(Updated) 2026 Microsoft 365 Packaging Update

Message ID

MC1304290

Services

Exchange OnlineMicrosoft IntuneMicrosoft Defender XDR

Summary

The 2026 Microsoft 365 Packaging Update, rolling out mid-June to early August, adds enhanced security features like Microsoft Defender Plan 1, URL time-of-click protection, Intune improvements, and +50GB Exchange Online storage. Microsoft 365 Business SKU backfill completes by September 30. Admins should review and configure new policies.

Details

Updated June 22, 2026: We have updated the timeline. For Microsoft 365 Business SKUs, backfill completion is now expected by September 30 for Microsoft 365 Business SKUs. All other details for all other SKUs in the original communication remain unchanged. Thank you for your patience.

[Introduction]

As a part of the 2026 Microsoft 365 Packaging and Pricing Update, we're excited to share that the following features will begin to roll out to Microsoft 365, Office 365, and Enterprise Mobility and Security (EMS) suites in mid-June and are expected to be complete by August 1, 2026.

Refer to the licensing blog for feature availability by suite. Government and Commercial packaging changes are listed separately.

Microsoft Defender for Office 365 Plan 1: Protection against advanced phishing and malware
URL time-of-click protection: Scans URLs at time of click to prevent access to malicious websites
Intune Remote Help: Secure remote support for devices
Intune Advanced Analytics: Insights to improve user experience
Intune Plan 2: Tunnel for MAM, FOTA, and specialty device management
Intune Endpoint Privilege Management: Supports least-privilege access
Microsoft Cloud PKI: Cloud-based certificate lifecycle management
Intune Enterprise Application Management: Enterprise App Catalog of Win32 applications with preconfigured deployment settings.
Exchange Online: +50GB email storage

Refer to list of service display names affected below:

Display Name	Part Number
Microsoft 365 built-in email and collaboration security (URL time-to-click protection)	MDOLITE_ENTERPRISE
Microsoft Defender for Office 365 (Plan 1)	ATP_ENTERPRISE
Exchange Online Storage (50GB additional)	EXCHANGE_STORAGE_50GB
Remote Help	REMOTE_HELP
Microsoft Intune Advanced Analytics	Intune_AdvancedEA
Intune Plan 2	INTUNE_P2
Intune ServiceNow Integration	Intune_ServiceNow
Microsoft Tunnel for Mobile Application Management	Intune-MAMTunnel
Intune Enterprise Application Management	3_PARTY_APP_PATCH
Intune Endpoint Privilege Management	Intune-EPM
Microsoft Cloud PKI	CLOUD_PKI

[When this will happen:]

We will begin rolling out in mid-June 2026 and expect to complete by early August 2026.

[How this affects your organization:]

Who is affected:

Refer to the licensing blog for feature availability by suite
Organizations using Microsoft 365, Office 365, and EMS suites
Microsoft 365 admins responsible for security and device management
Users receiving enhanced protections and increased mailbox storage

What will happen:

For Microsoft Defender features:

Built-in protection policy (Safe Links, Safe Attachments), anti-phishing protections, and URL time-of-click protection will be applied to all users by default
Policies cannot be disabled but can be supplemented or overridden
New alerts may appear in the Microsoft Defender portal

For Microsoft Intune features:

Intune features are not configured by default

For Exchange Online:

Exchange Online storage increases by +50GB

[What you can do to prepare:]

For Microsoft Defender features:

Review the Built-in Protection policy in the Microsoft Defender portal.
Add exclusions by user, group, or domain, if needed.
Consider enabling standard or strict preset security policies.
Review mail flow and configure enhanced filtering if using a third-party gateway.

For Microsoft Intune features:

Refer to the MS Learn documentation hyperlinked in the Intro section of this post.

Learn more:

[Compliance considerations:]

Area	Explanation
Does the change store new customer data?	Microsoft Defender and Intune features may generate and store additional security telemetry, alerts, and device analytics data as part of normal service operation.
Does the change alter how existing customer data is processed, stored, or accessed?	Microsoft Defender enhancements introduce additional scanning and analysis of email content and URLs, including time-of-click protection, increasing inspection of existing data for threat detection.
Does the change introduce or significantly modify AI/ML capabilities?	Microsoft Defender for Office 365 uses machine learning to detect phishing, malware, impersonation, and zero-day threats, and these capabilities are expanded through this rollout.
Does the change alter how admins can monitor, report on, or demonstrate compliance activities?	New alert types and threat detection insights will appear in the Microsoft Defender portal, impacting security monitoring and reporting.
Does the change add any integration to 3rd party software products?	Intune ServiceNow integration is included.
Does the change include an admin control and can it be controlled through Entra ID group membership?	Admins can configure Defender and Intune policies and apply settings using user and group-based assignments.

Change History

Show

Published: May 8, 2026

Last Updated: June 22, 2026

June 23, 2026 at 12:30 AM Updated

Summary

Starting mid-June 2026, Microsoft 365, Office 365, and EMS suites will receive enhanced security features like Microsoft Defender Plan 1, URL time-of-click protection, Intune improvements, and +50GB Exchange Online storage. Rollout completes by August 1, 2026, with new alerts and policy controls for admins.

New

Last Updated Date

2026-05-20T18:09:54.273Z

New

2026-06-22T22:30:30.753Z

Body Content

Updated May 20, 2026: Organizations using Microsoft 365 operated by 21Vianet can safely disregard this message.[Introduction] As a part of the <a href="https://www.microsoft.com/microsoft-365/blog/2025/12/04/advancing-microsoft-365-new-capabilities-and-pricing-update/" target="_blank">2026 Microsoft 365 Packaging and Pricing Update</a>, we're excited to share that the following features will begin to roll out to Microsoft 365, Office 365, and Enterprise Mobility and Security (EMS) suites in mid-June and are expected to be complete by August 1, 2026.Refer to the <a href="https://www.microsoft.com/licensing/news/2026-M365-Packaging-Pricing-Updates" target="_blank">licensing blog</a> for feature availability by suite. Government and Commercial packaging changes are listed separately.<ul><li><a href="https://learn.microsoft.com/office365/servicedescriptions/office-365-advanced-threat-protection-service-description" target="_blank">Microsoft Defender for Office 365 Plan 1</a>: Protection against advanced phishing and malware</li> <li>URL time-of-click protection: Scans URLs at time of click to prevent access to malicious websites</li> <li><a href="https://learn.microsoft.com/intune/intune-service/fundamentals/remote-help" target="_blank">Intune Remote Help</a>: Secure remote support for devices</li> <li><a href="https://learn.microsoft.com/intune/advanced-analytics/" target="_blank">Intune Advanced Analytics</a>: Insights to improve user experience</li> <li>Intune Plan 2: <a href="https://learn.microsoft.com/intune/device-security/microsoft-tunnel/mam" target="_blank">Tunnel for MAM</a>, <a href="https://learn.microsoft.com/intune/device-updates/android/setup-zebra-lifeguard" target="_blank">FOTA</a>, and <a href="https://learn.microsoft.com/intune/device-management/specialty-devices" target="_blank">specialty device management</a></li> <li><a href="https://learn.microsoft.com/intune/intune-service/protect/epm-overview" target="_blank">Intune Endpoint Privilege Management</a>: Supports least-privilege access</li> <li><a href="https://learn.microsoft.com/mem/intune/protect/microsoft-cloud-pki-overview" target="_blank">Microsoft Cloud PKI</a>: Cloud-based certificate lifecycle management</li> <li><a href="https://learn.microsoft.com/mem/intune/apps/apps-enterprise-app-management" target="_blank">Intune Enterprise Application Management</a>: Enterprise App Catalog of Win32 applications with preconfigured deployment settings.</li> <li>Exchange Online: +50GB email storage</li> </ul> Refer to list of service display names affected below: <table> <tbody><tr> <th>Display Name</th> <th>Part Number</th> </tr> <tr> <td>Microsoft 365 built-in email and collaboration security (URL time-to-click protection)</td> <td>MDOLITE_ENTERPRISE</td> </tr> <tr> <td>Microsoft Defender for Office 365 (Plan 1)</td> <td>ATP_ENTERPRISE</td> </tr> <tr> <td>Exchange Online Storage (50GB additional)</td> <td>EXCHANGE_STORAGE_50GB</td> </tr> <tr> <td>Remote Help</td> <td>REMOTE_HELP</td> </tr> <tr> <td>Microsoft Intune Advanced Analytics</td> <td>Intune_AdvancedEA</td> </tr> <tr> <td>Intune Plan 2</td> <td>INTUNE_P2</td> </tr> <tr> <td>Intune ServiceNow Integration</td> <td>Intune_ServiceNow</td> </tr> <tr> <td>Microsoft Tunnel for Mobile Application Management</td> <td>Intune-MAMTunnel</td> </tr> <tr> <td>Intune Enterprise Application Management</td> <td>3_PARTY_APP_PATCH</td> </tr> <tr> <td>Intune Endpoint Privilege Management</td> <td>Intune-EPM</td> </tr> <tr> <td>Microsoft Cloud PKI</td> <td>CLOUD_PKI</td> </tr> </tbody></table> [When this will happen:] We will begin rolling out in mid-June 2026 and expect to complete by early August 2026.<ul> </ul> [How this affects your organization:] Who is affected: <ul> <li>Refer to the <a href="https://www.microsoft.com/licensing/news/2026-M365-Packaging-Pricing-Updates" target="_blank">licensing blog</a> for feature availability by suite</li><li>Organizations using Microsoft 365, Office 365, and EMS suites</li><li>Microsoft 365 admins responsible for security and device management</li> <li>Users receiving enhanced protections and increased mailbox storage</li> </ul> What will happen:For Microsoft Defender features: <ul><li>Built-in protection policy (Safe Links, Safe Attachments), anti-phishing protections, and URL time-of-click protection will be applied to all users by default </li><li>Policies cannot be disabled but can be supplemented or overridden </li><li>New alerts may appear in the Microsoft Defender portal</li></ul>For Microsoft Intune features:<ul> <li>Intune features are not configured by default</li></ul>For Exchange Online:<ul> <li>Exchange Online storage increases by +50GB</li></ul> [What you can do to prepare:] For Microsoft Defender features: <ul> <li>Review the Built-in Protection policy in the Microsoft Defender portal.</li> <li> Add exclusions by user, group, or domain, if needed.</li><li>Consider enabling standard or strict preset security policies.</li><li>Review mail flow and configure enhanced filtering if using a third-party gateway.</li> </ul> For Microsoft Intune features: Refer to the MS Learn documentation hyperlinked in the Intro section of this post. Learn more: <ul> <li><a href="https://www.microsoft.com/microsoft-365/blog/2025/12/04/advancing-microsoft-365-new-capabilities-and-pricing-update/?msockid=16201fadc9a16bde3e5c09afc8a76aa7" target="_blank">M365 Packaging and Pricing Update: Official Announcement Blog</a></li><li><a href="https://www.microsoft.com/licensing/news/2026-M365-Packaging-Pricing-Updates" target="_blank">M365 Packaging and Pricing Update: Licensing Blog</a></li><li><a href="https://www.microsoft.com/licensing/news/2026-M365-Packaging-Pricing-Updates-FAQ" target="_blank">M365 Packaging and Pricing Update: Public FAQs</a></li><li><a href="https://learn.microsoft.com/defender-office-365/" target="_blank">Microsoft Defender for Office 365: Security Documentation</a></li><li><a href="https://learn.microsoft.com/defender-office-365/preset-security-policies#use-the-microsoft-defender-portal-to-add-exclusions-to-the-built-in-protection-preset-security-policy" target="_blank">Microsoft Defender for Office 365: Preset Security Policies Documentation</a></li></ul>[Compliance considerations:] <table> <tbody><tr> <th>Area</th> <th>Explanation</th> </tr> <tr> <td>Does the change store new customer data?</td> <td>Microsoft Defender and Intune features may generate and store additional security telemetry, alerts, and device analytics data as part of normal service operation.</td> </tr> <tr> <td>Does the change alter how existing customer data is processed, stored, or accessed?</td> <td>Microsoft Defender enhancements introduce additional scanning and analysis of email content and URLs, including time-of-click protection, increasing inspection of existing data for threat detection.</td> </tr> <tr> <td>Does the change introduce or significantly modify AI/ML capabilities?</td> <td>Microsoft Defender for Office 365 uses machine learning to detect phishing, malware, impersonation, and zero-day threats, and these capabilities are expanded through this rollout.</td> </tr> <tr> <td>Does the change alter how admins can monitor, report on, or demonstrate compliance activities?</td> <td>New alert types and threat detection insights will appear in the Microsoft Defender portal, impacting security monitoring and reporting.</td> </tr> <tr> <td>Does the change add any integration to 3rd party software products?</td> <td>Intune ServiceNow integration is included.</td> </tr> <tr> <td>Does the change include an admin control and can it be controlled through Entra ID group membership?</td> <td>Admins can configure Defender and Intune policies and apply settings using user and group-based assignments.</td> </tr> </tbody></table>

New

Updated June 22, 2026: We have updated the timeline. For Microsoft 365 Business SKUs, backfill completion is now expected by September 30 for Microsoft 365 Business SKUs. All other details for all other SKUs in the original communication remain unchanged. Thank you for your patience.[Introduction] As a part of the <a href="https://www.microsoft.com/microsoft-365/blog/2025/12/04/advancing-microsoft-365-new-capabilities-and-pricing-update/" target="_blank">2026 Microsoft 365 Packaging and Pricing Update</a>, we're excited to share that the following features will begin to roll out to Microsoft 365, Office 365, and Enterprise Mobility and Security (EMS) suites in mid-June and are expected to be complete by August 1, 2026.Refer to the <a href="https://www.microsoft.com/licensing/news/2026-M365-Packaging-Pricing-Updates" target="_blank">licensing blog</a> for feature availability by suite. Government and Commercial packaging changes are listed separately.<ul><li><a href="https://learn.microsoft.com/office365/servicedescriptions/office-365-advanced-threat-protection-service-description" target="_blank">Microsoft Defender for Office 365 Plan 1</a>: Protection against advanced phishing and malware</li> <li>URL time-of-click protection: Scans URLs at time of click to prevent access to malicious websites</li> <li><a href="https://learn.microsoft.com/intune/intune-service/fundamentals/remote-help" target="_blank">Intune Remote Help</a>: Secure remote support for devices</li> <li><a href="https://learn.microsoft.com/intune/advanced-analytics/" target="_blank">Intune Advanced Analytics</a>: Insights to improve user experience</li> <li>Intune Plan 2: <a href="https://learn.microsoft.com/intune/device-security/microsoft-tunnel/mam" target="_blank">Tunnel for MAM</a>, <a href="https://learn.microsoft.com/intune/device-updates/android/setup-zebra-lifeguard" target="_blank">FOTA</a>, and <a href="https://learn.microsoft.com/intune/device-management/specialty-devices" target="_blank">specialty device management</a></li> <li><a href="https://learn.microsoft.com/intune/intune-service/protect/epm-overview" target="_blank">Intune Endpoint Privilege Management</a>: Supports least-privilege access</li> <li><a href="https://learn.microsoft.com/mem/intune/protect/microsoft-cloud-pki-overview" target="_blank">Microsoft Cloud PKI</a>: Cloud-based certificate lifecycle management</li> <li><a href="https://learn.microsoft.com/mem/intune/apps/apps-enterprise-app-management" target="_blank">Intune Enterprise Application Management</a>: Enterprise App Catalog of Win32 applications with preconfigured deployment settings.</li> <li>Exchange Online: +50GB email storage</li> </ul> Refer to list of service display names affected below: <table> <tbody><tr> <th>Display Name</th> <th>Part Number</th> </tr> <tr> <td>Microsoft 365 built-in email and collaboration security (URL time-to-click protection)</td> <td>MDOLITE_ENTERPRISE</td> </tr> <tr> <td>Microsoft Defender for Office 365 (Plan 1)</td> <td>ATP_ENTERPRISE</td> </tr> <tr> <td>Exchange Online Storage (50GB additional)</td> <td>EXCHANGE_STORAGE_50GB</td> </tr> <tr> <td>Remote Help</td> <td>REMOTE_HELP</td> </tr> <tr> <td>Microsoft Intune Advanced Analytics</td> <td>Intune_AdvancedEA</td> </tr> <tr> <td>Intune Plan 2</td> <td>INTUNE_P2</td> </tr> <tr> <td>Intune ServiceNow Integration</td> <td>Intune_ServiceNow</td> </tr> <tr> <td>Microsoft Tunnel for Mobile Application Management</td> <td>Intune-MAMTunnel</td> </tr> <tr> <td>Intune Enterprise Application Management</td> <td>3_PARTY_APP_PATCH</td> </tr> <tr> <td>Intune Endpoint Privilege Management</td> <td>Intune-EPM</td> </tr> <tr> <td>Microsoft Cloud PKI</td> <td>CLOUD_PKI</td> </tr> </tbody></table> [When this will happen:] We will begin rolling out in mid-June 2026 and expect to complete by early August 2026.<ul> </ul> [How this affects your organization:] Who is affected: <ul> <li>Refer to the <a href="https://www.microsoft.com/licensing/news/2026-M365-Packaging-Pricing-Updates" target="_blank">licensing blog</a> for feature availability by suite</li><li>Organizations using Microsoft 365, Office 365, and EMS suites</li><li>Microsoft 365 admins responsible for security and device management</li> <li>Users receiving enhanced protections and increased mailbox storage</li> </ul> What will happen:For Microsoft Defender features: <ul><li>Built-in protection policy (Safe Links, Safe Attachments), anti-phishing protections, and URL time-of-click protection will be applied to all users by default </li><li>Policies cannot be disabled but can be supplemented or overridden </li><li>New alerts may appear in the Microsoft Defender portal</li></ul>For Microsoft Intune features:<ul> <li>Intune features are not configured by default</li></ul>For Exchange Online:<ul> <li>Exchange Online storage increases by +50GB</li></ul> [What you can do to prepare:] For Microsoft Defender features: <ul> <li>Review the Built-in Protection policy in the Microsoft Defender portal.</li> <li> Add exclusions by user, group, or domain, if needed.</li><li>Consider enabling standard or strict preset security policies.</li><li>Review mail flow and configure enhanced filtering if using a third-party gateway.</li> </ul> For Microsoft Intune features: Refer to the MS Learn documentation hyperlinked in the Intro section of this post. Learn more: <ul> <li><a href="https://www.microsoft.com/microsoft-365/blog/2025/12/04/advancing-microsoft-365-new-capabilities-and-pricing-update/?msockid=16201fadc9a16bde3e5c09afc8a76aa7" target="_blank">M365 Packaging and Pricing Update: Official Announcement Blog</a></li><li><a href="https://www.microsoft.com/licensing/news/2026-M365-Packaging-Pricing-Updates" target="_blank">M365 Packaging and Pricing Update: Licensing Blog</a></li><li><a href="https://www.microsoft.com/licensing/news/2026-M365-Packaging-Pricing-Updates-FAQ" target="_blank">M365 Packaging and Pricing Update: Public FAQs</a></li><li><a href="https://learn.microsoft.com/defender-office-365/" target="_blank">Microsoft Defender for Office 365: Security Documentation</a></li><li><a href="https://learn.microsoft.com/defender-office-365/preset-security-policies#use-the-microsoft-defender-portal-to-add-exclusions-to-the-built-in-protection-preset-security-policy" target="_blank">Microsoft Defender for Office 365: Preset Security Policies Documentation</a></li></ul>[Compliance considerations:] <table> <tbody><tr> <th>Area</th> <th>Explanation</th> </tr> <tr> <td>Does the change store new customer data?</td> <td>Microsoft Defender and Intune features may generate and store additional security telemetry, alerts, and device analytics data as part of normal service operation.</td> </tr> <tr> <td>Does the change alter how existing customer data is processed, stored, or accessed?</td> <td>Microsoft Defender enhancements introduce additional scanning and analysis of email content and URLs, including time-of-click protection, increasing inspection of existing data for threat detection.</td> </tr> <tr> <td>Does the change introduce or significantly modify AI/ML capabilities?</td> <td>Microsoft Defender for Office 365 uses machine learning to detect phishing, malware, impersonation, and zero-day threats, and these capabilities are expanded through this rollout.</td> </tr> <tr> <td>Does the change alter how admins can monitor, report on, or demonstrate compliance activities?</td> <td>New alert types and threat detection insights will appear in the Microsoft Defender portal, impacting security monitoring and reporting.</td> </tr> <tr> <td>Does the change add any integration to 3rd party software products?</td> <td>Intune ServiceNow integration is included.</td> </tr> <tr> <td>Does the change include an admin control and can it be controlled through Entra ID group membership?</td> <td>Admins can configure Defender and Intune policies and apply settings using user and group-based assignments.</td> </tr> </tbody></table>

May 20, 2026 at 8:30 PM Updated

Last Updated Date

2026-05-20T16:54:04.377Z

New

2026-05-20T18:09:54.273Z

Body Content

Updated May 20, 2026: Organizations in using Microsoft 365 operated by 21Vianet can safely disregard this message.[Introduction] As a part of the <a href="https://www.microsoft.com/microsoft-365/blog/2025/12/04/advancing-microsoft-365-new-capabilities-and-pricing-update/" target="_blank">2026 Microsoft 365 Packaging and Pricing Update</a>, we're excited to share that the following features will begin to roll out to Microsoft 365, Office 365, and Enterprise Mobility and Security (EMS) suites in mid-June and are expected to be complete by August 1, 2026.Refer to the <a href="https://www.microsoft.com/licensing/news/2026-M365-Packaging-Pricing-Updates" target="_blank">licensing blog</a> for feature availability by suite. Government and Commercial packaging changes are listed separately.<ul><li><a href="https://learn.microsoft.com/office365/servicedescriptions/office-365-advanced-threat-protection-service-description" target="_blank">Microsoft Defender for Office 365 Plan 1</a>: Protection against advanced phishing and malware</li> <li>URL time-of-click protection: Scans URLs at time of click to prevent access to malicious websites</li> <li><a href="https://learn.microsoft.com/intune/intune-service/fundamentals/remote-help" target="_blank">Intune Remote Help</a>: Secure remote support for devices</li> <li><a href="https://learn.microsoft.com/intune/advanced-analytics/" target="_blank">Intune Advanced Analytics</a>: Insights to improve user experience</li> <li>Intune Plan 2: <a href="https://learn.microsoft.com/intune/device-security/microsoft-tunnel/mam" target="_blank">Tunnel for MAM</a>, <a href="https://learn.microsoft.com/intune/device-updates/android/setup-zebra-lifeguard" target="_blank">FOTA</a>, and <a href="https://learn.microsoft.com/intune/device-management/specialty-devices" target="_blank">specialty device management</a></li> <li><a href="https://learn.microsoft.com/intune/intune-service/protect/epm-overview" target="_blank">Intune Endpoint Privilege Management</a>: Supports least-privilege access</li> <li><a href="https://learn.microsoft.com/mem/intune/protect/microsoft-cloud-pki-overview" target="_blank">Microsoft Cloud PKI</a>: Cloud-based certificate lifecycle management</li> <li><a href="https://learn.microsoft.com/mem/intune/apps/apps-enterprise-app-management" target="_blank">Intune Enterprise Application Management</a>: Enterprise App Catalog of Win32 applications with preconfigured deployment settings.</li> <li>Exchange Online: +50GB email storage</li> </ul> Refer to list of service display names affected below: <table> <tbody><tr> <th>Display Name</th> <th>Part Number</th> </tr> <tr> <td>Microsoft 365 built-in email and collaboration security (URL time-to-click protection)</td> <td>MDOLITE_ENTERPRISE</td> </tr> <tr> <td>Microsoft Defender for Office 365 (Plan 1)</td> <td>ATP_ENTERPRISE</td> </tr> <tr> <td>Exchange Online Storage (50GB additional)</td> <td>EXCHANGE_STORAGE_50GB</td> </tr> <tr> <td>Remote Help</td> <td>REMOTE_HELP</td> </tr> <tr> <td>Microsoft Intune Advanced Analytics</td> <td>Intune_AdvancedEA</td> </tr> <tr> <td>Intune Plan 2</td> <td>INTUNE_P2</td> </tr> <tr> <td>Intune ServiceNow Integration</td> <td>Intune_ServiceNow</td> </tr> <tr> <td>Microsoft Tunnel for Mobile Application Management</td> <td>Intune-MAMTunnel</td> </tr> <tr> <td>Intune Enterprise Application Management</td> <td>3_PARTY_APP_PATCH</td> </tr> <tr> <td>Intune Endpoint Privilege Management</td> <td>Intune-EPM</td> </tr> <tr> <td>Microsoft Cloud PKI</td> <td>CLOUD_PKI</td> </tr> </tbody></table> [When this will happen:] We will begin rolling out in mid-June 2026 and expect to complete by early August 2026.<ul> </ul> [How this affects your organization:] Who is affected: <ul> <li>Refer to the <a href="https://www.microsoft.com/licensing/news/2026-M365-Packaging-Pricing-Updates" target="_blank">licensing blog</a> for feature availability by suite</li><li>Organizations using Microsoft 365, Office 365, and EMS suites</li><li>Microsoft 365 admins responsible for security and device management</li> <li>Users receiving enhanced protections and increased mailbox storage</li> </ul> What will happen:For Microsoft Defender features: <ul><li>Built-in protection policy (Safe Links, Safe Attachments), anti-phishing protections, and URL time-of-click protection will be applied to all users by default </li><li>Policies cannot be disabled but can be supplemented or overridden </li><li>New alerts may appear in the Microsoft Defender portal</li></ul>For Microsoft Intune features:<ul> <li>Intune features are not configured by default</li></ul>For Exchange Online:<ul> <li>Exchange Online storage increases by +50GB</li></ul> [What you can do to prepare:] For Microsoft Defender features: <ul> <li>Review the Built-in Protection policy in the Microsoft Defender portal.</li> <li> Add exclusions by user, group, or domain, if needed.</li><li>Consider enabling standard or strict preset security policies.</li><li>Review mail flow and configure enhanced filtering if using a third-party gateway.</li> </ul> For Microsoft Intune features: Refer to the MS Learn documentation hyperlinked in the Intro section of this post. Learn more: <ul> <li><a href="https://www.microsoft.com/microsoft-365/blog/2025/12/04/advancing-microsoft-365-new-capabilities-and-pricing-update/?msockid=16201fadc9a16bde3e5c09afc8a76aa7" target="_blank">M365 Packaging and Pricing Update: Official Announcement Blog</a></li><li><a href="https://www.microsoft.com/licensing/news/2026-M365-Packaging-Pricing-Updates" target="_blank">M365 Packaging and Pricing Update: Licensing Blog</a></li><li><a href="https://www.microsoft.com/licensing/news/2026-M365-Packaging-Pricing-Updates-FAQ" target="_blank">M365 Packaging and Pricing Update: Public FAQs</a></li><li><a href="https://learn.microsoft.com/defender-office-365/" target="_blank">Microsoft Defender for Office 365: Security Documentation</a></li><li><a href="https://learn.microsoft.com/defender-office-365/preset-security-policies#use-the-microsoft-defender-portal-to-add-exclusions-to-the-built-in-protection-preset-security-policy" target="_blank">Microsoft Defender for Office 365: Preset Security Policies Documentation</a></li></ul>[Compliance considerations:] <table> <tbody><tr> <th>Area</th> <th>Explanation</th> </tr> <tr> <td>Does the change store new customer data?</td> <td>Microsoft Defender and Intune features may generate and store additional security telemetry, alerts, and device analytics data as part of normal service operation.</td> </tr> <tr> <td>Does the change alter how existing customer data is processed, stored, or accessed?</td> <td>Microsoft Defender enhancements introduce additional scanning and analysis of email content and URLs, including time-of-click protection, increasing inspection of existing data for threat detection.</td> </tr> <tr> <td>Does the change introduce or significantly modify AI/ML capabilities?</td> <td>Microsoft Defender for Office 365 uses machine learning to detect phishing, malware, impersonation, and zero-day threats, and these capabilities are expanded through this rollout.</td> </tr> <tr> <td>Does the change alter how admins can monitor, report on, or demonstrate compliance activities?</td> <td>New alert types and threat detection insights will appear in the Microsoft Defender portal, impacting security monitoring and reporting.</td> </tr> <tr> <td>Does the change add any integration to 3rd party software products?</td> <td>Intune ServiceNow integration is included.</td> </tr> <tr> <td>Does the change include an admin control and can it be controlled through Entra ID group membership?</td> <td>Admins can configure Defender and Intune policies and apply settings using user and group-based assignments.</td> </tr> </tbody></table>

New

May 20, 2026 at 6:30 PM Updated

Title

2026 Microsoft 365 Packaging Update

New

(Updated) 2026 Microsoft 365 Packaging Update

Last Updated Date

2026-05-08T22:44:39.700Z

New

2026-05-20T16:54:04.377Z

Tags

User impact,Admin impact

New

Updated message,User impact,Admin impact

Body Content

[Introduction] As a part of the <a href="https://www.microsoft.com/microsoft-365/blog/2025/12/04/advancing-microsoft-365-new-capabilities-and-pricing-update/" target="_blank">2026 Microsoft 365 Packaging and Pricing Update</a>, we're excited to share that the following features will begin to roll out to Microsoft 365, Office 365, and Enterprise Mobility and Security (EMS) suites in mid-June and are expected to be complete by August 1, 2026.Refer to the <a href="https://www.microsoft.com/licensing/news/2026-M365-Packaging-Pricing-Updates" target="_blank">licensing blog</a> for feature availability by suite. Government and Commercial packaging changes are listed separately.<ul><li><a href="https://learn.microsoft.com/office365/servicedescriptions/office-365-advanced-threat-protection-service-description" target="_blank">Microsoft Defender for Office 365 Plan 1</a>: Protection against advanced phishing and malware</li> <li>URL time-of-click protection: Scans URLs at time of click to prevent access to malicious websites</li> <li><a href="https://learn.microsoft.com/intune/intune-service/fundamentals/remote-help" target="_blank">Intune Remote Help</a>: Secure remote support for devices</li> <li><a href="https://learn.microsoft.com/intune/advanced-analytics/" target="_blank">Intune Advanced Analytics</a>: Insights to improve user experience</li> <li>Intune Plan 2: <a href="https://learn.microsoft.com/intune/device-security/microsoft-tunnel/mam" target="_blank">Tunnel for MAM</a>, <a href="https://learn.microsoft.com/intune/device-updates/android/setup-zebra-lifeguard" target="_blank">FOTA</a>, and <a href="https://learn.microsoft.com/intune/device-management/specialty-devices" target="_blank">specialty device management</a></li> <li><a href="https://learn.microsoft.com/intune/intune-service/protect/epm-overview" target="_blank">Intune Endpoint Privilege Management</a>: Supports least-privilege access</li> <li><a href="https://learn.microsoft.com/mem/intune/protect/microsoft-cloud-pki-overview" target="_blank">Microsoft Cloud PKI</a>: Cloud-based certificate lifecycle management</li> <li><a href="https://learn.microsoft.com/mem/intune/apps/apps-enterprise-app-management" target="_blank">Intune Enterprise Application Management</a>: Enterprise App Catalog of Win32 applications with preconfigured deployment settings.</li> <li>Exchange Online: +50GB email storage</li> </ul> Refer to list of service display names affected below: <table> <tbody><tr> <th>Display Name</th> <th>Part Number</th> </tr> <tr> <td>Microsoft 365 built-in email and collaboration security (URL time-to-click protection)</td> <td>MDOLITE_ENTERPRISE</td> </tr> <tr> <td>Microsoft Defender for Office 365 (Plan 1)</td> <td>ATP_ENTERPRISE</td> </tr> <tr> <td>Exchange Online Storage (50GB additional)</td> <td>EXCHANGE_STORAGE_50GB</td> </tr> <tr> <td>Remote Help</td> <td>REMOTE_HELP</td> </tr> <tr> <td>Microsoft Intune Advanced Analytics</td> <td>Intune_AdvancedEA</td> </tr> <tr> <td>Intune Plan 2</td> <td>INTUNE_P2</td> </tr> <tr> <td>Intune ServiceNow Integration</td> <td>Intune_ServiceNow</td> </tr> <tr> <td>Microsoft Tunnel for Mobile Application Management</td> <td>Intune-MAMTunnel</td> </tr> <tr> <td>Intune Enterprise Application Management</td> <td>3_PARTY_APP_PATCH</td> </tr> <tr> <td>Intune Endpoint Privilege Management</td> <td>Intune-EPM</td> </tr> <tr> <td>Microsoft Cloud PKI</td> <td>CLOUD_PKI</td> </tr> </tbody></table> [When this will happen:] We will begin rolling out in mid-June 2026 and expect to complete by early August 2026.<ul> </ul> [How this affects your organization:] Who is affected: <ul> <li>Refer to the <a href="https://www.microsoft.com/licensing/news/2026-M365-Packaging-Pricing-Updates" target="_blank">licensing blog</a> for feature availability by suite</li><li>Organizations using Microsoft 365, Office 365, and EMS suites</li><li>Microsoft 365 admins responsible for security and device management</li> <li>Users receiving enhanced protections and increased mailbox storage</li> </ul> What will happen:For Microsoft Defender features: <ul><li>Built-in protection policy (Safe Links, Safe Attachments), anti-phishing protections, and URL time-of-click protection will be applied to all users by default </li><li>Policies cannot be disabled but can be supplemented or overridden </li><li>New alerts may appear in the Microsoft Defender portal</li></ul>For Microsoft Intune features:<ul> <li>Intune features are not configured by default</li></ul>For Exchange Online:<ul> <li>Exchange Online storage increases by +50GB</li></ul> [What you can do to prepare:] For Microsoft Defender features: <ul> <li>Review the Built-in Protection policy in the Microsoft Defender portal.</li> <li> Add exclusions by user, group, or domain, if needed.</li><li>Consider enabling standard or strict preset security policies.</li><li>Review mail flow and configure enhanced filtering if using a third-party gateway.</li> </ul> For Microsoft Intune features: Refer to the MS Learn documentation hyperlinked in the Intro section of this post. Learn more: <ul> <li><a href="https://www.microsoft.com/microsoft-365/blog/2025/12/04/advancing-microsoft-365-new-capabilities-and-pricing-update/?msockid=16201fadc9a16bde3e5c09afc8a76aa7" target="_blank">M365 Packaging and Pricing Update: Official Announcement Blog</a></li><li><a href="https://www.microsoft.com/licensing/news/2026-M365-Packaging-Pricing-Updates" target="_blank">M365 Packaging and Pricing Update: Licensing Blog</a></li><li><a href="https://www.microsoft.com/licensing/news/2026-M365-Packaging-Pricing-Updates-FAQ" target="_blank">M365 Packaging and Pricing Update: Public FAQs</a></li><li><a href="https://learn.microsoft.com/defender-office-365/" target="_blank">Microsoft Defender for Office 365: Security Documentation</a></li><li><a href="https://learn.microsoft.com/defender-office-365/preset-security-policies#use-the-microsoft-defender-portal-to-add-exclusions-to-the-built-in-protection-preset-security-policy" target="_blank">Microsoft Defender for Office 365: Preset Security Policies Documentation</a></li></ul>[Compliance considerations:] <table> <tbody><tr> <th>Area</th> <th>Explanation</th> </tr> <tr> <td>Does the change store new customer data?</td> <td>Microsoft Defender and Intune features may generate and store additional security telemetry, alerts, and device analytics data as part of normal service operation.</td> </tr> <tr> <td>Does the change alter how existing customer data is processed, stored, or accessed?</td> <td>Microsoft Defender enhancements introduce additional scanning and analysis of email content and URLs, including time-of-click protection, increasing inspection of existing data for threat detection.</td> </tr> <tr> <td>Does the change introduce or significantly modify AI/ML capabilities?</td> <td>Microsoft Defender for Office 365 uses machine learning to detect phishing, malware, impersonation, and zero-day threats, and these capabilities are expanded through this rollout.</td> </tr> <tr> <td>Does the change alter how admins can monitor, report on, or demonstrate compliance activities?</td> <td>New alert types and threat detection insights will appear in the Microsoft Defender portal, impacting security monitoring and reporting.</td> </tr> <tr> <td>Does the change add any integration to 3rd party software products?</td> <td>Intune ServiceNow integration is included.</td> </tr> <tr> <td>Does the change include an admin control and can it be controlled through Entra ID group membership?</td> <td>Admins can configure Defender and Intune policies and apply settings using user and group-based assignments.</td> </tr> </tbody></table>

New

Never Miss a Microsoft 365 Update

Join thousands of IT professionals who rely on DeltaPulse for real-time Microsoft 365 change intelligence, automated notifications, and community insights.

Explore Dashboard Sign Up Free