In this article, you'll learn about the Microsoft license requirements for Messaging Security and Unified Quarantine (post-delivery quarantine) in Defend, as well as the related Messaging Security Posture Check. A tenant does not need to hold all of these licenses to use every feature. Each check is independent.
Messaging Security License Requirements
Messaging Security accepts any of the following Microsoft licenses:
- Microsoft 365 E3, E5, E7, F1, F3
- Microsoft 365 Business Basic, Business Standard, Business Premium
- Office 365 E1, E2, E3, E4, E5, F3
- Office 365 Government Community Cloud (GCC) G1, G3, G5
- Microsoft 365 GCC G3, G5
- Microsoft 365 and Office 365 A1, A3, A5 (faculty and student use)
- Standalone Teams licenses: Teams Enterprise, Teams Essentials, Teams Commercial Cloud, Teams EEA, Teams Free, Teams Trial, Teams Exploratory
- Teams Rooms Basic, Standard, Pro, Premium, and Teams Shared Devices (device licenses also satisfy this requirement)
- Dynamics 365 Team Members, Remote Assist, Customer Engagement, Multi-app
Messaging Security does not require Microsoft Defender for Office 365 Plan 2.
Note:A tenant can hold a qualifying license and still not meet the Messaging Security requirement if Teams itself is not enabled for that tenant. License and enablement are checked separately.
Messaging Security Posture Check License Requirements
Messaging Security Posture Check requires a Microsoft Entra ID (Azure AD) Premium P1 license.
Unified Quarantine License Requirements
Unified Quarantine accepts any of the following Microsoft licenses:
- Microsoft Defender for Office 365 Plan 2
- Microsoft 365 E5 license (or equivalent Security and Compliance add-ons)
- Office 365 E5, and Office 365 E5 without Audio Conferencing
- Microsoft 365 and Office 365 A5 (faculty use, student use, student use benefit, and without Audio Conferencing variants)
- Microsoft 365 GCC G5, Office 365 GCC G5
- Standalone Microsoft Defender for Office 365 Plan 2 add-on SKUs
- Microsoft for Business Premium
Note:Unified Quarantine does not require a Teams license.
Non-License Prerequisites
Holding the right license is not the only requirement for either feature.
- Messaging Security also requires the tenant to be on a Dedicated app registration with the EmailAndTeamsReadWrite feature set, granted through the in-product Set up consent flow, and the connecting admin account needs settings-write permission in Microsoft 365.
- Unified Quarantine also requires the Microsoft Graph SetVerdict permission to be consented to. If this permission is missing, the customer needs to relink their Microsoft 365 account.
Note:If a tenant holds a qualifying license but a feature still won't enable, check these non-license prerequisites before escalating a license issue.