A red-teamer reports MDE P2's automatic attack disruption repeatedly cut off an internal test where other products didn't (opinion, one engagement). The licensing fact is from Microsoft Learn: attack disruption needs MDE Plan 2 (or E5-class / Defender for Business). P1 gives prevention and manual response only. Set device groups to Full or Semi automation and keep the Sense agent current.