Trying to understand why Microsoft includes both products in either M365 E5 or EMS E5 if they essentially to the same thing. Does one include something the other doesn't? (other than the obvious Azure based console in AATP to review the reports)
@AndySVM ATA is available in an EMS E3 - Azure ATP is in the E5.
ATA requires more on-premises components to deploy, as Azure ATP is delivered from the cloud service. Effectively they are very similar, just delivered (and managed) in different places, but it means E3 customers have the ability to monitor and protect their on-premises networks
While Azure ATP and ATA both protect on-premises environments, they have a number of significant differences:
ATA is a standalone solution, installed on-premises. Azure ATP with its cloud connectivity includes continuous feature updates including new detections, UEBA capabilities, security assessments, and an investigation experience across Microsoft 365 Security solutions.