Microsoft 365 E3 gained Defender Plan 1 in July and impersonation protection is still off by default

Microsoft 365 E3 has carried Defender for Office 365 Plan 1 since 1 July 2026. Safe Links and Safe Attachments came on for every recipient. User and domain impersonation protection did not, and applies to nobody until an administrator turns on a preset security policy or configures an anti-phishing policy.

Last verified: 2026-08-20.

What Microsoft published

The what is new page files it under July 2026: "Microsoft 365 E3 now includes Microsoft Defender for Office 365 Plan 1." The service description names the day, "included with Office 365 E3/Microsoft 365 E3 effective July 1, 2026", and a footnote adds: "User and domain impersonation protection is available with Microsoft Defender for Office 365 Plan 1."

The licence does not apply it. The preset page says "the Standard and Strict preset security policies are assigned to no one" until the profiles are on and users assigned, and calls the preset that runs by itself "default threat policies for Safe Links and Safe Attachments only". Microsoft's anti-phishing tuning guidance is blunt: impersonation protection "isn't turned on in the default anti-phishing policy, and therefore needs to be configured".

Four Microsoft pages, read 2026-08-20

Plan against the service description. The two stale pages pull opposite ways: one bills an add-on the customer owns, the other says the presets are not theirs.

The misreading that costs more

A capability arriving with a licence reads as arriving switched on. That is how Built-in protection behaves and not how anti-phishing behaves. What runs meanwhile observes and does not act: the recommended settings page lists targeted user protection not selected, mailbox intelligence protection off, no action on an impersonation verdict, threshold at level 1 while Standard sets 3 and Strict sets 4. Safe Links and Safe Attachments never touch this mail: display-name impersonation of a director or a supplier is plain text, no link to rewrite, no attachment to detonate. Asked later who is covered and since when, that administrator has a licence statement and no preset rule to enumerate.

flowchart TD
  accTitle: Deciding whether impersonation protection covers anyone in an E3 tenant
  accDescr: A tree from what the portal renders, through the preset rule state, to whether a policy supplies impersonation protection, ending at Act now, Schedule or Monitor.
  A[Defender portal, Email and collab] -->|neither renders| B[Not entitled, stop]
  A -->|Explorer| C[Plan 2, already licensed]
  A -->|Real-time detections| D[Plan 1, the E3 case]
  C --> E{Preset rule for Standard or Strict exists}
  D --> E
  E -->|no rule| F{Any anti-phishing policy supplies it}
  E -->|exists, State Disabled| F
  E -->|exists, State Enabled| G{Scope covers who gets impersonated}
  F -->|no| H[Act now, protection applies to nobody]
  F -->|yes| I[Monitor, supplied by policy not preset]
  G -->|partial| J[Schedule, widen scope or sender list]
  G -->|yes| I
  A -.-> K[Safe Links still covers everyone]

Prerequisites

Global Reader, which the preset page names for "Read-only access to preset security policies". Every command below is a Get command, and the same page limits Global Administrator to emergencies. Read entitlement off what the portal renders, not a licence label: Microsoft calls Real-time detections "a quick way to differentiate between Defender for Office 365 Plan 1 and Plan 2".

The read-only check

Connect-ExchangeOnline

# 1. Standard and Strict on at all? No -Identity: a bad name returns all.
Get-ATPProtectionPolicyRule | Format-Table Name,State
Get-EOPProtectionPolicyRule | Format-Table Name,State

# 2. If a rule exists, who does it reach?
Get-ATPProtectionPolicyRule | Format-List Name,State,SentTo,SentToMemberOf,RecipientDomainIs

# 3. Built-in protection. Everyone, or carved out?
Get-ATPBuiltInProtectionRule | Format-List Name,State,ExceptIfSentTo,ExceptIfRecipientDomainIs

# 4. What the presets alone do not settle.
Get-AntiPhishPolicy | Format-List Name,IsDefault,EnableTargetedUserProtection,TargetedUsersToProtect,EnableTargetedDomainsProtection,TargetedDomainsToProtect,EnableOrganizationDomainsProtection,EnableMailboxIntelligenceProtection,PhishThresholdLevel

Disconnect-ExchangeOnline -Confirm:$false

Expected output

Step 1 returning no rows is the finding, not an error: "If you never turned on the preset security policy, the associated rules don't exist." Step 3 should return the rule Microsoft documents as the only one, ATP Built-In Protection Rule, which the cmdlet reference says "is always enabled", with no exceptions unless recipients were carved out. (Also add that URL to the front-matter citations and to Public citations as "Get-ATPBuiltInProtectionRule", and delete the second bullet under "Needs founder evidence and fact-confirmation".) Step 4 decides: an untouched default policy returns EnableTargetedUserProtection, EnableTargetedDomainsProtection, EnableOrganizationDomainsProtection and EnableMailboxIntelligenceProtection all False, TargetedUsersToProtect and TargetedDomainsToProtect empty, and PhishThresholdLevel 1. That, with no enabled preset rule, is where impersonation protection applies to nobody. A True closes the gap only where its paired list is populated: Microsoft pairs EnableTargetedUserProtection with TargetedUsersToProtect and EnableTargetedDomainsProtection with TargetedDomainsToProtect, and owned domains come from the separate switch EnableOrganizationDomainsProtection, so a True over an empty list protects nobody and is still a finding.

Side effects

None to the configuration. Every command is a Get command, no policy is created, and reading the rules does not bring a preset into existence. The sign-in and cmdlet activity land in the tenant audit trail.

Rollback

Nothing to roll back, because nothing changed. For the remediation that follows: "Turning off the preset security policy doesn't delete the associated rules." Switched off, the rule stays at State Disabled, so scope and sender list survive re-enabling. An anti-phishing policy has no equivalent switch, so capture its property set from step 4 first.

Limitations

The check proves what the presets and policies are set to. It does not prove a protection works. An enabled preset is not coverage either: the rule carries recipient conditions, which is why step 2 reads the scoping properties and not the State. Even fully enabled it is a named-sender list, capped on the preset page at "a maximum of 350 users" and "a maximum of 50 custom domains" beyond owned domains and mailbox intelligence, so the impersonated executive can be unlisted while every toggle reads On. The same page records that "User impersonation protection doesn't work if the sender and recipient previously communicated via email", the compromised-supplier case.

Absence of an enabled preset is not itself a finding, which is why step 4 exists: the default policy can be modified and custom policies created, and either supplies the protection. The cmdlets are cloud only. The entitlement read here names Office 365 E3 and Microsoft 365 E3 only, with no mention of G3, and the navigation test works at tenant level, not per user.

The decision

Decision: Act now, on the read. No deadline forces it, since no page read here publishes an end date for the E3 inclusion. A live default does: since 1 July 2026 a tenant that never turned a preset on has had impersonation protection applied to nobody, and nothing announces that. Act now where no preset rule is enabled and no policy supplies the protection; Schedule where a preset is enabled but its scope or sender list misses the people who get impersonated; Monitor where it is supplied and scoped.

For an independent reading of that state and a dated record, the Microsoft Defender XDR implementation service is the internal path.