Exchange Online Protection:
What It Covers, and the Gaps It Leaves Open
EOP is included free with every Microsoft 365 plan — and it handles bulk spam well. But BEC, spear phishing, zero-day malware, and account takeover regularly bypass it. Here's exactly what EOP does, what it misses, and how Iron Cove closes the gap.
EOP is a solid baseline — included free with every Microsoft 365 plan
Exchange Online Protection filters every inbound and outbound message through Microsoft's global threat intelligence network. For bulk spam and known malware, it performs well. Here's what it reliably catches:
Known spam and bulk email filtering
Common malware and virus blocking via signature scanning
Basic phishing detection for well-known patterns
IP reputation and connection filtering
Message quarantine for flagged emails
Anti-spoofing for obvious From-header fakes
EOP is included at no extra cost with Microsoft 365 Business Basic, Business Standard, Business Premium, and all enterprise plans. Microsoft Defender for Office 365 (Plan 1 & 2) adds sandboxing and URL detonation but is a paid add-on.
What Exchange Online Protection regularly misses
These aren't edge cases. BEC, spear phishing, and account takeover are the attacks causing the largest financial losses for businesses on Microsoft 365 — and they were designed to bypass EOP.
Business Email Compromise (BEC) — no malware to detect
Spear phishing targeting specific employees by name or role
Zero-day malware before threat signatures exist
Lookalike and typosquatted domain spoofing
Account takeover — attacker authenticated with valid credentials
Post-delivery removal of threats already in inboxes
DMARC enforcement and domain fraud protection
Lateral phishing from a compromised internal account
BEC slips past EOP every day
Business email compromise has no malware. An attacker impersonating your CFO or a vendor sends a plain-text wire transfer request — EOP sees a clean email. FBI data puts BEC losses above $2.9 billion annually, most at companies using Microsoft 365.
Zero-day threats have a window
EOP's malware engine works from known signatures. A novel weaponized attachment or obfuscated macro can land in inboxes for hours — sometimes days — before Microsoft catches up. Sandboxing closes that window.
Account takeover is invisible to EOP
Once an attacker has valid Microsoft 365 credentials — from phishing or credential stuffing — they send mail as a real user. EOP has no behavioral analysis to flag that your CFO is suddenly wiring money from an IP in Eastern Europe.
No retroactive remediation
When a malicious email gets through EOP — and they do — you have no automated way to pull it from the 50 inboxes it forwarded to. A third-party layer with post-delivery remediation removes threats organization-wide in minutes.
How Iron Cove extends Exchange Online Protection
We deploy and manage Barracuda Email Protection on top of your existing EOP — via Microsoft 365 API, no MX record changes — to catch what EOP misses and remediate threats that already got through.
Assess your current EOP gaps
We review your mail flow, DMARC configuration, recent incidents, and quarantine logs to identify exactly what EOP is missing in your Microsoft 365 environment.
Layer Barracuda on top of EOP
Barracuda Email Protection integrates directly with Microsoft 365 via API — no MX record change, no mail flow disruption. It adds AI-driven spam filtering, sandboxing, and behavioral analysis on top of what EOP already provides.
Enforce DMARC and stop domain spoofing
We configure managed DMARC reporting and move your domain from "none" to enforcement — closing the impersonation gap that EOP alone cannot solve.
Monitor and remediate on your behalf
Iron Cove monitors threats, removes post-delivery threats from all affected inboxes, and delivers reporting so you always know what EOP caught — and what Barracuda stopped behind it.
Barracuda Email Protection
API-native integration with Microsoft 365 and Google Workspace. AI-driven spam filtering, attachment sandboxing, automated incident response, account takeover detection, and managed DMARC enforcement.
Learn About BarracudaProofpoint Essentials
Gateway-based filtering with advanced threat protection, email archiving, and DLP — strong choice for regulated industries or teams needing robust archiving alongside spam filtering.
Learn About ProofpointCommon questions about Exchange Online Protection
Answers from Iron Cove engineers who manage Microsoft 365 email security for SMBs every day.
Is Exchange Online Protection good enough for a small business?
EOP is a solid baseline that catches commodity spam and known malware — and it's included free with every Microsoft 365 plan. But BEC, spear phishing, and account takeover are the leading causes of financial loss for small businesses, and EOP catches none of them reliably. Most IT advisors recommend a third-party layer for any business handling financial transactions or sensitive data.
What is Exchange Online Protection and how does it work?
Exchange Online Protection (EOP) is Microsoft's built-in email filtering service, included with every Microsoft 365 subscription. It filters inbound and outbound mail through spam scoring, malware signature scanning, and connection filtering before messages reach your mailbox. It works well for bulk spam but relies primarily on known threat signatures.
What is the difference between EOP and Microsoft Defender for Office 365?
EOP is included in all M365 plans and covers basic spam, malware, and phishing. Microsoft Defender for Office 365 (Plan 1 and Plan 2) adds Safe Attachments (sandboxing), Safe Links (URL detonation), and some threat hunting. It closes some gaps but still lacks the AI-driven BEC detection, account takeover protection, post-delivery remediation, and managed DMARC enforcement that a dedicated third-party layer provides.
Do I still need a third-party spam filter if I have Microsoft Defender for Office 365?
For most SMBs, yes. Defender for Office 365 improves on EOP significantly but doesn't cover account takeover with behavioral analysis, automated post-delivery removal across all inboxes, or managed DMARC enforcement. Barracuda Email Protection integrates alongside both EOP and Defender via API without conflict.
Can I use a third-party spam filter with Exchange Online Protection?
Yes — and this is the recommended configuration for businesses that need enterprise-grade protection. Barracuda Email Protection connects to Microsoft 365 via API, so both EOP and Barracuda scan inbound mail. You get layered filtering, sandboxing, behavioral analysis, and post-delivery remediation without touching your MX records.
How do I set up a third-party spam filter with Microsoft 365?
Iron Cove handles the entire setup. Barracuda connects via Microsoft 365 API — no MX record change or mail routing changes required. We configure the integration, tune filtering thresholds for your organization, set up DMARC, and build automated incident response workflows. Typical deployment time is a few business days.
Find out what EOP is missing in your Microsoft 365 environment
Iron Cove reviews your mail flow, DMARC configuration, and quarantine logs — and shows you exactly where your exposure is. Free assessment, no obligation.
✓ Free email security gap assessment
✓ DMARC status and domain fraud review
✓ Barracuda or Proofpoint recommendation
✓ Response within one business day
Talk to us
Phone & Hours
(213) 545-0601Monday-Friday: 9am to 5pm
Join Our Newsletter
© 2026 | Iron Cove Solutions| Privacy | Simplifying Cloud-Based Intention