What is Exchange Online Protection (EOP), and what does it include?

Every Microsoft 365 mailbox already has a spam filter in front of it. For years it was called Exchange Online Protection, or EOP, and most admins still use that name. This guide explains what EOP is, what it does to each message, what you get without paying extra, and where its limits are.

What is Exchange Online Protection?

Exchange Online Protection is Microsoft's cloud email filtering service. In current documentation Microsoft calls it the built-in security features for all cloud mailboxes, and says these features "help protect your Microsoft 365 organization from spam, malware, phishing and other email threats" (Microsoft Learn).

Three facts define it:

• It's included. These protections "are included in all organizations with cloud mailboxes." There's nothing to buy.
• It's on by default. Default anti-malware, anti-spam and anti-phishing (spoofing) policies apply to all recipients. Microsoft says "you can't turn them off, but you can override them."
• It's the bottom of a ladder. Microsoft describes EOP as protection that prevents "broad, volume-based, known email attacks" (Microsoft Learn). Defender for Office 365 Plan 1 and Plan 2 sit on top.

You'll still see "EOP" in message headers, PowerShell cmdlets and older documentation, so it's worth knowing both names.

How does EOP filter a message?

Microsoft documents the order each inbound message passes through (Microsoft Learn):

A message that passes every layer is delivered. You choose the action for each verdict, for example Junk Email folder or quarantine, except that high confidence phishing messages "are always delivered to quarantine." After delivery, zero-hour auto purge (ZAP) can still pull a message out if Microsoft's verdict changes.

For a general explanation of these layers, read how spam filters work.

Connection filtering

The connection filter policy holds your IP Allow List and IP Block List, and the safe list option. It acts on the IP address of the server connecting to Microsoft. Our anti-spam policies guide explains why the IP Allow List is risky and shouldn't hold your filtering gateway's addresses.

Anti-spam and bulk filtering

Anti-spam policies set the bulk complaint level threshold and the action for each verdict. The verdict and score appear in the X-Forefront-Antispam-Report header; see Microsoft 365 spam headers explained.

Spoof protection

The anti-phishing policy in EOP covers spoofing only: forged senders, detected using SPF, DKIM, DMARC and Microsoft's own composite authentication. Spoof intelligence shows which senders are spoofing your domains and lets you allow or block them. Publishing SPF, DKIM and DMARC for your own domain makes this work much better; check yours with the DMARC Checker.

What does EOP include?

Here is what every cloud-mailbox tenant gets, grouped the way Microsoft's protection ladder groups it, with a few items from its built-in security feature list:

Prevent and detect

• Anti-malware, anti-spam with bulk email protection, and anti-phishing spoof protection with spoof intelligence
• Outbound spam protection, including control of external auto-forwarding
• Connection filtering
• Quarantine and quarantine policies
• Admin submissions and user reported messages
• The Tenant Allow/Block List for domains, addresses, spoofed senders, URLs and files
• Preset security policies (Standard and Strict)
• Directory Based Edge Blocking, which rejects mail to recipients that don't exist

Investigate

• Message trace
• Audit log search
• Email security reports and mail flow reports

Respond

• Zero-hour auto purge for email
• Refining Tenant Allow/Block List entries

That's a solid baseline. Mail flow rules alone cover a lot of ground; see Microsoft 365 mail flow rules for security.

What doesn't EOP include?

The gap is mostly about new and targeted attacks, and about investigation. These features need Defender for Office 365:

Source: Microsoft's protection ladder, at the time of writing (October 2026).

In practice, an EOP-only tenant has three blind spots:

1. Links that turn malicious after delivery. Without Safe Links, nothing re-checks a URL when the user clicks it. ZAP helps only within its window and only when Microsoft's verdict changes.
2. Unknown malicious files. Without Safe Attachments, attachments are scanned for known malware but not detonated in a sandbox.
3. Impersonation of your people and partners. Spoof protection catches forged From addresses. It doesn't catch a lookalike domain or a free-mail account using your CEO's name. That's the core of business email compromise.

Investigation is also thinner. Without Threat Explorer, you can't search every inbox for a phish and remove it in one action. Our Plan 1 vs Plan 2 guide covers which subscriptions include each plan.

How do you see what EOP did to a message?

EOP doesn't explain itself to users. A message just lands in Junk, goes to quarantine or never shows up. Admins have three places to look:

1. Message trace in the Exchange admin center shows whether a message arrived and its delivery status, such as Delivered, Quarantined or Filtered as spam, for up to 90 days. See our message trace guide.
2. Quarantine in the Defender portal holds malware, high confidence phishing and anything your policies send there. Our guide to releasing quarantined email covers who can release what.
3. Message headers on delivered mail record the verdict. Paste them into the Email Header Analyzer to read the spam confidence level and authentication results.

If a legitimate sender keeps landing in Junk, fix the cause (usually the sender's SPF, DKIM or DMARC) before reaching for an allow entry. Allow entries in anti-spam policies skip most filtering and are easy for attackers to abuse.

Can you use EOP with on-premises Exchange?

Yes. The same filtering is sold as a separate subscription that Microsoft now calls the Built-in security add-on for on-premises mailboxes, long known as standalone EOP. Microsoft says it serves "on-premises email organizations without cloud mailboxes" and that the server "can use Microsoft Exchange or other SMTP email products" (Microsoft Learn). Organizations that bought Exchange Enterprise CAL with Services licenses already have it.

Microsoft's setup steps are:

1. Add and verify your domain in the Microsoft 365 admin center.
2. Add recipients and, optionally, set the domain to Authoritative to turn on Directory Based Edge Blocking.
3. Create connectors between Microsoft 365 and your on-premises server, and test mail flow.
4. Restrict inbound port 25 on your firewall to Microsoft's datacenter addresses.
5. Configure on-premises Exchange so spam verdicts land in users' Junk Email folders.
6. Point your MX record to Microsoft 365.

One operational detail: when your on-premises server can't accept mail, Microsoft says messages "remain in our queues for one day" (Microsoft Learn). If outages can last longer, plan for that. With Exchange Server 2016 and 2019 out of support, many on-premises sites are weighing options; see Exchange Server end of support: your email options.

Does EOP still run if another filter is in front?

Yes. If your MX record points to a filtering gateway, mail reaches Microsoft 365 through an inbound connector and EOP filters it again. You can't switch EOP off. Microsoft documents a mail flow rule that skips most spam filtering for trusted sources, but malware scanning and high confidence phishing handling still apply (Microsoft Learn).

For this layout, Microsoft recommends Enhanced Filtering for Connectors so EOP sees the original sender's IP address instead of the gateway's. Our guide to using a third-party spam filter with Microsoft 365 walks through it, and blocking direct-to-tenant bypass stops attackers skipping the gateway. The Microsoft 365 built-in vs gateway comparison covers when a second layer is worth it.

Next steps

1. Apply the Standard or Strict preset security policy, so EOP runs with Microsoft's recommended settings rather than defaults nobody chose.
2. Review your anti-spam allow lists and connection filter IP Allow List, and remove entries you can't justify.
3. Publish SPF, DKIM and DMARC for every domain, and check them with the free Email Health Check.
4. Decide whether you need Defender Plan 1, an MX-level gateway such as iBlockSpam with per-domain pricing, or both.

Browse our other email security basics.