Microsoft added a new layer to Microsoft Defender for Office 365 this summer that scans incoming email for prompt injection, hidden instructions written to hijack an AI assistant like Copilot instead of tricking a person. The protection is on by default, but only for organizations licensed on Defender for Office 365 Plan 2 or Microsoft 365 E5. Most Southwest Florida businesses running standard Microsoft 365 Business Premium do not have that license, so if your team leans on Copilot to read or summarize email, this is a gap worth closing.
Key takeaways
- Prompt injection attacks target the AI reading your email, not the human, by hiding instructions in invisible text, quoted replies, or encoded strings.
- Microsoft’s new detection in Defender for Office 365 flags these messages as High Confidence Phishing and quarantines them automatically, no setup required.
- It only works with Defender for Office 365 Plan 2 or Microsoft 365 E5. Standard Business Premium includes Plan 1, a smaller feature set, according to Microsoft’s own plan comparison.
- Public preview began in early July 2026, with worldwide general availability starting in early September 2026, per Microsoft’s Message Center rollout notice.
- Business Premium tenants can trial Plan 2, add it as a paid add-on, or lean on staff training and mail-flow rules until they decide whether to upgrade.
What is prompt injection, and why should a small business care?
Traditional phishing tries to fool a person into clicking a link or wiring money. Prompt injection is aimed at the software instead. If an employee asks Copilot to summarize a long email thread or draft a reply, the AI reads every word of that thread, including text a human would never notice. An attacker can bury a command in white-on-white font, a zero-size line, or a quoted reply buried three messages deep, telling the assistant to describe a phishing link as safe, pull data out of the mailbox, or forward a thread somewhere it shouldn’t go. Microsoft’s own documentation walks through these techniques, including hidden text, encoded strings, and instructions smuggled inside forwarded content.
For a five- or twenty-person office in Naples or Fort Myers that has started using Copilot to triage a shared inbox, this is not a hypothetical. The more your team automates email handling with AI, the more that inbox becomes an attack surface a spam filter alone was never built to catch.
What does the new Defender protection actually do?
Detection happens during normal mail flow, before a message ever lands in a mailbox or gets summarized by an assistant. Defender for Office 365 evaluates the subject, body, hidden markup, and quoted or forwarded content, then classifies anything it flags as prompt injection under the existing High Confidence Phishing verdict, with a new “Prompt Injection Protection” tag visible in Threat Explorer. Flagged mail goes straight to quarantine. There is nothing to turn on if your tenant already has the right license.
Why doesn’t this reach most Business Premium tenants?
Microsoft 365 Business Premium, the plan most small and mid-size Southwest Florida businesses run, includes Defender for Office 365 Plan 1. Plan 1 covers Safe Links, Safe Attachments, and impersonation protection, solid tools, but the new prompt injection detection was built on top of Plan 2, which ships standard with Microsoft 365 E5 and is otherwise sold as an add-on or 90-day trial. Microsoft confirms this split directly in its Defender for Office 365 plan comparison. Unless you’ve specifically added Plan 2 or moved to E5, your mailboxes are not getting this particular protection yet, even though it is enabled automatically for tenants that do qualify.
What should a Southwest Florida business do about it now?
Start by checking which Defender for Office 365 plan you’re actually on. Your IT provider or the Microsoft 365 admin center can confirm it in a few minutes. If you’re on Plan 1 and your staff regularly use Copilot against email, weigh the cost of the Plan 2 add-on against the risk, or run the 90-day trial Microsoft offers to see what it catches in your own mail flow before committing. In the meantime, remind staff that an AI-generated summary of an email is not the same as reading the email itself, and that any thread asking someone to forward data, approve a payment, or click a link deserves a second look regardless of what a summary says. This pairs well with the account-level protections we covered when we looked at Safe Links coverage on Business Premium, and with the broader pattern of AI-driven business email compromise scams we’ve been tracking this year.
Frequently asked questions
What is prompt injection in email?
It’s an attack that hides instructions inside an email, in invisible text, a quoted reply, or an encoded string, aimed at an AI assistant that reads the message rather than at the human recipient.
Does Microsoft 365 Business Premium include this new protection?
Not by default. Business Premium includes Defender for Office 365 Plan 1. The new prompt injection detection requires Plan 2 or Microsoft 365 E5.
Do I need to turn this feature on if I have the right license?
No. Microsoft enables it automatically for eligible tenants as part of standard mail flow inspection, with no extra configuration.
When is this feature fully available?
Public preview started in early July 2026. Worldwide general availability begins in early September 2026, according to Microsoft’s Message Center notice.
If you’re not sure which Defender for Office 365 plan your business is on, or whether your Copilot rollout has a blind spot like this one, SWFIT offers a free 15-minute IT and security review to check your Microsoft 365 licensing and email protections. Get in touch to schedule one.
