A priority account is a user you have tagged in Microsoft 365 so that security and mail-health features treat them differently from everyone else. You can tag up to 250 users or groups, and what the tag unlocks depends on your licenses.
Why a few mailboxes deserve a different standard
Attackers do not treat every inbox equally. Microsoft's own guidance points out that broad phishing campaigns that cast a random net are inefficient, while spear phishing and whaling aimed at a handful of people pay off far more. A CEO, a CFO, a CISO, a domain admin or the service account behind a build system can open doors that an ordinary user cannot.
The priority account tag is Microsoft's way of telling the platform who those people are. It also covers a quieter problem: for an executive, a delayed or bounced email is a business incident, not a nuisance. So the same tag drives both protection (stopping the bad mail) and monitoring (catching the good mail that never arrived).
You can tag individual users or whole groups, which makes it practical to cover the executive team, their delegates and your most privileged technical accounts in one pass.
What tagging gives you
One tag switches on five capabilities, and each has its own license gate.
Feature | What it does | What you need |
Reporting in Defender for Office 365 | Filter alerts, reports and investigations down to priority accounts | Defender for Office 365 Plan 1 or Plan 2 |
Priority account protection | Extra detection heuristics tuned to how executive mail flows; on by default | Defender for Office 365 Plan 2 |
Exchange Online priority account monitoring | Mailbox health checks for licensing, storage, message limits and delivery | 5,000+ qualifying licenses and 50+ monthly active users |
Premium Mail Flow Monitoring | Alerts when failed or delayed mail passes a threshold you choose | 5,000+ qualifying licenses and 50+ monthly active users |
Priority feedback in Copilot Chat | Feedback from tagged users jumps to the front of Microsoft's triage queue | Users allowed to submit feedback with logs and content samples |
The heuristics in priority account protection exist because Microsoft's datacenter telemetry shows executive mail patterns differ from the average user's. That is also why Microsoft explains you should not simply tag everyone: the extra tuning only helps a small, distinctive group.
Licensing: what you actually need
There are two separate gates, and mixing them up is the most common source of confusion.
Gate 1: Defender for Office 365 (security features).
• Plan 1 or Plan 2 gives you the tag as a filter in alerts, reports and investigations. Microsoft 365 Business Premium includes Defender for Office 365, so smaller organizations get this too.
• Plan 2 is required for priority account protection itself. It comes with Office 365 E5, Microsoft 365 E5 and Microsoft 365 E5 Security, and Business Premium customers can reach it through the Microsoft Defender Suite for Business Premium add-on.
• You can test Plan 2 with the 90-day Defender for Office 365 trial in the Defender portal trials hub.
Gate 2: tenant size (Exchange monitoring features).
• At least 5,000 licenses in any mix of Office 365 E3, Microsoft 365 E3, Office 365 E5 and Microsoft 365 E5. For example, 3,000 Office 365 E3 plus 2,500 Microsoft 365 E5 counts as 5,500.
• At least 50 monthly active users across Teams, OneDrive, SharePoint, Exchange Online or Microsoft 365 apps.
• Both conditions must hold for Exchange Online priority account monitoring and Premium Mail Flow Monitoring.
Permissions to tag users - Membership in both the Security Administrator and Exchange Admin role groups in the Defender portal/the Entra Security Administrator role or Global Administrator. With Defender XDR Unified RBAC, use the Authorization and settings / System settings permission.
Setting it up
You can tag accounts in three places. Allow up to eight hours for a change to apply fully.
Option 1: Microsoft 365 admin center
1. Sign in at admin.cloud.microsoft and open the Priority accounts page. The long route is Users > Active users > More actions > Manage priority accounts.
2. Select Tag accounts.
3. Choose how to search: name and email address, job title, or distribution list. Select Next.
4. Pick the users or distribution groups and select Tag. The counter shows how many of your 250 slots are used.
5. To remove someone, tick them in the list and choose Remove tag.
Option 2: Microsoft Defender portal
1. Go to Settings > Email & collaboration > User tags at security.microsoft.com.
2. Select the Priority account tag and choose Edit.
3. On Assign members, add users or groups, or use Import with a text file of email addresses, one per line.
4. Review the tag and select Submit.
Option 3: Exchange Online PowerShell
# List current priority accounts
Get-User -IsVIP | Select-Object Identity
# Tag a user
Set-User -VIP $true -Identity [email protected] -Confirm:$false
# Remove the tag
Set-User -VIP $false -Identity [email protected] -Confirm:$false
When you tag a mailbox, also tag everyone with access to it. Microsoft's example is a CEO and the executive assistant who manages the CEO's calendar: an attacker who compromises the assistant already has a path to the executive.
Policies to configure for tagged users
The tag does not harden anything by itself. It identifies the people; you still apply the controls. Microsoft's recommendations for these accounts break down like this.
Control | What to set | Where |
Multifactor authentication | Require MFA for every priority account | Microsoft Entra |
Legacy authentication | Disable it globally for priority users. If you cannot, turn off POP3 and IMAP4 per mailbox and disable authenticated SMTP at the organization level, enabling it only where needed | Entra / Exchange Online |
Strict preset security policy | Apply the Strict profile to priority users, which quarantines spam instead of delivering it to Junk Email | Defender portal > Preset security policies |
Priority account protection | Confirm it is on. Microsoft recommends leaving it on | Settings > Email & collaboration > Priority account protection |
Custom alert policies | Create alerts scoped by user tag so activity on tagged accounts raises the right people | Defender portal > Alert policies |
Attack simulation | Target simulated phishing at the tagged users to test them | Attack simulation training (Plan 2) |
User training | Teach tagged users to spot phishing; they are the prime targets | Microsoft 365 learning pathways |
To check or enable priority account protection from PowerShell:
Get-EmailTenantSettings | Format-List Identity,EnablePriorityAccountProtection
Set-EmailTenantSettings -EnablePriorityAccountProtection $true
A value of True means protection is on. It is enabled by default in Defender for Office 365 Plan 2 organizations, so this is a verification step more than a setup step.
The Strict preset is the biggest practical change for most tenants. It means a suspicious message to the CFO is held for review rather than landing in a folder where it might get opened, at the cost of a few more quarantine releases for your help desk. Plan for that trade-off before you roll it out.
Where to see what is happening
Once accounts are tagged, the tag becomes a filter across the Defender portal and Exchange admin center:
• Alerts and Incidents: tags of affected users are visible, and alerts can be filtered by tag.
• Threat Explorer (Plan 2) and Real-time detections (Plan 1): tags show in the email grid. For protection results, choose Context > Equal any of > Priority account protection, then Refresh.
• Email entity page: the Analysis tab lists Priority account protection under Threat detection details when it influenced a verdict.
• Threat protection status report: filter by Priority account protection = Yes in the Phish, Spam, Malware, Policy type and Delivery status views.
• Campaign Views, Top senders and recipients, Compromised user report: filter or highlight by tag.
• Quarantine and Submissions: handle messages held for priority accounts and send suspect items to Microsoft.
• Email issues for priority accounts report (Exchange admin center): undelivered and delayed messages for tagged users.
Common mistakes and a rollout checklist
Most problems come from treating the tag as a finished project instead of a living list.
• Tagging everyone. The cap is 250, and the tuning only pays off for a small group.
• Forgetting delegates. Assistants, shared-mailbox users and anyone with mailbox access are a back door to the executive.
• Expecting instant effect. Tags can take up to eight hours to apply.
• Skipping sign-in hardening. Strong mail filtering does little if the account still allows legacy authentication or has no MFA.
• Letting the list go stale. Reorganizations change who holds the keys. Review the tagged set on a regular schedule, for example each quarter.
Join the conversation! Your thoughts help the community grow.