Do I need a separate spam filter with Microsoft 365?

Microsoft 365 is not an unprotected inbox. Every tenant already has a spam, malware and phishing filter in front of it, so the real question is whether that filter, as you've configured it, covers what your business needs. This guide gives the honest answer first, then shows the specific gaps an extra layer fills and how to add one without weakening Microsoft's protection.

Does Microsoft 365 already have a spam filter?

Yes. Every Microsoft 365 subscription with cloud mailboxes includes Microsoft's built-in email security, long known as Exchange Online Protection (EOP). Microsoft says these protections "are included in all organizations with cloud mailboxes" and are on by default through default anti-malware, anti-spam and anti-phishing (spoofing) policies. You "can't turn them off, but you can override them" (Microsoft Learn).

Each inbound message passes through connection filtering (sender IP reputation, where Microsoft says "most spam is rejected"), malware scanning, your mail flow rules, then spam and phishing verdicts. High confidence phishing always goes to quarantine. For a full tour of those layers, read what Exchange Online Protection includes.

Microsoft is also clear about what this tier is for. It says the built-in features "prevent broad, volume-based, known email attacks" (Microsoft Learn). New links, unknown malicious files and impersonation of your people sit above that line.

What does each Microsoft 365 plan include for email security?

Microsoft calls the tiers a protection ladder: built-in features for every cloud mailbox, then Defender for Office 365 Plan 1, then Plan 2.

Source: Microsoft's protection ladder.

Which plan do you have? At the time of writing (October 2026), Microsoft's service description says Plan 1 is included in Microsoft 365 Business Premium and, "effective July 1, 2026, in Office 365 E3 and Microsoft 365 E3". Plan 2 is included in enterprise subscriptions such as Microsoft 365 E5. Business Basic and Business Standard get the built-in tier only, unless you buy Defender as an add-on: Microsoft's licensing service plan reference lists Defender for Office 365 (Plan 1) in Business Premium but not in either of them. Check Your products in the Microsoft 365 admin center to confirm. Our Plan 1 vs Plan 2 guide goes deeper.

When is Microsoft 365's built-in protection enough?

Microsoft 365's own protection is enough for many organizations. Be honest with yourself on these points before you buy anything:

1. You're on one platform. Every domain you own receives mail in Microsoft 365.
2. You've applied a preset policy. The Standard or Strict preset security policy is on for all recipients, not left on defaults nobody chose.
3. You have Plan 1 or better, or you've accepted the risk of no time-of-click link checks and no attachment sandbox.
4. Allow lists are clean. No broad allowed domains, IP Allow List entries or mail flow rules that set the spam confidence level (SCL) to -1.
5. Your own domain is authenticated. SPF, DKIM and DMARC are published, so Microsoft can spot mail that spoofs you.
6. Someone reviews quarantine and users know how to report a missed phish.

If all six are true and junk isn't a daily complaint, you probably don't need a second filter. Spend the effort on MFA and user reporting instead.

Why does spam still get through Microsoft 365?

The most common cause of spam reaching Microsoft 365 inboxes is a setting that tells Microsoft to skip filtering, not a weak filter. The anti-spam header on a delivered message shows it. Here's an example of the relevant part of the X-Forefront-Antispam-Report header (example values only):

X-Forefront-Antispam-Report: CIP:203.0.113.25;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:SKA;H:mail.example.net;DIR:INB;CAT:NONE;

Microsoft's anti-spam header reference explains the values that matter:

If you see skip values on spam, fix the allow entry first. Paste a header into the Email Header Analyzer to read it quickly, and see why spam gets through Microsoft 365 for the full fix list. A new product won't help if a rule tells Microsoft to wave mail through.

How do you see what Microsoft 365 is catching?

Microsoft 365 shows what it's catching in its email security reports and mail flow reports, and in message trace for individual messages. Look at the trend in malware, phishing and spam detections, and at how many user-reported messages turned out to be real threats. If users keep reporting phish that Microsoft delivered, that's evidence for Defender Plan 1 or another layer. If they mostly report newsletters, tune bulk filtering instead. Our message trace guide shows how to follow a single message.

What gaps does an extra spam filter fill?

An MX-level filter (an inbound gateway your domain's MX record points to, which filters mail before Microsoft 365 receives it) fills operational gaps more than detection gaps. These are the cases where it earns its place:

• Users find their own held mail. In Microsoft's built-in quarantine policies, notifications are off in DefaultFullAccessPolicy and AdminOnlyAccessPolicy; the preset policies switch to a policy with notifications on (Microsoft Learn). You can configure this, but many tenants never do. iBlockSpam gives every user a personal quarantine with digest emails on a schedule they choose (hourly, daily, a chosen weekday or custom).
• Mail during outages. Microsoft's figure here is about on-premises servers: when Microsoft 365 can't deliver to an on-premises server that can't accept mail, it says deferred messages "remain in our queues for one day" (Microsoft Learn). Microsoft doesn't describe a cloud-mailbox equivalent on that page. Our reasoning: with cloud-only mailboxes, the likelier failure is on your side, such as a broken connector, a DNS mistake or a domain problem that makes Exchange Online refuse mail, and a gateway in front can keep that mail instead of leaving each sender to retry. iBlockSpam holds mail for up to 5 days and delivers it when the destination is back.
• Mixed platforms. If some domains live on Google Workspace, cPanel or Exchange, one filter and one portal cover them all.
• Per-domain pricing. Shared mailboxes, aliases and seasonal staff don't change the price. iBlockSpam includes unlimited mailboxes per domain (a mailbox count, not unlimited message volume).
• Extra controls. Geographic filters, attachment-type filters and an Office macro filter, applied before mail reaches Microsoft.
• A second, independent opinion. Two engines with different signals catch different things. Microsoft itself notes that "no matter how many layers of email protection exist, total protection never reaches 100 percent" (Microsoft Learn).

What a gateway doesn't replace: Safe Links at click time, Safe Attachments for SharePoint, OneDrive and Teams, ZAP after delivery, and protection for internal mail between colleagues, which never crosses your MX. Keep Microsoft's protection on. The Microsoft 365 built-in vs gateway comparison lays these out side by side.

Defender Plan 1, a gateway or both?

Defender Plan 1 and an MX gateway solve different problems, so the choice depends on which gap you have.

Plenty of organizations run both: Business Premium for link and attachment protection, and a gateway for edge filtering, digests and spooling.

How do you add a filter in front of Microsoft 365 safely?

Adding a filter in front of Microsoft 365 means pointing your MX record at it and telling Microsoft about the extra hop. Microsoft documents this as "MX record points to third-party spam filtering" (Microsoft Learn). The safe order is:

1. Record what you have. Note your current MX, SPF and DMARC records and lower the MX TTL a day ahead.
2. Create a Partner inbound connector that accepts mail from the filter's IP addresses or certificate.
3. Turn on Enhanced Filtering for Connectors. Without it, every message "adopts the source IP of the last hop", so Microsoft's SPF and reputation checks see the filter instead of the real sender (Microsoft Learn). Microsoft says to disable SCL -1 bypass rules once it's on.
4. Change the MX record and send test messages from outside accounts. Confirm the route in the headers.
5. Lock down direct delivery once mail flows, so attackers can't skip the filter by sending straight to your mail.protection.outlook.com host. See blocking direct-to-tenant bypass.
6. Tell users where to look for a missing message: the gateway digest, Microsoft quarantine, or Junk.

The step-by-step version, with PowerShell and rollback, is in using an external spam filter with Microsoft 365.

Next steps

• Check Your products in the Microsoft 365 admin center to see whether you have Defender Plan 1.
• Apply the Standard or Strict preset security policy and remove allow entries you can't justify.
• Run the free Email Health Check to see your MX, SPF and DMARC records today.
• If the gaps above match your situation, the iBlockSpam Microsoft 365 setup page shows exactly what changes in your tenant.

Browse our other guides on choosing email protection.