Should I leverage both ATA and Azure ATP? or are they the same thing?

Copper Contributor

Trying to understand why Microsoft includes both products in either M365 E5 or EMS E5 if they essentially to the same thing.  Does one include something the other doesn't? (other than the obvious Azure based console in AATP to review the reports)


@Azure Advanced Threat Protection Team @Advanced Threat Analytics Team 

4 Replies

@AndySVM I'm not certain but I thought ATA was to be EoL'd?
They are effectively the same thing as far as I know ;)

@David Caddick, just got the below confirmation from Microsoft during the "Azure ATP Webinar: Deployment and Configuration" webinar session today.



FYI: After the event, we will be posting recordings of the webinar at

@AndySVM ATA is available in an EMS E3 - Azure ATP is in the E5.


ATA requires more on-premises components to deploy, as Azure ATP is delivered from the cloud service. Effectively they are very similar, just delivered (and managed) in different places, but it means E3 customers have the ability to monitor and protect their on-premises networks

@Justin Barker @AndySVM

While Azure ATP and ATA both protect on-premises environments, they have a number of significant differences:


ATA is a standalone solution, installed on-premises. Azure ATP with its cloud connectivity includes continuous feature updates including new detections, UEBA capabilities, security assessments, and an investigation experience across Microsoft 365 Security solutions.