Microsoft 365 security features depend on your subscription, account type, and assigned permissions. Work or school accounts use organization-managed alerts in the Microsoft Defender portal; personal Microsoft accounts have a separate sign-in activity review and recovery process. An alert is a reason to investigate, not proof by itself that an attacker succeeded.
Which Microsoft 365 security features does a subscription include?
There is no single security feature set shared by every Microsoft 365 subscriber. Alert policies are available to the enterprise and government organizations Microsoft lists, while some advanced alert features require Microsoft 365 E5 or G5, or specific qualifying add-ons. Eligibility depends on the base plan and add-on combination, so check the current alert-policy requirements for your organization rather than assuming every plan includes advanced alerts.
As an Amazon Associate I earn from qualifying purchases.
Microsoft Entra licensing is a separate consideration. Capabilities such as identity risk policies, risk reports and notifications, and MFA registration policies have their own licensing distinctions. Microsoft describes security defaults as available to all customers, but that does not make every advanced identity feature available on every tier. See Microsoft Entra identity protection licensing and confirm the tenant’s exact plan before relying on a particular capability.
Recommended Free Tools
Where do work or school account alerts appear?
Organization alerts are generated when activity matches an enabled alert policy. Administrators review and filter them in the Microsoft Defender portal, where they can also assign a status or dismiss an alert after addressing the underlying issue. Depending on the policy, an administrator can configure email notifications for selected recipients; the policy may also have a daily notification limit.
#1 Best Overall
- Designed for Your Windows and Apple Devices | Install premium Office apps on your Windows laptop, desktop, MacBook or iMac. Works seamlessly across your devices for home, school, or personal productivity.
- Includes Word, Excel, PowerPoint & Outlook | Get premium versions of the essential Office apps that help you work, study, create, and stay organized.
- 1 TB Secure Cloud Storage | Store and access your documents, photos, and files from your Windows, Mac or mobile devices.
- Premium Tools Across Your Devices | Your subscription lets you work across all of your Windows, Mac, iPhone, iPad, and Android devices with apps that sync instantly through the cloud.
- Easy Digital Download with Microsoft Account | Product delivered electronically for quick setup. Sign in with your Microsoft account, redeem your code, and download your apps instantly to your Windows, Mac, iPhone, iPad, and Android devices.
Microsoft says a newly created or updated alert policy can take up to 24 hours to synchronize before it can trigger alerts. Default policy examples cover administrator privilege assignments, malware, phishing, unusual file deletion, and external sharing. Some defaults are enabled automatically, but availability depends on the organization’s plan and add-ons. Some policies combine several events or entities into one alert.
Alert visibility and controls depend on assigned roles as well as licensing. Microsoft documents separate permissions for reading and managing alerts and recommends granting only the access needed. If the alert page is missing or a control is disabled, ask your Microsoft 365 administrator to check your role and the tenant’s licensing before treating it as a malfunction. See permissions for Microsoft Defender for Office 365.
What does an alert mean, and what happens next?
An alert flags activity that meets a policy’s conditions; it does not automatically establish that an attack succeeded. Review the alert’s details and the associated activity, then follow your organization’s incident process. Avoid dismissing it until the underlying issue has been addressed.
For organizations licensed for Defender for Office 365 Plan 2, certain alerts can start automated investigation and response (AIR). Triggers can include suspicious email, zero-hour auto purge, user submissions or clicks, and suspicious mailbox behavior. AIR produces findings and recommended actions; authorized security staff review, prioritize, and respond, and permissions determine who can start investigations or approve or reject recommendations. Microsoft describes alerts, investigations, and outcomes together on the Incidents page, where an incident groups correlated alerts and related data. Details are in Microsoft’s automated investigation and response overview.
Rank #3
- FIDO2 CERTIFIED: FIDO Alliance Certified FIDO2 v2.1 and CTAP Level 1 for 2FA and MFA on Google Microsoft Apple GitHub login.gov AGOV SwissID and any WebAuthn service
- PASSKEY READY: Works as a hardware passkey for passwordless sign-in where the service enables it and as a U2F and WebAuthn security key everywhere else
- CERTIFIED SECURITY: NXP JCOP 4.5 secure element rated Common Criteria EAL6+ (augmented)
- TAP OR INSERT: Dual NFC ISO 14443 and contact ISO 7816 interface in an ID-1 format smart card that is passive and battery-free
- BUILT TO LAST: Passive smart card made in Switzerland designed by Swiss company Cryptnox and backed by a 2 year manufacturer warranty
How are personal Microsoft account alerts different?
A personal Microsoft account is not managed through an organization’s Defender alert workflow. Microsoft may send email or SMS notices about sign-in attempts from a new location or device. A trip or newly installed app can also prompt a verification step, so a notice is a cue to check rather than conclusive evidence of compromise.
- Open Microsoft’s Recent activity page by navigating to it directly, not through a link in an unexpected message.
- Review the listed sign-ins. If an activity was not yours, use the page’s option to report it as not yours and follow the account-security prompts.
- If Microsoft blocks a sign-in, follow the on-screen steps to receive and enter a security code.
Microsoft identifies [email protected] as the sender for the account-security messages described in its unusual sign-in guidance. Sender details alone do not prove a message is genuine; checking activity by going to the account directly is the safer route.
Rank #4
- STREAMLINED & INTUITIVE UI, DVD FORMAT | Intelligent desktop | Personalize your experience for simpler efficiency | Powerful security built-in and enabled.
- OEM IS TO BE INSTALLED ON A NEW PC with no prior version of Windows installed and cannot be transferred to another machine.
- OEM DOES NOT PROVIDE SUPPORT | To acquire product with Microsoft support, obtain the full packaged “Retail” version.
- PRODUCT SHIPS IN PLAIN ENVELOPE | Activation key is located under scratch-off area on label.
- GENUINE WINDOWS SOFTWARE IS BRANDED BY MIRCOSOFT ONLY.
How does MFA help protect an account?
Multifactor authentication (MFA) requires two or more verification methods. Microsoft gives examples such as a password plus a phone approval, a code, or a passkey. An organization can require people to register an additional method at sign-in and can control which methods are available. Follow your organization’s policy or Microsoft’s MFA setup guidance for the account you are protecting.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallA physical FIDO2 security key is one possible sign-in factor, not a universal requirement. Check Microsoft’s current support information and your organization’s policy before choosing one; compatibility depends on account and tenant configuration.
Quick Recap
Best Value
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
