Overview: EOP, Plan 1, Plan 2 and what each adds
The Microsoft 365 email protection stack in layers, Exchange Online Protection, Defender for Office 365 Plan 1 and Plan 2, what each adds, which SKUs carry which, the filtering pipeline, preset versus custom policies and the precedence order, the configuration analyzer and how to trial Plan 2 in audit mode.
Anti-phishing, anti-spam, anti-malware and preset policies
The core EOP and Defender for Office 365 mail policies in depth, spoof and impersonation protection, SCL and BCL verdicts, outbound limits, the common attachments filter, connection filtering, the Tenant Allow/Block List, quarantine policies, Standard versus Strict values side by side, and the order in which it all evaluates.
Safe Links, Safe Attachments and Teams protection
Time-of-click URL scanning in email, Office apps and Teams, attachment detonation with Block and Dynamic Delivery, Safe Attachments for SharePoint, OneDrive and Teams, Safe Documents, ZAP for Teams, and which settings live in a policy versus the global switch.
SPF, DKIM, DMARC, ARC and spoof intelligence
How Exchange Online Protection evaluates inbound and outbound mail authentication, composite authentication and its reason codes, DKIM signing for custom domains, honouring DMARC in anti-phishing policy, trusted ARC sealers and Enhanced Filtering for third-party gateways, and a staged plan to reach p=reject.
Threat Explorer, quarantine, submissions and AIR
The Defender for Office 365 investigation toolset, Threat Explorer and Real-time detections, the email entity page, quarantine and quarantine policies, admin and user submissions, automated investigation and response, message trace, and the Email tables in Advanced Hunting with working KQL.
Attack simulation training, user reporting and priority accounts
How Attack simulation training builds and reports on phishing simulations, how the Outlook Report button and the reporting mailbox are configured, and how the Priority account tag and custom user tags change protection and visibility in Defender for Office 365.