Most Microsoft 365 tenants configure Safe Links and Safe Attachments like they're one setting. Safe Links rechecks every clicked URL for as long as a message exists. Safe Attachments checks a file once, at delivery, then stops. For security architects running Defender for Office 365, this covers where each control's coverage ends, a real Teams misconfiguration that let a phishing link through, and the checklist to close both gaps.

Email is still the top entry point for ransomware, BEC, and credential theft. Architects choosing between Exchange Online Protection, Defender for Office 365 Plan 1, and Plan 2 have to answer one question: which tier, at what licensing cost, gets the organization to a defensible posture. This article covers what each tier does, the cost-of-breach math, and the 5 questions that decide Plan 1 versus Plan 2.