(Updated) Announcing evaluation mode and trial for Defender for Office 365

Updated January 07, 2021: Microsoft has updated the timeline below.

Microsoft is introducing an evaluation mode in Microsoft Defender for Office365 which applies only to email protection. The Microsoft Defender for Office 365 evaluation experience is designed to eliminate the complexities of device and environment configuration so that you can focus on evaluating the capabilities of the security solution.

The ability to access and setup evaluation mode requires a customer to either have a paid or trial license for any of the following licenses as part of their subscriptions:

• Microsoft Defender for Office 365 Plan 1
• Microsoft Defender for Office 365 Plan 2
• Microsoft 365 E5
• Microsoft 365 E5 Security
• Office 365 E5

Note that tenants with Exchange Online as part of their subscriptions will see a new Microsoft Defender for Office 365 evaluation card in the Threat Management part of the Office 365 Security & Compliance Center.

This message is associated with Microsoft 365 Roadmap ID 68862.

When this will happen

• Microsoft will begin rolling out evaluation mode to tenants with Exchange Online mailboxes in mid-December.
• Microsoft expects the rollout to be complete by the end of January 2021 (previously December 2020).

How this will affect your organization

Microsoft Defender for Office 365 in evaluation mode creates email policies that log verdicts, such as malware, but don’t act on messages. You are not required to change your MX record configuration.

When you have set up evaluation mode, you will have a daily report with up to 90 days of data quantifying the messages that would have been blocked had the policies been made and implemented (for example, delete, send to junk, quarantine). Reports are generated for all Microsoft Defender for Office 365 and Exchange Online Protection detections. They are aggregated per detection technology (for example, impersonation) and can be filtered by time range. Additionally, message reports can be created on-demand to create custom pivots or to deep dive messages using Threat Explorer.

What you need to do to prepare

For customers who would like to try the evaluation experience but do not currently meet the licensing bar, we are providing a 30-day free trial for 25 licenses. If you would like to utilize this feature after 30 days, you will need to meet the minimum licensing requirements.

After the trial has expired, you can continue to access the evaluation report for 90 days. However, it won’t collect any more information.

Go to Settings to turn off your evaluation at any time.

Learn more: Microsoft Defender for Office365