In short
Exchange Online Protection (EOP) is Microsoft's built-in email filtering for every Exchange Online mailbox, now called the built-in security features for all cloud mailboxes. It provides anti-malware, anti-spam, anti-spoofing, quarantine and zero-hour auto purge, managed in the Microsoft Defender portal. It is also sold as an add-on for on-premises mail servers.
Get a quote for Exchange Online Protection
Tell us roughly how many users or sites you have and we will reply by email with options and a quote.
What is Exchange Online Protection?
Exchange Online Protection, usually shortened to EOP, is the cloud filtering service that protects every Exchange Online mailbox against spam, malware and phishing. You do not buy it or switch it on: Microsoft applies it automatically through default threat policies for anti-malware, anti-spam and anti-phishing (spoofing). The default policies cannot be turned off, but you can override them with Microsoft's preset security policies or your own custom policies.
Microsoft has been renaming it. Its documentation now calls EOP the built-in security features for all cloud mailboxes, and the standalone version the Built-in security add-on for on-premises mailboxes. The old name has not disappeared: the service description is still filed under Exchange Online Protection, and the preset security policy wizard still has a page titled "Apply Exchange Online Protection". If a consultant, licence list or admin guide mentions either name, it is the same thing.
EOP sits at the bottom of Microsoft's protection ladder. Microsoft 365 phishing protection explains how Defender for Office 365 Plan 1 and Plan 2 build on it.
How EOP filters a message
Microsoft describes the path a message takes through EOP in this order:
- Connection filtering checks the sending server's reputation. Microsoft says most spam is rejected at this point.
- Anti-malware scans the message and attachments. Messages with malware go to quarantine, where by default only admins can see them.
- Policy filtering applies your Exchange mail flow rules (transport rules), for example adding a warning banner to external mail.
- Anti-spam and anti-phishing filtering classifies the message as bulk, spam, high confidence spam, phishing or high confidence phishing, and anti-phishing policies detect spoofing. Your policies decide whether each verdict goes to Junk Email or quarantine; high confidence phishing goes to quarantine.
- Delivery to the mailbox. If a verdict changes after delivery, zero-hour auto purge (ZAP) can move or quarantine the message.
Because filtering happens in Microsoft's datacentres before mail reaches the mailbox, there is nothing to install. If you put a secure email gateway in front of Microsoft 365, EOP still runs behind it, and Enhanced Filtering for Connectors lets it see the original sender rather than the gateway.
What EOP includes
The main features, as listed in Microsoft's service description and documentation:
| Feature | What it does |
|---|---|
| Anti-malware policies | Scan the message body and attachments for malware; optional common attachments filter blocks risky file types |
| Inbound and outbound anti-spam | Classify spam, bulk and phishing; outbound policies limit spam sent from compromised accounts and control automatic external forwarding |
| Connection filtering | IP Allow and Block lists for sending servers |
| Anti-phishing (spoofing) policies | Spoof intelligence, honouring senders' DMARC policies, unauthenticated sender indicators and the first contact safety tip |
| Zero-hour auto purge (ZAP) | Acts on delivered spam, phishing and malware when the verdict changes (cloud mailboxes only) |
| Tenant Allow/Block List | Allow or block domains, addresses, spoofed senders, URLs and files |
| Quarantine and quarantine policies | Hold suspect mail and decide what users can do with it |
| Preset security policies and configuration analyzer | Apply Microsoft's Standard or Strict settings and find weaker custom policies |
| Admin submissions and user reported messages | Send false positives and missed phishing to Microsoft, or to your own reporting mailbox |
| Message trace and email security reports | Follow a message's path and review filtering results |
Not sure which option fits? Ask us
Tell us what you need and we will recommend the right option for your organisation, with a quote.
EOP vs Defender for Office 365
EOP is designed for broad, high-volume, known threats. Microsoft Defender for Office 365 is Microsoft's answer to the targeted attacks EOP does not cover:
| Capability | EOP | Defender Plan 1 | Defender Plan 2 |
|---|---|---|---|
| Anti-malware, anti-spam, spoof protection, ZAP for email | Yes | Yes | Yes |
| Quarantine, Tenant Allow/Block List, message trace | Yes | Yes | Yes |
| User and domain impersonation protection, mailbox intelligence | - | Yes | Yes |
| Safe Links in email, Office apps and Teams | - | Yes | Yes |
| Safe Attachments sandboxing, including SharePoint, OneDrive and Teams files | - | Yes | Yes |
| Email entity page | - | Yes | Yes |
| Real-time detections | - | Yes | Replaced by Threat Explorer |
| Threat Explorer, campaigns and threat trackers | - | - | Yes |
| Automated investigation and response (AIR), advanced hunting | - | - | Yes |
In plain terms: EOP checks who sent a message and whether it contains known-bad content. It does not detonate unknown attachments, re-check links at the moment they are clicked, or notice that "[email protected]" is pretending to be your finance director. Those gaps are where BEC attacks and whaling attacks get through.
Where EOP is managed
EOP's security settings are managed in the Microsoft Defender portal (security.microsoft.com) under Email & collaboration:
- Policies & rules > Threat policies holds the anti-malware, anti-spam, anti-phishing and preset security policies, the Tenant Allow/Block List and the configuration analyzer.
- Review > Quarantine is where admins release, delete or report quarantined mail.
- Submissions collects admin submissions and user-reported messages.
Mail flow rules, connectors, accepted domains and message trace are also available in the Exchange admin center. Delegate access with least privilege: Microsoft's own guidance is to keep the Global Administrator role for emergencies and use roles such as Security Administrator for day-to-day policy work.
Is Exchange Online Protection the right fit for you?
We will check it against your systems and requirements and recommend the right option.
Quarantine basics
Quarantine holds messages that a policy decided should not reach the inbox. A few points that help admins and users:
- Some detections are quarantined whatever you set. Malware, high confidence phishing, and malware or phishing caught by Safe Attachments go to quarantine regardless of other settings, and recipients can only request their release.
- Quarantine policies decide what users may do with their own quarantined mail (preview, release, request release, delete) and whether they get quarantine notifications.
- Retention depends on the reason. Spam and phishing held by anti-spam policies are kept for a configurable period of 1 to 30 days (15 days by default in the default policy, 30 days in the preset policies); malware and mail flow rule quarantines are kept for 30 days.
- Reporting from quarantine lets admins, and users if you allow it, report false positives to Microsoft.
Too much legitimate mail in quarantine usually points to over-broad mail flow rules, missing SPF records on suppliers' domains or a gateway without Enhanced Filtering for Connectors, rather than EOP being too strict.
EOP licensing: cloud mailboxes and on-premises Exchange
Cloud mailboxes. EOP is included with every Exchange Online mailbox, whether it comes through Microsoft 365 Business Basic, Business Premium, an enterprise plan or a standalone Exchange Online plan. There is no separate EOP licence to buy for Microsoft 365 users.
On-premises mail. Organisations running their own Exchange servers, or another SMTP mail system, can buy the same protection as the Built-in security add-on for on-premises mailboxes, often still called standalone EOP. You point your MX records at Microsoft, which filters mail and passes it on to your servers. Exchange Enterprise CAL with Services licences include it too. Microsoft's feature table shows that zero-hour auto purge is not available in the on-premises add-on, because Microsoft cannot reach into mailboxes it does not host. In a hybrid deployment, the cloud protection can also cover on-premises mailboxes.
For commercial advice on Microsoft 365 plans, Forever Group's Microsoft 365 team can help.
Is EOP enough on its own?
For a very small organisation with good habits it is a reasonable floor, provided it is configured: preset policies on, external forwarding off, user reporting set up, and SPF, DKIM and DMARC published. But EOP on its own leaves the most expensive attacks largely to your users' judgement, because it has no impersonation protection, no click-time link checking and no attachment sandboxing.
Most organisations have three realistic routes:
- Use the Plan 1 you may already own. Business Premium and Microsoft 365 E3 include Defender for Office 365 Plan 1, and many tenants have never configured it.
- Add Defender for Office 365 as an add-on where your plan does not include it.
- Add a third-party layer, either an integrated cloud email security product connected by API or a gateway, especially if you also use Google Workspace or want automatic removal from every mailbox. Our email security platforms comparison lists what we supply.
Forever Systems can review what EOP is doing in your tenant today, tighten it, and show you whether the gaps justify spending anything. Contact us for a review or a quote.
How Forever Systems helps with email security
We are an independent UK IT and cyber security provider. We supply several email security platforms, so we can suggest what suits your mail system, your risks and your budget rather than pushing one product.
- Start with what you have: we can review the protection already built into Microsoft 365 or Google Workspace before suggesting anything extra
- Compare like for like: API-based protection, secure email gateways, encryption and DLP from the vendors we supply, explained in plain English
- Get authentication right: we help you plan SPF, DKIM, DMARC and MTA-STS so genuine mail is delivered and spoofed mail is not
- Deployment help: connecting a platform to Microsoft 365 or Google Workspace, mail routing changes and policy set-up, scoped at quote
- People and backup too: security awareness training, Check Point Harmony Email & Collaboration and Sophos from our specialist sites
Tell us about your mail system and we will suggest options, with pricing confirmed at quote.
Frequently asked questions
What is Exchange Online Protection in Microsoft 365?
Exchange Online Protection (EOP) is the email filtering built into every Exchange Online mailbox. It provides anti-malware, anti-spam, anti-spoofing, quarantine and zero-hour auto purge through default policies that are on automatically. Microsoft now calls it the built-in security features for all cloud mailboxes.
Is Exchange Online Protection included in Microsoft 365?
Yes. Every Microsoft 365 or Office 365 plan with Exchange Online mailboxes includes EOP at no extra cost. A separate subscription, the Built-in security add-on for on-premises mailboxes, is only needed to protect mail servers you host yourself.
What is the difference between EOP and Defender for Office 365?
EOP stops broad, known threats such as spam, known malware and spoofing. Defender for Office 365 Plan 1 adds impersonation protection, mailbox intelligence, Safe Links and Safe Attachments against targeted phishing and zero-day malware, and Plan 2 adds investigation, hunting and automated response.
Where is the Exchange Online Protection portal?
EOP's policies, quarantine and submissions are managed in the Microsoft Defender portal at security.microsoft.com, under Email & collaboration. Mail flow rules, connectors and message trace are also in the Exchange admin center.
Can EOP protect on-premises Exchange?
Yes. Microsoft sells the same filtering as the Built-in security add-on for on-premises mailboxes, often called standalone EOP, for Exchange and other SMTP mail systems, and it is included with Exchange Enterprise CAL with Services. Zero-hour auto purge is not available for on-premises mailboxes.
Is EOP enough for a small business?
It is a reasonable baseline once configured, but it has no impersonation protection, click-time link checking or attachment sandboxing. If you hold Business Premium you already own Defender for Office 365 Plan 1, which fills those gaps; otherwise consider an add-on or a third-party layer.
Still have a question about Exchange Online Protection?
Ask us and a member of our team will reply by email.