Exchange Online: Protection Against Spam, Phishing, and Malware

Every organization with mailboxes in Exchange Online receives protection against spam, malware, and phishing without an additional license. What many know as Exchange Online Protection (EOP) is now called "built-in security features for all cloud mailboxes" on Microsoft Learn; the preset policies wizard and the PowerShell cmdlets still use the name EOP. Incoming messages pass through connection filtering (sender reputation, where most spam stops), anti-malware, mail flow rules, and finally anti-spam and anti-phishing. Defender for Office 365 adds to this layer but does not replace it.

The Microsoft 365 admin center shows your licenses under "Your products"; in the Defender portal, under Email & collaboration, the menu item Real-time detections appears with Plan 1, and Explorer with Plan 2.

There are default policies for anti-malware, anti-spam, and anti-phishing. They apply to all recipients, cannot be turned off, and always take effect last; preset and custom policies take precedence over them.

Preset security policies set the values recommended by Microsoft, which can hardly be changed. Microsoft advises assigning Standard and/or Strict to all recipients; until then, they apply to no one. Strict is intended for particularly at-risk people ("high value targets or priority users"). All recipients without another policy for Safe Links and Safe Attachments automatically receive Built-in protection as soon as the tenant has at least one license for Defender for Office 365; Microsoft recommends licenses for all users.

1. 1

   Open the page

   Microsoft Defender portal > Email & collaboration > Policies & rules > Threat policies > Preset security policies (security.microsoft.com/presetSecurityPolicies).

2. 2

   Assign Standard protection

   Turn the switch "On", then select "Manage protection settings" and, under "Apply Exchange Online Protection", choose "All recipients". If not all users have a license, assign the Defender for Office 365 protection only to licensed users.

3. 3

   Fill in impersonation protection (Plan 1)

   Up to 350 people whom attackers could imitate, such as executive management and the head of finance, and up to 50 external domains you frequently correspond with. Your own domains and mailbox intelligence are protected automatically.

4. 4

   Add Strict and test

   Additionally assign Strict to at-risk people. Test: with Standard, spam lands in the Junk Email folder; with Strict, in quarantine. Do not change the profile policies with PowerShell; Microsoft does not support this.

If a recipient is included in several policies, only the first one in this order takes effect: Strict, Standard, Defender for Office 365 evaluation policies, custom policies by priority, and finally Built-in protection and default policies. Outbound spam and Teams protection are not part of the profiles.

For phishing, Junk applies to the default policy and to policies created with PowerShell; policies newly created in the portal quarantine phishing. Anti-malware, Safe Attachments, and Safe Links are configured identically in Standard and Strict.

According to Microsoft, threat policies work best when your domains are correctly authenticated. SPF checks the envelope sender (MAIL FROM, RFC 7208), DKIM the domain's signature in the d= field (RFC 6376), and DMARC whether one of these domains matches the visible sender domain (RFC 9989).

; Zone example.com: only Microsoft 365 sends
@                     TXT    "v=spf1 include:spf.protection.outlook.com -all"
selector1._domainkey  CNAME  <target 1 from the Defender portal>
selector2._domainkey  CNAME  <target 2 from the Defender portal>
_dmarc                TXT    "v=DMARC1; p=none; rua=mailto:dmarc@example.com"

; Zone example.net: does not send email
@                     TXT    "v=spf1 -all"
_dmarc                TXT    "v=DMARC1; p=reject;"

• SPF: at most one v=spf1 record per domain, several result in permerror (RFC 7208, section 4.5), and at most 10 terms that trigger DNS lookups (include, a, mx, ptr, exists, redirect), including nested ones (section 4.6.4). Microsoft recommends -all and advises against replacing Microsoft's include with IP addresses.
• DKIM: Microsoft automatically signs only emails from addresses of the *.onmicrosoft.com domain; emails from your own domains remain unsigned without setup. To set it up, create the two CNAME records shown under Threat policies > Email authentication settings > DKIM and turn on "Sign messages for this domain with DKIM signatures".
• DKIM keys created with PowerShell have 1024 bits; Rotate-DkimSigningConfig -KeySize 2048 switches to 2048 bits during rotation.
• DMARC: create the record with your DNS provider and tighten it from p=none via p=quarantine to p=reject, subdomains with little traffic first, the main domain last. Microsoft's examples still mention pct, which RFC 9989 has removed.
• Unused domains receive v=spf1 -all and v=DMARC1; p=reject;, but no DKIM record. An unused *.onmicrosoft.com also needs p=reject; you create the record in the Microsoft 365 admin center (Settings > Domains > DNS records).
• For third-party sending services such as newsletter platforms, Microsoft recommends a subdomain such as marketing.example.com, with its own SPF and DKIM.

For inbound mail, Microsoft 365 honors the DMARC policy of external senders ("Honor DMARC record policy", on by default): p=reject is rejected, p=quarantine goes to quarantine. The rollout plan is included in the download "SPF, DKIM, and DMARC in five steps".

A quarantine policy bundles permissions (No access, Limited access, Full access) and defines whether users are notified (every four hours, daily, or weekly). Default policies are read-only; you create your own under Threat policies > Quarantine policies. A changed assignment only applies to messages quarantined in the future.

• Users can never release malware and high confidence phishing themselves; if the quarantine policy allows release, they can only request it. The alert policy "User requested to release a quarantined message" notifies the administrators of this.
• The retention of 1 to 30 days is set in the anti-spam policy ("Retain spam in quarantine for this many days"); it also applies to anti-phishing. After that, the message is deleted and cannot be recovered.
• Reporting: under Settings > Email & collaboration > User reported settings, select "Monitor reported messages in Outlook" with the built-in "Report" button and enter a dedicated Exchange Online mailbox; the default is the Global Administrator's mailbox.
• Register the reporting mailbox as a SecOps mailbox in advanced delivery and exclude it from DLP; otherwise, reported messages are filtered. Reply to the reporters on the Submissions page with "Mark as and notify".

Microsoft ranks the ways to allow senders, starting with the most recommended: Tenant Allow/Block List, mail flow rules, safe senders in Outlook, IP Allow List, allow lists in anti-spam policies. In the list, blocks take precedence; blocked domains, addresses, and URLs are treated as high confidence phishing. Direct allow entries only work against the verdicts bulk email, spam, high confidence spam, and phishing; against malware and high confidence phishing only via the Submissions page. Microsoft removes unnecessary allow entries itself.

The configuration analyzer (Threat policies > Configuration analyzer) compares your own policies with Standard and Strict, checks SPF and DKIM records in DNS, and shows changes from the last 90 days.

• Licenses clarified; Defender for Office 365 protection assigned only to licensed users.
• Every sending domain with SPF (-all), DKIM with your own domain, and DMARC with a reporting address; target p=reject.
• Domains that do not send blocked with v=spf1 -all and p=reject, including an unused *.onmicrosoft.com via DMARC.
• Standard profile for all recipients, Strict for particularly at-risk people.
• Impersonation protection filled with executives and important partner domains (Plan 1).
• Built-in protection without exceptions for licensed users (Plan 1); common attachments filter turned on.
• Automatic external forwarding off; justified exceptions in a separate policy.
• Junk email filter in Outlook set to "No automatic filtering".
• Quarantine with notification, release requests are processed; "Report" active, reporting mailbox registered as a SecOps mailbox.
• Allow entries only temporary in the Tenant Allow/Block List; allow lists in anti-spam empty.
• No mail flow rule bypasses spam filtering based only on the sender domain.
• Configuration analyzer without open recommendations.

This checklist is a TOMORIS recommendation based on Microsoft's recommendations. Since October 1, 2026, essential and important entities have had to implement appropriate and proportionate risk management measures that, taking into account the state of the art, ensure a level of cybersecurity appropriate to the risk (§ 32 paras. 1 and 2 NISG 2026, Austrian Network and Information Systems Security Act 2026). Under § 2 NISV 2026, the annex to IR (EU) 2024/2690 applies for this purpose, including an implementation plan for modern email communication standards (point 6.7.2(k)) and protection against malware (point 6.9); your own risk analysis determines which specific settings this requires.