Exchange Online Protection
The filtering included with every Microsoft 365 cloud mailbox (anti-malware, anti-spam and anti-phishing), which Microsoft now documents as built-in security features for all cloud mailboxes.
What it means
Microsoft's documentation describes these protections as included in all organisations with cloud mailboxes and on by default through default policies for anti-malware, anti-spam and anti-phishing (spoofing) protection. Administrators cannot turn the defaults off but can override them with preset or custom policies. They are also sold standalone to protect on-premises mail systems.
Incoming mail first passes connection filtering, which checks the sender's reputation and rejects most spam there, then malware scanning, then spam filtering that assigns verdicts and the SCL and BCL values seen in message headers.
For senders, EOP is what decides delivery to most Microsoft 365 business mailboxes. Microsoft Defender for Office 365 adds further protection on top for organisations that license it.
Related terms
On this site
Sources
What this definition rests on. The wording is ours; the facts are theirs.
- Microsoft Learn: Built-in security features for all cloud mailboxes (EOP)learn.microsoft.com
- Microsoft Learn: Microsoft Defender for Office 365 overviewlearn.microsoft.com
All 432 terms in the glossaryThe wiki: blocklists and bounce codes