Apple Podcasts 
Spotify 
Youtube Music 
Spreaker 
Podchaser 
Amazon Music Exchange Online Protection (EOP) - Simply Explained
Quick answer: Exchange Online Protection, or EOP, is the baseline cloud email security service in Microsoft 365. This episode explains how it helps filter spam, malware, and unwanted messages, where it fits with Microsoft Defender for Office 365, and which operating decisions make protection more effective.
Exchange Online Protection (EOP) serves as a vital component of email security for organizations. It protects you from various email threats, including spam, malware, and phishing attacks. By using EOP, you gain a robust defense mechanism that filters incoming and outgoing emails through Microsoft's secure cloud infrastructure. This proactive approach allows you to focus on your core business activities while ensuring the safety of your communications.
Key Takeaways
- EOP protects organizations from email threats like spam, malware, and phishing, ensuring secure communications.
- The service requires no setup, providing automatic protection through Microsoft's secure cloud infrastructure.
- EOP includes advanced features like anti-spam, anti-malware, and anti-phishing protection to enhance email security.
- Regular updates and user training are essential to adapt to evolving cyber threats and empower employees.
- Monitoring EOP reports helps identify potential security issues and assess the effectiveness of email filtering.
- Avoid common configuration mistakes, such as creating overly broad allow-lists, to maintain EOP's effectiveness.
- For advanced threats, consider upgrading to Microsoft Defender for Office 365 for enhanced protection features.
- EOP simplifies email security management, allowing IT administrators to easily access reports and adjust settings.
What Is Exchange Online Protection (EOP)?
Exchange Online Protection (EOP) is a security capability integrated into Exchange Online and Office 365. It plays a crucial role in email security by defending against various threats. EOP primarily utilizes signature-matching technology to protect your organization from spam, viruses, and malware. This built-in email filtering and management service ensures that your communications remain secure.
Key Features of Microsoft EOP
EOP offers several key features that enhance your email security. Here are some of the main features:
| Feature | Description |
|---|---|
| Built-in Security Features | Focused on spam filtering and blocking common malware attacks to protect against basic email threats. |
| Deployment | No setup required; protection is applied automatically. |
| Management | Administrators can view filtering reports and adjust settings via the Microsoft 365 admin center. |
| Integration | Works seamlessly with Exchange Online and other Microsoft 365 services. |
| Advanced Protection | Includes Microsoft Defender for Office 365 with features like Safe Links and Safe Attachments. |
| Reporting | Near real-time reporting and message trace capabilities provide insights into email environments. |
| IT Support | 24/7 IT-level phone support at no additional cost. |
| Reliability | Global network of redundant data centers ensures 99.999% network uptime. |
| No Hardware Required | No hardware or software required to install, manage, and maintain. |
| Easy Maintenance | Simplifies IT environments by reducing the need for in-house email security servers and apps. |
EOP employs several layers of protection, including:
- Anti-spam protection: This feature filters out spam and unwanted emails, reducing the risk of downloading malicious software.
- Anti-malware protection: EOP detects malware and prevents it from entering your system.
- Anti-phishing protection: It scans emails for phishing attempts and blocks them before reaching your inbox.
Additionally, EOP includes Zero-Hour Auto Purge (ZAP) technology. ZAP actively monitors your mailboxes to isolate and remove spam, phishing, and malware emails that may have entered your inbox. This feature enhances security measures by ensuring that even after delivery, harmful emails can be removed.
EOP Security Features Against Phishing
Exchange Online Protection (EOP) plays a crucial role in combating phishing attacks, which remain one of the most common threats to email security. Phishing attacks often trick users into revealing sensitive information or downloading malicious software. EOP employs several methods to identify and mitigate these threats effectively.
EOP uses the following techniques to detect phishing attacks:
- Attackers frequently rotate domains and exploit trusted cloud services to evade detection.
- Phishing emails often mimic internal workflows, making them appear legitimate to users.
- Compromised SharePoint links and QR-code phishing can bypass traditional text analysis.
- OAuth consent phishing targets session permissions directly, avoiding the need for password collection.
- Attackers exploit trust relationships within Microsoft infrastructure, using legitimate business domains to distribute phishing messages.
To counter these tactics, EOP implements advanced anti-phishing measures. It analyzes incoming emails for suspicious patterns and behaviors. When EOP identifies a potential phishing threat, it blocks the email before it reaches your inbox. This proactive approach significantly reduces the risk of falling victim to phishing scams.
The importance of phishing protection cannot be overstated. According to the 2026 Verizon Data Breach Investigations Report, phishing was the initial attack vector in 16% of breaches. This statistic highlights the critical need for robust email security measures. By utilizing EOP, you enhance your organization's defenses against these prevalent threats.
In addition to blocking phishing attempts, EOP provides ongoing education and training resources. Maintaining strong and up-to-date phishing education programs empowers employees to recognize and respond to phishing attempts effectively. This combination of technology and training creates a comprehensive defense against phishing attacks.
Limitations of Microsoft Exchange Online Protection
While Exchange Online Protection (EOP) provides essential email security, it has some limitations you should be aware of. EOP serves as a foundational solution, but it does not cover every possible threat. Understanding these limitations can help you make informed decisions about your organization's email security strategy.
EOP primarily focuses on filtering spam, malware, and basic phishing attempts. However, it may not effectively protect against more sophisticated threats. For example, advanced phishing attacks, Business Email Compromise (BEC), and impersonation of executives often slip through EOP's defenses. These types of threats require more advanced threat protection measures.
To illustrate this point, consider the following table that outlines the coverage of EOP against various threat types:
| Threat Type | EOP Coverage |
|---|---|
| Advanced phishing | No |
| Business Email Compromise (BEC) | No |
| Impersonation of executives | No |
| Malware detection | Yes |
As you can see, while EOP effectively detects malware, it lacks coverage for advanced phishing and impersonation threats. This gap in protection can leave your organization vulnerable to attacks that exploit human behavior and trust.
For organizations facing these advanced threats, upgrading to Microsoft Defender for Office 365 is a wise choice. This advanced solution builds upon EOP by offering enhanced features such as Safe Links and Safe Attachments. These features provide deeper insights and automated investigations, ensuring you stay ahead of evolving cyber threats.
Best Practices for Using EOP
To maximize the effectiveness of Exchange Online Protection (EOP), you should follow several best practices. These practices will help you maintain a secure email environment and protect your organization from potential threats.
-
Maintain Default Policies: Start by keeping the default anti-malware policy. This foundational safety net protects your organization from common threats. Additionally, create custom policies for high-risk users. This approach ensures that sensitive accounts receive the most robust protection without disrupting overall operations.
-
Regular Updates and User Training: Regularly update your EOP settings to adapt to evolving threats. Cybercriminals constantly change their tactics, so staying current is crucial. Provide ongoing training for your users. Educating them about phishing attacks and other threats empowers them to recognize suspicious emails. This combination of technology and training strengthens your defenses.
-
Monitor and Analyze Reports: Monitoring your EOP reports is essential for maintaining email security. Use the following features to gain insights into your email environment:
Feature Description Message Tracking and Trace Logs Track email flow, showing delivery status, filtering actions, and timestamps for troubleshooting. Reports and Dashboards Gain insights on spam detection rates, malware, phishing attempts, and overall email traffic statistics. Auditing Log actions taken on mailboxes and configuration changes for compliance and forensic analysis. Compliance Features Ensure legal compliance and data preservation with retention policies and journaling. Monitoring and Alerting Receive alerts for unusual activities and mail flow insights to identify potential security issues. Protocol and Connectivity Logging Analyze email headers for troubleshooting and understanding mail flow issues. Summaries in Admin Center View overall mail volume and user activity, contributing to monitoring email service usage.
Regularly review these reports to gauge the health of your email system. For example, utilize message tracking logs to troubleshoot delivery issues. Monitor spam and malware reports to assess the effectiveness of your filtering. Implement auditing to track mailbox access and configuration changes. These practices will help you maintain a secure email environment.
- Avoid Common Configuration Mistakes: Be cautious of common mistakes when configuring EOP. Creating overly broad allow-lists can weaken EOP's effectiveness. Neglecting to review policies regularly can lead to outdated configurations. Assign responsibility for managing quarantined messages to ensure that unaddressed issues do not linger.
By following these best practices, you can enhance your email security and make the most of EOP's capabilities. A proactive approach will help you stay ahead of potential threats and protect your organization effectively.
Features and Benefits of Microsoft EOP
Microsoft Exchange Online Protection (EOP) offers numerous benefits that enhance your organization's email security. By implementing EOP, you gain advanced threat protection against phishing and ransomware. This capability is crucial in today’s digital landscape, where cyber threats are constantly evolving.
Here are some key benefits of using EOP:
- Advanced threat protection: EOP effectively safeguards your organization from various email threats, including phishing and ransomware attacks.
- Easy setup: You can quickly implement EOP with minimal configuration, making it suitable for organizations that need immediate protection.
- Integration with Microsoft services: EOP works seamlessly with Exchange Online and Microsoft Defender for Office 365, providing a comprehensive security solution.
- Message tracking and reporting: EOP helps you monitor email traffic and identify potential threats. This feature allows you to improve your security policies based on real-time data.
EOP enhances email security for organizations by employing a multi-layered approach. It filters incoming and outgoing emails, ensuring that harmful content does not reach your inbox. The anti-spam, anti-malware, and anti-phishing features work together to create a robust defense against various threats.
Moreover, EOP simplifies management for IT administrators. You can easily access filtering reports and adjust settings through the Microsoft 365 admin center. This user-friendly interface allows you to maintain control over your email security without requiring extensive technical knowledge.
To illustrate the management capabilities of EOP compared to other solutions, consider the following table:
| Capability | Exchange Online | Other Solutions |
|---|---|---|
| Verifies protections are enabled and tuned | Manual | Native checks |
| Best-practice baseline comparison | Limited | Native |
| Compliance mapping | No | Yes |
| Unified with identity and device posture | No | Yes |
As shown, EOP provides essential management features that help you maintain a secure email environment. Its cloud-based nature means you do not need to invest in additional hardware or software, further simplifying your IT infrastructure.
In summary, Exchange Online Protection (EOP) plays a crucial role in safeguarding your email communications. It offers real-time threat detection, anti-phishing, and anti-spam filtering, ensuring your organization remains secure. Key features like malware filtering and customizable policies enhance your defenses against sophisticated threats.
To maximize EOP's effectiveness, you should implement best practices, such as regular updates and user training. Staying informed about evolving email security threats is essential. By doing so, you can protect your organization from potential risks and maintain a secure email environment.
FAQ
What is Exchange Online Protection (EOP)?
EOP is a cloud-based email security service from Microsoft. It protects your organization from spam, malware, and phishing attacks, ensuring safe email communications.
How does EOP filter spam?
EOP uses advanced algorithms to analyze incoming emails. It identifies and blocks spam based on known patterns, sender reputation, and content analysis.
Can I customize EOP settings?
Yes, you can customize EOP settings through the Microsoft 365 admin center. You can create policies tailored to your organization's specific needs.
Does EOP protect against ransomware?
EOP provides protection against various email threats, including ransomware. Its anti-malware features scan attachments and links to block harmful content.
How often does EOP update its filters?
EOP updates its filters continuously. Microsoft regularly enhances its threat intelligence to adapt to new and evolving email threats.
Is training necessary for EOP users?
Yes, user training is essential. Educating employees about phishing and other threats helps them recognize suspicious emails and enhances overall security.
What support options are available for EOP?
EOP offers 24/7 IT-level phone support at no extra cost. You can also access online resources and documentation for additional assistance.
Can EOP be integrated with other Microsoft services?
Absolutely! EOP integrates seamlessly with Exchange Online and Microsoft Defender for Office 365, providing a comprehensive email security solution.
Last reviewed: July 2026.
What You’ll Learn
- What EOP protects and where its baseline capabilities begin and end.
- How email policies, reporting, and ongoing tuning support real-world operations.
- When to combine EOP with broader Microsoft Defender for Office 365 controls.
Who Should Listen
This episode is for Microsoft 365 administrators, IT professionals, architects, and business owners who need a practical understanding of Exchange Online Protection before planning, configuring, or supporting it.
🎧 You Should Also Listen To
- Microsoft Defender for Office 365 — Continue with advanced phishing and collaboration threat protection.
- Microsoft Defender for Identity — Learn how identity signals can add context to email-related incidents.
🚀 Want to be part of m365.fm?
Then stop just listening… and start showing up.
👉 Connect with me on LinkedIn and let’s make something happen:
- 🎙️ Be a podcast guest and share your story
- 🎧 Host your own episode (yes, seriously)
- 💡 Pitch topics the community actually wants to hear
- 🌍 Build your personal brand in the Microsoft 365 space
This isn’t just a podcast — it’s a platform for people who take action.
🔥 Most people wait. The best ones don’t.
👉 Connect with me on LinkedIn and send me a message:
"I want in"
Let’s build something awesome 👊
1
00:00:00,000 --> 00:00:03,800
Welcome to another episode of Microsoft Knowledge Nuggets on M365.
2
00:00:03,800 --> 00:00:05,200
FM, I'm Mirko Peters.
3
00:00:05,200 --> 00:00:07,920
Today's topic is something every business relies on, but rarely
4
00:00:07,920 --> 00:00:09,760
thinks about email security.
5
00:00:09,760 --> 00:00:11,200
Here's a number that should stop you.
6
00:00:11,200 --> 00:00:15,440
90% of all cyber attacks on businesses start in one place, the inbox,
7
00:00:15,440 --> 00:00:18,960
not a hacked server, not a compromised app, just a single email.
8
00:00:18,960 --> 00:00:22,240
And if you're like most people, you assume your email is protected, you're right.
9
00:00:22,240 --> 00:00:25,720
It is, but you probably don't know how aware that protection stops.
10
00:00:25,720 --> 00:00:28,320
By the end of this episode, you'll know exactly what
11
00:00:28,320 --> 00:00:31,680
exchange online protection does, where its limits are and whether you need something
12
00:00:31,680 --> 00:00:35,440
more, we'll cover three filtering layers, a safety net that catches what slips
13
00:00:35,440 --> 00:00:38,440
through and the upgrade decision that could save your business.
14
00:00:38,440 --> 00:00:39,960
Here's the simplest definition.
15
00:00:39,960 --> 00:00:42,600
What exactly is exchange online protection?
16
00:00:42,600 --> 00:00:47,200
Exchange online protection or EOP is the built in email security layer that
17
00:00:47,200 --> 00:00:49,400
comes with every Microsoft 365 plan.
18
00:00:49,400 --> 00:00:52,320
No extra cost, no setup required for basic protection.
19
00:00:52,320 --> 00:00:53,200
It's just there.
20
00:00:53,200 --> 00:00:56,560
Think of it like the front gate security guard at your office building that
21
00:00:56,560 --> 00:01:00,480
guard checks everyone who walks in, looks at their badge, verifies they belong.
22
00:01:00,480 --> 00:01:03,440
But once they're through the door, the guard doesn't follow them around.
23
00:01:03,440 --> 00:01:04,960
And that's exactly what EOP does.
24
00:01:04,960 --> 00:01:09,240
It has three core jobs, stops, bam, block malware and catch basic fishing.
25
00:01:09,240 --> 00:01:10,360
Everything runs in the cloud.
26
00:01:10,360 --> 00:01:12,880
So you don't have to maintain servers or update software.
27
00:01:12,880 --> 00:01:14,080
Here's the key point.
28
00:01:14,080 --> 00:01:17,960
EOP is always on, even if you never touch a single setting.
29
00:01:17,960 --> 00:01:21,640
You could buy a Microsoft 365 license, never open the admin center.
30
00:01:21,640 --> 00:01:25,120
And EOP would still be filtering your email, but it's not a full security
31
00:01:25,120 --> 00:01:27,160
suite. It's the foundation, the bare minimum.
32
00:01:27,160 --> 00:01:30,160
And since you're already paying for it as a beginner, you might as well understand
33
00:01:30,160 --> 00:01:30,680
what you've got.
34
00:01:30,680 --> 00:01:33,000
Layer one, anti spam.
35
00:01:33,000 --> 00:01:35,960
Let's start with the first layer, the one that handles the most noise.
36
00:01:35,960 --> 00:01:40,680
Spam, spam is volume about 99% of unwanted email is just bulk junk.
37
00:01:40,680 --> 00:01:44,280
Newsletters you never signed up for, promotional offers, random garbage,
38
00:01:44,280 --> 00:01:46,000
but spam isn't just annoying.
39
00:01:46,000 --> 00:01:48,200
It's also the cover that attack us hide behind.
40
00:01:48,200 --> 00:01:50,360
So how does EOP filter it?
41
00:01:50,360 --> 00:01:51,040
Three ways.
42
00:01:51,040 --> 00:01:52,480
First connection filtering.
43
00:01:52,840 --> 00:01:56,960
EOP checks the IP address of the sending server against known reputation lists.
44
00:01:56,960 --> 00:02:01,000
If that IP has a history of sending spam, the message gets blocked before it
45
00:02:01,000 --> 00:02:02,240
even reaches your mailbox.
46
00:02:02,240 --> 00:02:06,440
Second, content filtering, EOP scans the actual words and patterns in the email.
47
00:02:06,440 --> 00:02:09,960
Subject lines, body text embedded links, it looks for signs of spam.
48
00:02:09,960 --> 00:02:12,600
Third, bulk, complained feedback loops.
49
00:02:12,600 --> 00:02:16,720
If enough people mark a sender, a spam EOP learns and starts blocking that sender
50
00:02:16,720 --> 00:02:18,280
for everyone, the goal is simple.
51
00:02:18,280 --> 00:02:21,720
Keep spam out of your inbox without accidentally deleting legitimate mail.
52
00:02:21,840 --> 00:02:23,280
So what happens to flag spam?
53
00:02:23,280 --> 00:02:25,520
It goes to quarantine or to the user's junk folder.
54
00:02:25,520 --> 00:02:29,560
Admins can customize which one, for example, say a sender from a known spam list
55
00:02:29,560 --> 00:02:30,600
tries to send you an offer.
56
00:02:30,600 --> 00:02:35,320
EOP sees the IP recognizes it and blocks the message before you ever see it.
57
00:02:35,320 --> 00:02:37,400
Most users never notice this happening.
58
00:02:37,400 --> 00:02:40,440
It's completely invisible when it works, but admins have controls.
59
00:02:40,440 --> 00:02:43,760
You can adjust how aggressive the filter is, standard or strict.
60
00:02:43,760 --> 00:02:46,120
You can set a loud and blocked sender lists.
61
00:02:46,120 --> 00:02:50,920
You can configure quarantine notifications, so users know when something was held back.
62
00:02:51,360 --> 00:02:52,200
Why does this matter?
63
00:02:52,200 --> 00:02:56,320
Because spam is the bulk of all email attacks, filtering it out reduces the noise
64
00:02:56,320 --> 00:02:57,080
for the other layers.
65
00:02:57,080 --> 00:03:00,920
That means the anti-malware and anti-fishing systems can focus on the real threats
66
00:03:00,920 --> 00:03:02,280
instead of drowning in junk.
67
00:03:02,280 --> 00:03:05,640
Layer two, anti-malware, spam is mostly annoying.
68
00:03:05,640 --> 00:03:07,200
Malware is dangerous.
69
00:03:07,200 --> 00:03:09,480
So let's talk about the second layer, anti-malware.
70
00:03:09,480 --> 00:03:13,160
This is what catches viruses, ransomware and trojans hidden inside attachments.
71
00:03:13,160 --> 00:03:14,000
Here's how it works.
72
00:03:14,000 --> 00:03:17,840
When an email arrives with an attachment, EOP inspects that file in real time
73
00:03:17,840 --> 00:03:19,720
against a database of known malware signatures.
74
00:03:20,200 --> 00:03:24,080
It also uses heuristics, behavioral patterns that suggest something is off.
75
00:03:24,080 --> 00:03:25,440
So what exactly does it block?
76
00:03:25,440 --> 00:03:29,040
By default, EOP blocks executable files like X and us,
77
00:03:29,040 --> 00:03:31,760
X-KR, it blocks scripts like VBEs and .js.
78
00:03:31,760 --> 00:03:35,600
It blocks archives that contain suspicious code, a whole list of common dangerous
79
00:03:35,600 --> 00:03:36,160
file types.
80
00:03:36,160 --> 00:03:37,920
But here's the critical limitation.
81
00:03:37,920 --> 00:03:39,920
EOP does not sandbox unknown files.
82
00:03:39,920 --> 00:03:42,440
They can only catch threats that have already been identified.
83
00:03:42,440 --> 00:03:45,880
If a brand new piece of malware lands in your inbox that nobody has ever seen
84
00:03:45,880 --> 00:03:47,920
before, EOP has no signature for it.
85
00:03:47,920 --> 00:03:49,120
So that message gets delivered.
86
00:03:49,360 --> 00:03:52,600
Catching zero-day malware requires defender for Office 365,
87
00:03:52,600 --> 00:03:56,800
which detonates those unknown files in an isolated sandbox to see what they actually do.
88
00:03:56,800 --> 00:03:58,280
Let's make this concrete.
89
00:03:58,280 --> 00:04:01,640
Say someone sends you a PDF with an embedded macro that's known to be malicious.
90
00:04:01,640 --> 00:04:05,320
EOP recognizes that signature quarantines the message and you never see it.
91
00:04:05,320 --> 00:04:07,200
The malware never touches your computer.
92
00:04:07,200 --> 00:04:08,080
That's the good news.
93
00:04:08,080 --> 00:04:09,560
What happens to detected malware?
94
00:04:09,560 --> 00:04:11,760
The message gets quarantined or rejected entirely.
95
00:04:11,760 --> 00:04:13,120
It never reaches your inbox.
96
00:04:13,120 --> 00:04:16,480
There's a backup system called zero-hour autopage, ZAP for short.
97
00:04:17,040 --> 00:04:20,040
If a malicious attachment somehow gets delivered and then Microsoft's threat
98
00:04:20,040 --> 00:04:24,200
intelligence updates, ZAP can retroactively remove that message from your inbox.
99
00:04:24,200 --> 00:04:25,640
We'll cover ZAP in detail later.
100
00:04:25,640 --> 00:04:27,520
But for now, here's why this matters to you.
101
00:04:27,520 --> 00:04:30,200
Most ransomware starts as a malware-laden email.
102
00:04:30,200 --> 00:04:34,040
Someone opens an attachment and within minutes their entire company is locked out of
103
00:04:34,040 --> 00:04:34,560
its files.
104
00:04:34,560 --> 00:04:38,400
EOP catches the known stuff, which is still the vast majority of attacks.
105
00:04:38,400 --> 00:04:41,640
It won't stop everything, but it stops enough to make a real difference.
106
00:04:41,640 --> 00:04:43,680
Layer three, anti-fishing.
107
00:04:43,680 --> 00:04:46,120
So now we get to the layer that fools people the most.
108
00:04:46,400 --> 00:04:48,760
Fishing is different from spam and malware.
109
00:04:48,760 --> 00:04:49,760
It's not about code.
110
00:04:49,760 --> 00:04:53,440
It's about trickery, fake login pages that look identical to the real thing,
111
00:04:53,440 --> 00:04:55,880
urgent requests that demand immediate action.
112
00:04:55,880 --> 00:04:58,160
Sender addresses that are slightly misspelled,
113
00:04:58,160 --> 00:05:00,720
Microsoft and Com instead of Microsoft.com.
114
00:05:00,720 --> 00:05:03,120
This is social engineering, not a technical exploit.
115
00:05:03,120 --> 00:05:05,360
So what does EOP actually do against fishing?
116
00:05:05,360 --> 00:05:06,280
Three main things.
117
00:05:06,280 --> 00:05:07,800
First, spoof intelligence.
118
00:05:07,800 --> 00:05:10,760
EOP checks whether the senders address has been forged.
119
00:05:10,760 --> 00:05:14,680
If an email claims to be from your bank, but the underlying authentication fails,
120
00:05:14,680 --> 00:05:15,920
EOP flags it.
121
00:05:16,320 --> 00:05:18,840
Second, it verifies email authentication protocols.
122
00:05:18,840 --> 00:05:20,680
That's SPF, decam and demarc.
123
00:05:20,680 --> 00:05:24,600
These are technical records in DNS that confirm the sender is allowed to use a domain.
124
00:05:24,600 --> 00:05:28,680
Third, it uses machine learning models that look at sender behavior patterns
125
00:05:28,680 --> 00:05:30,040
to spot anything suspicious.
126
00:05:30,040 --> 00:05:31,920
But here's what EOP does not do.
127
00:05:31,920 --> 00:05:34,200
It does not detect impersonation of specific people.
128
00:05:34,200 --> 00:05:37,080
So if an email looks like it's from your CEO asking for gift cards,
129
00:05:37,080 --> 00:05:39,040
EOP probably won't see that as dangerous.
130
00:05:39,040 --> 00:05:41,840
It can't learn who your executives are and protect them directly.
131
00:05:41,840 --> 00:05:43,960
That requires defender for Office 365.
132
00:05:43,960 --> 00:05:45,600
It also doesn't scan links at click time.
133
00:05:45,800 --> 00:05:49,760
If a link in an email looks clean when it arrives, but turns malicious two hours later,
134
00:05:49,760 --> 00:05:51,560
EOP won't catch it.
135
00:05:51,560 --> 00:05:52,800
Let's use an example.
136
00:05:52,800 --> 00:05:55,120
You get an email that appears to be from your boss.
137
00:05:55,120 --> 00:05:57,080
The display name says Sarah Johnson.
138
00:05:57,080 --> 00:05:59,840
The message says she needs you to buy gift cards for a client,
139
00:05:59,840 --> 00:06:01,840
but the actual sender address is Sarah.
140
00:06:01,840 --> 00:06:03,280
chasehanson@gmail.com.
141
00:06:03,280 --> 00:06:04,680
A zero instead of an O.
142
00:06:04,680 --> 00:06:08,720
EOP might flag this of the domain looks suspicious or if authentication fails,
143
00:06:08,720 --> 00:06:11,960
but it won't recognize that Sarah Johnson is your actual boss.
144
00:06:11,960 --> 00:06:13,880
And this is a targeted impersonation attack.
145
00:06:13,880 --> 00:06:14,920
That's a big gap.
146
00:06:14,960 --> 00:06:16,200
And this is where D mark comes in.
147
00:06:16,200 --> 00:06:21,440
D mark is a DNS record that tells receiving mail servers what to do with emails that fail authentication.
148
00:06:21,440 --> 00:06:24,120
If you publish a strict D mark policy for your domain,
149
00:06:24,120 --> 00:06:27,800
it becomes much harder for attackers to spoof your company's email addresses.
150
00:06:27,800 --> 00:06:32,000
EOP uses D mark information when it's available, but it can't enforce it for you.
151
00:06:32,000 --> 00:06:33,280
You have to set it up yourself.
152
00:06:33,280 --> 00:06:34,760
That's why user awareness matters.
153
00:06:34,760 --> 00:06:38,520
Even with EOP, some fishing emails will get through, especially the targeted ones.
154
00:06:38,520 --> 00:06:43,720
EOP can add safety tips to emails like a warning that says this sender is not verified,
155
00:06:44,080 --> 00:06:45,320
but those have to be enabled.
156
00:06:45,320 --> 00:06:46,360
So here's the takeaway.
157
00:06:46,360 --> 00:06:48,920
Classics, bam filtering can't stop social engineering.
158
00:06:48,920 --> 00:06:52,440
EOP's anti-fishing blocks a lot of basic fishing, but it has clear limits.
159
00:06:52,440 --> 00:06:55,320
And those limits are exactly where attackers focus their efforts.
160
00:06:55,320 --> 00:06:59,000
The retroactive safety net zero hour auto purge.
161
00:06:59,000 --> 00:07:03,400
So what happens when a bad email slips through those three layers, it will no filter is perfect.
162
00:07:03,400 --> 00:07:05,400
That's where zero hour auto purge comes in.
163
00:07:05,400 --> 00:07:07,640
Zap for short, this is EOP's safety net.
164
00:07:07,640 --> 00:07:08,520
Here's how it works.
165
00:07:08,520 --> 00:07:12,000
Zap continuously scans messages that were already delivered to inboxes.
166
00:07:12,000 --> 00:07:15,840
If Microsoft's threat intelligence updates in a new verdict comes in,
167
00:07:15,840 --> 00:07:19,600
say a message that looked clean two hours ago is now flagged as malware.
168
00:07:19,600 --> 00:07:21,640
Zap automatically removes it.
169
00:07:21,640 --> 00:07:23,920
No one has to push a button, it just happens.
170
00:07:23,920 --> 00:07:26,280
The window is 48 hours from delivery.
171
00:07:26,280 --> 00:07:29,480
That might not sound like a lot, but it covers most delayed detections.
172
00:07:29,480 --> 00:07:33,160
Attackers often use tricks where a file or link is benign when it arrives,
173
00:07:33,160 --> 00:07:35,080
then turns malicious hours later.
174
00:07:35,080 --> 00:07:36,320
Zap catches that shift.
175
00:07:36,320 --> 00:07:39,560
It covers spam, fishing, high confidence fishing, and malware.
176
00:07:39,560 --> 00:07:42,960
Each verdict triggers a different action based on your existing policies,
177
00:07:42,960 --> 00:07:45,680
usually moving the message to quarantine or the junk folder.
178
00:07:45,680 --> 00:07:50,360
Now here's something new, as of early 2026, Zap expanded to two additional places.
179
00:07:50,360 --> 00:07:52,600
First, Microsoft Teams chat messages.
180
00:07:52,600 --> 00:07:55,680
If a malicious link or file gets shared in a Teams chat,
181
00:07:55,680 --> 00:07:59,000
Zap can retroactively remove it for everyone in that conversation.
182
00:07:59,000 --> 00:08:00,640
Second, the deleted items folder.
183
00:08:00,640 --> 00:08:01,800
This one matters a lot.
184
00:08:01,800 --> 00:08:06,520
Previously, if a user deleted a malicious email themselves, Zap wouldn't touch it.
185
00:08:06,520 --> 00:08:08,440
It was already gone, but here's the problem.
186
00:08:08,440 --> 00:08:10,320
Deleted items can be restored.
187
00:08:10,320 --> 00:08:13,240
So now Zap scans the deleted items folder too.
188
00:08:13,240 --> 00:08:15,320
If it finds something dangerous at quarantines at there,
189
00:08:15,320 --> 00:08:18,720
that means even emails users threw away thinking they were harmless get cleaned up.
190
00:08:18,720 --> 00:08:21,360
And here's the best part, no admin action needed.
191
00:08:21,360 --> 00:08:25,160
Zap is enabled by default for every single exchange online mailbox.
192
00:08:25,160 --> 00:08:26,000
You didn't turn it on.
193
00:08:26,000 --> 00:08:27,760
It was just there from day one.
194
00:08:27,760 --> 00:08:29,200
Let me give you a concrete example.
195
00:08:29,200 --> 00:08:32,920
Say a malicious PDF gets through your initial filters because it's a brand new variant.
196
00:08:32,920 --> 00:08:35,520
No signature exists for it yet, so it lands in your inbox.
197
00:08:35,520 --> 00:08:38,280
Two hours later, Microsoft's threat intelligence team
198
00:08:38,280 --> 00:08:39,720
updates their signatures.
199
00:08:39,720 --> 00:08:42,000
They've now identified that file as dangerous.
200
00:08:42,000 --> 00:08:45,760
Zap scans your inbox, finds that email and moves it to quarantine.
201
00:08:45,760 --> 00:08:46,680
Silently.
202
00:08:46,680 --> 00:08:47,760
You never knew it was there.
203
00:08:47,760 --> 00:08:48,840
You never clicked it.
204
00:08:48,840 --> 00:08:51,400
And by the time you check your email later, it's already gone.
205
00:08:51,400 --> 00:08:52,600
What does the user see?
206
00:08:52,600 --> 00:08:54,160
The email disappears from their inbox.
207
00:08:54,160 --> 00:08:57,920
They might get a quarantine notification depending on how their admin set things up.
208
00:08:57,920 --> 00:08:59,440
But most of the time it's invisible.
209
00:08:59,440 --> 00:09:00,640
The threat just vanishes.
210
00:09:00,640 --> 00:09:01,440
Why does this matter?
211
00:09:01,440 --> 00:09:03,080
Because a tag detection isn't instant.
212
00:09:03,080 --> 00:09:06,920
There's always a gap between when a threat arrives and when it gets identified.
213
00:09:06,920 --> 00:09:08,360
Zap covers that gap.
214
00:09:08,360 --> 00:09:12,640
It's the safety net underneath everything else and it works for every single EOP customer,
215
00:09:12,640 --> 00:09:16,080
whether you're a solo freelancer or a thousand person company.
216
00:09:16,080 --> 00:09:17,520
The limits of EOP.
217
00:09:17,520 --> 00:09:22,000
So Zap is great at catching what slips through, but it has limits and so does EOP overall.
218
00:09:22,000 --> 00:09:25,200
Let's be straight about what this free layer can and can't do.
219
00:09:25,200 --> 00:09:27,240
EOP handles volume filtering really well.
220
00:09:27,240 --> 00:09:31,200
Commodity spam, known malware, basic phishing, it blocks that stuff at scale.
221
00:09:31,200 --> 00:09:35,360
Microsoft's own SLA says it catches over 99% of spam with a false positive rate below
222
00:09:35,360 --> 00:09:37,680
1 in 250,000.
223
00:09:37,680 --> 00:09:41,680
Those are solid numbers for everyday threats, but for targeted sophisticated attacks, EOP
224
00:09:41,680 --> 00:09:42,680
isn't enough.
225
00:09:42,680 --> 00:09:43,680
Here's where it falls short.
226
00:09:43,680 --> 00:09:44,840
No sandbox detonation.
227
00:09:44,840 --> 00:09:49,360
If an attachment is brand new and nobody has ever seen it, EOP can't open it in a safe
228
00:09:49,360 --> 00:09:50,880
environment to see what it does.
229
00:09:50,880 --> 00:09:52,960
It just delivers the message and hopes for the best.
230
00:09:52,960 --> 00:09:55,160
That's a big gap, no real-time link scanning.
231
00:09:55,160 --> 00:09:58,960
EOP checks URLs when the email arrives, but it doesn't check them again when you click.
232
00:09:58,960 --> 00:09:59,960
Attackers know this trick.
233
00:09:59,960 --> 00:10:04,000
They send a clean link, wait for it to pass inspection, then flip it to malicious after delivery.
234
00:10:04,000 --> 00:10:05,320
EOP won't catch that.
235
00:10:05,320 --> 00:10:06,800
No impersonation protection.
236
00:10:06,800 --> 00:10:11,800
EOP can detect spoofed domains like Microsoft, comments that of Microsoft.com, but it can't
237
00:10:11,800 --> 00:10:15,560
learn who your CEO is and flag emails pretending to be them.
238
00:10:15,560 --> 00:10:19,520
That's a completely different level of detection, and no automated investigation or response.
239
00:10:19,520 --> 00:10:23,560
If a threat does get through, EOP can't hunt for it across your environment, find other
240
00:10:23,560 --> 00:10:26,440
affected users, or automatically clean things up.
241
00:10:26,440 --> 00:10:28,080
That requires Defender Plan 2.
242
00:10:28,080 --> 00:10:30,200
Now look at the real threat landscape right now.
243
00:10:30,200 --> 00:10:35,040
Recent research shows 50% of attacks can bypass endpoint-only defenses entirely.
244
00:10:35,040 --> 00:10:39,000
When phishing as a service kits are making sophisticated attacks cheap and accessible, for a few
245
00:10:39,000 --> 00:10:41,880
hundred dollars, criminals can buy a complete phishing kit.
246
00:10:41,880 --> 00:10:44,680
Fake websites, email templates, even tech support.
247
00:10:44,680 --> 00:10:47,880
This isn't scriptkitties anymore, it's organized crime with a subscription model.
248
00:10:47,880 --> 00:10:49,120
Here's a real example.
249
00:10:49,120 --> 00:10:53,400
Say an attacker sends a zero-day malware sample hidden inside a password protected archive.
250
00:10:53,400 --> 00:10:54,920
EOP can't open that archive.
251
00:10:54,920 --> 00:10:56,880
It has no way to inspect the contents.
252
00:10:56,880 --> 00:10:58,200
The message gets delivered.
253
00:10:58,200 --> 00:11:02,680
But Defender for Office 365, it can detonate that file in an isolated sandbox, enter
254
00:11:02,680 --> 00:11:05,880
the password and see exactly what the malware does.
255
00:11:05,880 --> 00:11:07,120
That's the difference.
256
00:11:07,120 --> 00:11:08,640
The real world impact is serious.
257
00:11:08,640 --> 00:11:12,640
A business running only EOP is vulnerable to business email compromise.
258
00:11:12,640 --> 00:11:17,760
BEC attacks where someone impersonates an executive and tricks an employee into wiring money
259
00:11:17,760 --> 00:11:19,440
or sharing sensitive data.
260
00:11:19,440 --> 00:11:20,800
These attacks don't use malware.
261
00:11:20,800 --> 00:11:22,080
They use psychology.
262
00:11:22,080 --> 00:11:25,040
And EOP has no defense against that, but here's the good news.
263
00:11:25,040 --> 00:11:28,160
EOP still stops the vast majority of commodity attacks.
264
00:11:28,160 --> 00:11:32,280
The drive-by phishing, the mass market ransomware, the obvious spam it all gets filtered before
265
00:11:32,280 --> 00:11:33,280
you ever see it.
266
00:11:33,280 --> 00:11:36,360
For the average small business, EOP is a solid foundation.
267
00:11:36,360 --> 00:11:37,920
It's just not the whole house.
268
00:11:37,920 --> 00:11:41,360
When you need Defender for Office 365, so when do you need to upgrade?
269
00:11:41,360 --> 00:11:46,120
Let's talk about Defender for Office 365 because this is where EOP's gaps get filled.
270
00:11:46,120 --> 00:11:48,840
Defender plan one runs about $2 per user per month.
271
00:11:48,840 --> 00:11:53,000
It's included in Microsoft 365 Business Premium and E5 subscriptions.
272
00:11:53,000 --> 00:11:57,160
And as of August 2026, Microsoft is rolling it into E3 as well, so if you're on E3 check
273
00:11:57,160 --> 00:11:59,600
your licensing because you might already have it.
274
00:11:59,600 --> 00:12:00,840
What does plan one add?
275
00:12:00,840 --> 00:12:02,000
Three big things.
276
00:12:02,000 --> 00:12:03,000
Safe attachments.
277
00:12:03,000 --> 00:12:05,480
This is the sandbox detonation we talked about earlier.
278
00:12:05,480 --> 00:12:09,320
When an unknown file arrives, Defender opens it in an isolated environment and watches
279
00:12:09,320 --> 00:12:10,320
what it does.
280
00:12:10,320 --> 00:12:14,000
If it tries to encrypt files or phone home to a command server, Defender catches it and
281
00:12:14,000 --> 00:12:15,000
blocks delivery.
282
00:12:15,000 --> 00:12:16,000
EOP can't do that.
283
00:12:16,000 --> 00:12:17,000
Safe links.
284
00:12:17,000 --> 00:12:20,480
This scans every URL at the moment you click it, not just when the email arrives.
285
00:12:20,480 --> 00:12:25,000
If a link was clean at delivery but turns malicious two hours later, Safe links catches it.
286
00:12:25,000 --> 00:12:27,000
It blocks the page before you ever see it.
287
00:12:27,000 --> 00:12:29,720
This closes the time gap that attackers love to exploit.
288
00:12:29,720 --> 00:12:31,680
Impersonation protection.
289
00:12:31,680 --> 00:12:36,400
Defender learns who your executives are, your CEO, your CFO, your HR director.
290
00:12:36,400 --> 00:12:39,320
It builds a relationship map of who they normally email.
291
00:12:39,320 --> 00:12:43,040
Then when a message arrives pretending to be one of them, Defender flags it, even if
292
00:12:43,040 --> 00:12:46,280
the sending domain passes all authentication checks.
293
00:12:46,280 --> 00:12:50,800
That's the difference between catching a spoofed domain and catching a targeted CEO fraud attempt.
294
00:12:50,800 --> 00:12:52,120
Now there's Defender plan two.
295
00:12:52,120 --> 00:12:55,000
That's about $5 per user per month, included in E5.
296
00:12:55,000 --> 00:12:57,600
Plan two adds investigation and response capabilities.
297
00:12:57,600 --> 00:13:00,840
Threat Explorer gives you 30 days of detailed message to let me know.
298
00:13:00,840 --> 00:13:05,400
You can answer questions like who else received this phishing email and who clicked the link
299
00:13:05,400 --> 00:13:07,000
in minutes instead of hours.
300
00:13:07,000 --> 00:13:13,160
An automated investigation and response, AIR runs playbooks automatically when a user reports
301
00:13:13,160 --> 00:13:14,160
phishing.
302
00:13:14,160 --> 00:13:18,840
It finds all affected recipients, evaluates clicks and queues remediation for approval that
303
00:13:18,840 --> 00:13:21,040
can reduce dwell time from days to minutes.
304
00:13:21,040 --> 00:13:22,040
So how do you decide?
305
00:13:22,040 --> 00:13:23,600
Here's a practical guide.
306
00:13:23,600 --> 00:13:28,480
If you're a small business in a low-risk industry with basic needs, EOP might be sufficient.
307
00:13:28,480 --> 00:13:30,800
But seriously consider Defender plan one anyway.
308
00:13:30,800 --> 00:13:33,640
The cost is tiny compared to what are single-breach costs.
309
00:13:33,640 --> 00:13:38,000
If your business has executives who are visible targets and let's be honest, most do, Defender
310
00:13:38,000 --> 00:13:39,960
plan one is almost mandatory.
311
00:13:39,960 --> 00:13:43,800
Business email compromise attacks target the people with authority to move money or approve
312
00:13:43,800 --> 00:13:44,800
payments.
313
00:13:44,800 --> 00:13:46,080
EOP alone won't stop them.
314
00:13:46,080 --> 00:13:49,640
If you have regulatory requirements or handle high volumes of sensitive email, consider
315
00:13:49,640 --> 00:13:50,720
plan two.
316
00:13:50,720 --> 00:13:53,480
The automation and hunting capabilities make a real difference when you need to prove
317
00:13:53,480 --> 00:13:55,000
compliance and respond quickly.
318
00:13:55,000 --> 00:13:56,000
Here's a real example.
319
00:13:56,000 --> 00:13:58,680
A 50-person company fell for a fake invoice last year.
320
00:13:58,680 --> 00:14:02,120
An email that looked exactly like the Avengers Standard Billing format.
321
00:14:02,120 --> 00:14:03,440
The finance team paid it.
322
00:14:03,440 --> 00:14:04,960
$20,000 gone.
323
00:14:04,960 --> 00:14:08,520
Defender's impersonation protection would have caught that email because it recognized
324
00:14:08,520 --> 00:14:10,040
the vendor domain was slightly off.
325
00:14:10,040 --> 00:14:11,800
EOP alone didn't flag it.
326
00:14:11,800 --> 00:14:12,800
And here's the thing.
327
00:14:12,800 --> 00:14:17,520
The cost of a breach lost data, ransomware payouts, reputation damage, customer trust.
328
00:14:17,520 --> 00:14:20,240
Dwarfs the per-user cost of Defender by orders of magnitude.
329
00:14:20,240 --> 00:14:23,120
$2 per user per month is less than a cup of coffee.
330
00:14:23,120 --> 00:14:26,440
A single ransomware attack can cost hundreds of thousands.
331
00:14:26,440 --> 00:14:27,680
How it all fits together.
332
00:14:27,680 --> 00:14:30,360
So here's how these pieces actually connect.
333
00:14:30,360 --> 00:14:31,960
That's where the real understanding comes from.
334
00:14:31,960 --> 00:14:33,240
EOP is the base layer.
335
00:14:33,240 --> 00:14:38,360
It's always on, handles the bulk filtering, and stops about 99% of the noise before it ever
336
00:14:38,360 --> 00:14:39,360
reaches you.
337
00:14:39,360 --> 00:14:41,280
That's the foundation.
338
00:14:41,280 --> 00:14:43,720
Defender plan one adds the smart layer on top.
339
00:14:43,720 --> 00:14:48,040
Real-time link scanning, sandbox analysis for attachments, impersonation detection.
340
00:14:48,040 --> 00:14:50,360
This is where those targeted attacks get caught.
341
00:14:50,360 --> 00:14:53,800
Defender plan two sits above that with investigation and automation.
342
00:14:53,800 --> 00:14:56,600
Threat hunting automated response campaign correlation.
343
00:14:56,600 --> 00:14:59,720
This takes you from reactive cleanup to proactive defense.
344
00:14:59,720 --> 00:15:02,480
Together they form Microsoft's email security stack.
345
00:15:02,480 --> 00:15:03,960
And here's the important point.
346
00:15:03,960 --> 00:15:05,840
They're not three separate tools.
347
00:15:05,840 --> 00:15:07,560
It's one system with three tiers.
348
00:15:07,560 --> 00:15:10,840
You buy what you need and the integration is already built in.
349
00:15:10,840 --> 00:15:12,320
Remember the office building analogy.
350
00:15:12,320 --> 00:15:15,640
EOP is the front gate security guard checking IDs.
351
00:15:15,640 --> 00:15:18,920
Defender plan one is the security cameras and badge readers inside.
352
00:15:18,920 --> 00:15:21,360
Watching what people do after they get through the door.
353
00:15:21,360 --> 00:15:25,480
Defender plan two is the security operations center monitoring everything, connecting signals
354
00:15:25,480 --> 00:15:27,400
and dispatching response.
355
00:15:27,400 --> 00:15:29,600
Integration matters because the pieces talk to each other.
356
00:15:29,600 --> 00:15:33,320
When a user reports a fishing email, Defender automatically connects that report with other
357
00:15:33,320 --> 00:15:34,640
signals across the stack.
358
00:15:34,640 --> 00:15:37,080
It checks if the same sender targeted other users.
359
00:15:37,080 --> 00:15:39,400
It looks for similar patterns in email traffic.
360
00:15:39,400 --> 00:15:42,560
It connects dots that a human analyst would take hours to find.
361
00:15:42,560 --> 00:15:44,480
And Zap works across all layers.
362
00:15:44,480 --> 00:15:49,000
Whether a verdict comes from EOP's signature database or Defender sandbox analysis,
363
00:15:49,000 --> 00:15:53,040
if the determination changes after delivery, Zap removes that message retroactively.
364
00:15:53,040 --> 00:15:55,760
It's the common safety net underneath everything.
365
00:15:55,760 --> 00:15:57,240
Here's the real knowledge nugget.
366
00:15:57,240 --> 00:16:00,400
Email security isn't a single product you buy and forget about.
367
00:16:00,400 --> 00:16:02,680
It's layers that build on each other.
368
00:16:02,680 --> 00:16:06,560
Buy what you need but understand the gaps because the gaps are exactly where attackers are
369
00:16:06,560 --> 00:16:08,040
looking.
370
00:16:08,040 --> 00:16:09,520
So what should you do now?
371
00:16:09,520 --> 00:16:10,520
Start with something free.
372
00:16:10,520 --> 00:16:13,680
Check that your domain has a DMR record published in DNS.
373
00:16:13,680 --> 00:16:17,320
That alone improves EOP's effectiveness against spoofing attacks.
374
00:16:17,320 --> 00:16:22,200
Second, if your organization deals with sensitive data or has visible executives, trial defender
375
00:16:22,200 --> 00:16:25,680
plan one, the cost is small and the protection is significant.
376
00:16:25,680 --> 00:16:27,680
And remember, no tool catches everything.
377
00:16:27,680 --> 00:16:28,920
Train your users to spot fishing.
378
00:16:28,920 --> 00:16:30,440
They're the last line of defense.
379
00:16:30,440 --> 00:16:34,280
Hit subscribe for more plain English breakdowns of Microsoft security and drop a comment
380
00:16:34,280 --> 00:16:35,280
if this helped.
Founder of m365.fm, m365.show and m365con.net
Mirko Peters is a Microsoft 365 expert, content creator, and founder of m365.fm, a platform dedicated to sharing practical insights on modern workplace technologies. His work focuses on Microsoft 365 governance, security, collaboration, and real-world implementation strategies.
Through his podcast and written content, Mirko provides hands-on guidance for IT professionals, architects, and business leaders navigating the complexities of Microsoft 365. He is known for translating complex topics into clear, actionable advice, often highlighting common mistakes and overlooked risks in real-world environments.
With a strong emphasis on community contribution and knowledge sharing, Mirko is actively building a platform that connects experts, shares experiences, and helps organizations get the most out of their Microsoft 365 investments.
