishing (or Report junk). In the Junk Email folder, the same button offers Not junk. A message reported as phishing is deleted from the mailbox; one reported as junk moves to Junk Email and the sender is blocked.
According to Microsoft's guide to reporting phishing in Outlook, the button appears in recent versions of Outlook for Microsoft 365, the new Outlook for Windows, Outlook on the web, and Outlook for Mac, iOS and Android. It only shows when user reporting is on and the built-in Report button is selected in your settings. If someone can't see it, the first check is their Outlook version.
Who sees the reports?
Admins choose whether reports go to Microsoft, to a reporting mailbox, or both. Microsoft's default is both, and if nobody has picked a reporting mailbox, reports go to the global admin's mailbox. In a small business that's often the owner, or an IT provider who never checks it. Reports also appear on the User reported tab of the Submissions page in the Defender portal.
The settings live in the Microsoft Defender portal at Settings > Email & collaboration > User reported settings. Microsoft recommends setting up the reporting mailbox as a SecOps mailbox in the advanced delivery policy so reports arrive unfiltered. That matters even more if you run phishing simulations. On Gmail? See our guide to reporting phishing in Gmail and Google Workspace.
What's built into Microsoft 365, and what isn't?
This table sums up what a typical small business on Business Basic, Standard or Premium gets, as of November 2026. Check your licence, because Microsoft updates its plans.
| Need | Built into Microsoft 365? | Notes |
|---|---|---|
| Spam, malware and spoofing filters | Yes, all plans | Built-in protection for every cloud mailbox. |
| Safe Links, Safe Attachments, impersonation protection | Business Premium (Defender Plan 1) | Basic and Standard need a Defender add-on. |
| MFA for everyone | Yes, free | Security defaults. Conditional Access needs Entra ID P1. |
| A Report button in Outlook | Yes, all plans with Exchange Online | An admin sets it up and chooses where reports go. |
| Practice phishing emails | Only with Plan 2 or E5 | Not in Business Premium as standard. 90-day trial available. |
| Regular hands-on staff training | Only with Plan 2 or E5 | Training campaigns are part of Attack simulation training. |
| Practice with calls, voice clones and pushy “suppliers” | No | Simulations focus on email-based techniques. |
| A reporting culture | No | Comes from how you respond to reports and mistakes. |
| Evidence of training for insurers or customers | Partly, with Plan 2 | Otherwise you'll need your own records. |
What does a small team still need beyond Microsoft 365?
Even with the best licence, a small team needs four things that settings alone can't supply.
- Regular, short practice. A yearly video fades. A few minutes each month keeps the habits fresh, and it works best when a click leads to a quick, friendly lesson rather than a telling-off. Our guide to security awareness training for small businesses covers what good looks like.
- Conversation skills. The costliest scams often aren't a single email. They're a back-and-forth: a “supplier” who pushes back when questioned, or a caller who sounds like your director. Staff need to practise saying “I'll call you back on the number we have” under pressure. See invoice fraud and payment diversion and the glossary entry on pretexting.
- A reporting culture. The Report button only helps if people press it. Thank everyone who reports, including false alarms, and treat a click as a learning moment. People who fear blame hide mistakes.
- Simple evidence. If an insurer, customer or assessor asks how you train staff, a dated record of who trained and how they did is far easier than “we mentioned it in a meeting”. Our Cyber Essentials staff training guide explains how training fits alongside the technical controls.
A checklist for Microsoft 365 admins
If you look after Microsoft 365 for a small business, these eight steps cover the basics in an afternoon.
- Check your licence. Open Your products in the Microsoft 365 admin center and note whether you have Defender for Office 365 Plan 1, Plan 2, or neither.
- Turn on MFA for everyone. Microsoft's free security defaults require every user to register for MFA and block older sign-in methods. They're on by default for new tenants. Check in the Microsoft Entra admin center under Entra ID > Overview > Properties > Manage security defaults. If your licence includes Entra ID P1, Microsoft suggests Conditional Access instead.
- Switch on Safe Links and Safe Attachments if you're on Business Premium. Microsoft's Standard preset security policy is the simplest way to apply sensible settings.
- Enable the built-in Report button in User reported settings in the Defender portal.
- Decide who receives reports. Set a reporting mailbox that a named person checks every working day, and make it a SecOps mailbox in the advanced delivery policy.
- Tell staff how to report, in one short message, and thank the first few people who do.
- Run monthly practice. Attack simulation training if you have Plan 2, or another tool if you don't. Our free security training lessons are a no-cost start.
- Keep a record of who trained, when, and how they did.
Where Lureproof fits for Microsoft 365 teams
Lureproof is security awareness training built for teams of 5–50, and it works alongside Microsoft 365 rather than replacing anything in it. Today, Microsoft 365 teams can use the monthly hands-on assessment (about 15 minutes, covering inbox triage, lookalike links, fake login pages, a voice deepfake and a pre-scripted live chat with a “supplier” changing bank details), weekly 60-second drills, and a leaderboard that rewards spotting and reporting scams and never names clickers. You set it up by verifying your domain and importing a CSV or Excel staff list.
To be clear about what isn't ready yet: native Microsoft 365 directory sync and practice phishing emails for Microsoft 365 are coming soon. The current state is on our integrations page. Plans start free for up to five people, and the assessment, drills and leaderboard are on the Team and Business plans.
FAQ
Does Microsoft 365 Business Premium include Attack simulation training?
Not as standard, as of November 2026. Microsoft's documentation says Attack simulation training needs Microsoft 365 E5 or Microsoft Defender for Office 365 Plan 2, and Business Premium includes Plan 1. You can try Plan 2 free for 90 days or add it to many subscriptions. Check your own licence, as Microsoft's plans change.
How do I report a phishing email in Outlook?
In a supported version of Outlook, select the message, select Report, then choose Report phishing. If you can't see the Report button, ask your Microsoft 365 admin to turn on the built-in Report button in the User reported settings in the Microsoft Defender portal.
Where do reported phishing emails go in Microsoft 365?
Admins choose whether reports go to Microsoft, to a reporting mailbox, or both. Microsoft's default is both, and the default reporting mailbox is the global admin's mailbox until you set another one. Admins can review reports on the User reported tab of the Submissions page in the Microsoft Defender portal.
Do I need phishing training if I already have Microsoft 365?
Usually, yes. Microsoft 365 filters a lot of bad email, but no filter catches everything, and some scams, such as a fake supplier asking to change bank details, contain no link or attachment to block. Regular, short practice helps your team spot and report what gets through.