Microsoft Defender for Office 365

Microsoft's email and collaboration security service for Microsoft 365, documented across built-in cloud mailbox protection, Defender for Office 365 Plan 1 and Plan 2, and Microsoft Defender XDR.

AI capabilities recorded

• Threat Classification

  Active · verified 2026-09-09

  Microsoft documents a threat classification system in Defender for Office 365 that uses large language models, small language models and machine learning models to automatically categorise email-based threats by intent and attack nature. The record covers classification only, not the separate protection mechanisms that act on a verdict.