The core EOP and Defender for Office 365 mail policies in depth, spoof and impersonation protection, SCL and BCL verdicts, outbound limits, the common attachments filter, connection filtering, the Tenant Allow/Block List, quarantine policies, Standard versus Strict values side by side, and the order in which it all evaluates.
The Microsoft 365 email protection stack in layers, Exchange Online Protection, Defender for Office 365 Plan 1 and Plan 2, what each adds, which SKUs carry which, the filtering pipeline, preset versus custom policies and the precedence order, the configuration analyzer and how to trial Plan 2 in audit mode.
How Exchange Online Protection evaluates inbound and outbound mail authentication, composite authentication and its reason codes, DKIM signing for custom domains, honouring DMARC in anti-phishing policy, trusted ARC sealers and Enhanced Filtering for third-party gateways, and a staged plan to reach p=reject.