Microsoft Exchange Online Protection Explained

What Is Exchange Online Protection?

Exchange Online Protection (EOP) is the email filtering infrastructure that Microsoft uses to process all email for Microsoft 365 mailboxes. Every Microsoft 365 plan — from Business Basic through to Enterprise E5 — includes EOP as a standard component. Email flows through EOP before reaching user inboxes, with EOP applying filtering rules at each stage.

EOP applies filtering in a defined sequence: connection filtering (checking the sending IP against blocklists), anti-malware scanning (checking attachments for known malware), anti-spam (scoring emails for spam characteristics), and basic anti-phishing (checking for domain spoofing and impersonation). Messages that pass all checks are delivered to the inbox; those that fail are quarantined or moved to junk.

What EOP Detects Well

EOP is effective at filtering high-volume commodity threats — spam campaigns, known malware distributed in bulk, emails from known malicious IP addresses, and straightforward domain spoofing where the sending domain is clearly not the claimed domain. For most Microsoft 365 tenants, EOP handles a substantial volume of unwanted email without requiring additional configuration.

Microsoft 365 Business Premium adds Defender for Office 365 Plan 1 on top of EOP, providing Safe Links (which rewrites and scans URLs in emails at click time) and Safe Attachments (which detonates attachments in a sandbox before delivery). These capabilities add meaningful protection against malicious links and zero-day malware in attachments.

Where EOP Falls Short

EOP is not designed to defeat sophisticated, targeted attacks. Business email compromise (BEC) attacks — where an attacker impersonates an executive or supplier to authorise a fraudulent payment — often evade EOP because the emails contain no malware or malicious links. The threat is purely social engineering, which signature-based filtering cannot detect.

Phishing emails from newly registered domains, compromised legitimate accounts, and carefully crafted targeted attacks routinely evade EOP detection. Research from KnowBe4 in 2025 found a 47% rise in phishing attacks successfully bypassing Microsoft's native defences and secure email gateways. This is not a criticism of EOP's quality — it is a reflection of how attackers adapt specifically to evade known filtering systems.

Supplementing EOP with a Dedicated Gateway

For businesses that need stronger protection against targeted phishing and BEC, a dedicated email security gateway — deployed in front of Microsoft 365 — provides an additional layer of filtering with different detection techniques. AMVIA deploys Barracuda Email Security Gateway for clients requiring enhanced email protection.

A dedicated gateway complements EOP rather than replacing it: EOP handles volume filtering whilst the gateway focuses on targeted threats and adds additional capabilities such as impersonation detection, link sandboxing, and outbound content inspection. The two layers catching different attack types provides more complete protection than either alone.

Key Considerations for UK SMEs

• EOP is a baseline — sufficient for many businesses, but not designed for targeted attacks
• Microsoft 365 Business Premium includes Defender for Office 365 Plan 1, which adds Safe Links and Safe Attachments — configure these correctly before assessing whether additional gateway protection is needed
• Configure anti-phishing policies in EOP to enable impersonation protection for key executives and domains
• Enable DMARC, DKIM, and SPF on your domain to strengthen EOP's ability to reject spoofed email
• Consider a dedicated email gateway if your business receives targeted communications or operates in a high-risk sector

How AMVIA Can Help

AMVIA configures EOP and Defender for Office 365 policies as part of its Microsoft 365 managed security service — ensuring anti-phishing, safe links, and safe attachments are correctly configured rather than left at default settings. For businesses requiring enhanced email protection, AMVIA deploys Barracuda Email Security Gateway as a front-end layer on top of EOP. DMARC, DKIM, and SPF configuration is included in AMVIA's email security service. Contact AMVIA on 0333 733 8050 to discuss your email security requirements.