What Is Exchange Online Protection and Is It Enough on Its Own?
If your business uses Microsoft 365, you have Exchange Online Protection. You may not know it by that name, but it’s been filtering your email since the moment you moved to Exchange Online. What many businesses don’t realise is that EOP is the floor, not the ceiling, of Microsoft’s email security stack.
What Is Exchange Online Protection?
EOP is Microsoft’s baseline email filtering service, included in every M365 plan with Exchange Online. It handles anti-spam filtering, anti-malware scanning, basic phishing detection, connection filtering, and outbound spam filtering.
Where EOP Falls Short
- •Zero-day and novel malware: EOP scans against known signatures; new malware passes through
- •Sophisticated phishing and spear phishing: carefully crafted BEC emails with no malicious attachments or links
- •Malicious links that aren’t malicious yet: EOP checks at delivery time, but links can be redirected after delivery
- •Internal phishing: if an attacker compromises an internal account, EOP’s inbound filtering doesn’t apply
Microsoft Defender for Office 365: What It Adds
Defender for Office 365 (included in Business Premium) sits on top of EOP and addresses its key limitations:
- •Safe Attachments: opens suspicious files in an isolated sandbox and observes behaviour before delivery
- •Safe Links: rewrites URLs so every click is checked in real time, not just at delivery
- •Anti-phishing with impersonation protection: ML-based detection of impersonation attempts
- •Attack simulation training (Plan 2): run simulated phishing campaigns to test staff awareness
Do You Need It?
If your business handles sensitive customer data, financial transactions, or confidential information (and most businesses do), the answer is yes. The incremental cost of Business Premium over Standard is modest. The cost of a successful BEC attack is not.
Many organisations already have Business Premium but have never properly configured the Defender features they’re paying for. Having it and having it configured are two different things.