Exchange Online Protection overview

• 09/18/2020
• 7 minutes to read
• • c
  • m
  • M
  • D
  • L
  • +5

Applies to

• Exchange Online Protection
• Microsoft Defender for Office 365 plan 1 and plan 2
• Microsoft 365 Defender

Exchange Online Protection (EOP) is the cloud-based filtering service that protects your organization against spam, malware, and other email threats. EOP is included in all Microsoft 365 organizations with Exchange Online mailboxes.

The steps to set up EOP security features and a comparison to the added security that you get in Microsoft Defender for Office 365, see protect against threats. The recommended settings for EOP features are available in Recommended settings for EOP and Microsoft Defender for Office 365 security.

The rest of this article explains how EOP works and the features that are available in EOP.

How EOP works

To understand how EOP works, it helps to see how it processes incoming email:

1. When an incoming message enters EOP, it initially passes through connection filtering, which checks the sender's reputation. The majority of spam is stopped at this point and rejected by EOP. For more information, see Configure connection filtering.

2. Then the message is inspected for malware. If malware is found in the message or the attachment(s) the message is routed to an admin only quarantine store. To learn more about malware protection, see Anti-malware protection in EOP.

3. The message continues through policy filtering, where it's evaluated against any mail flow rules (also known as transport rules) that you've created. For example, a rule can send a notification to a manager when a message arrives from a specific sender.

   In on-premises organization with Exchange Enterprise CAL with Services licenses, Data loss prevention (DLP) checks in EOP also happen at this point.

4. The message passes through content filtering (anti-spam and anti-spoofing) where harmful messages are identified as spam, high confidence spam, phishing, high confidence phishing, or bulk (anti-spam policies) or spoofing (spoof settings in anti-phishing policies). You can configure the action to take on the message based on the filtering verdict (quarantine, move to the Junk Email folder, etc.). For more information, see Configure anti-spam policies and Configure anti-phishing policies in EOP.

A message that successfully passes all of these protection layers is delivered to the recipients.

For more information, see Order and precedence of email protection.

EOP datacenters

EOP runs on a worldwide network of datacenters that are designed to provide the best availability. For example, if a datacenter becomes unavailable, email messages are automatically routed to another datacenter without any interruption in service. Servers in each datacenter accept messages on your behalf, providing a layer of separation between your organization and the internet, thereby reducing load on your servers. Through this highly available network, Microsoft can ensure that email reaches your organization in a timely manner.

EOP performs load balancing between datacenters but only within a region. If you're provisioned in one region all your messages will be processed using the mail routing for that region. The following list shows the how regional mail routing works for the EOP datacenters:

• In Europe, the Middle East, and Africa (EMEA), all Exchange Online mailboxes are located in EMEA datacenters, and all messages are routed through EMEA datacenters for EOP filtering.
• In Asia-Pacific (APAC), all Exchange Online mailboxes are located in APAC datacenters, and messages are currently routed through APAC datacenters for EOP filtering.
• In the Americas, services are distributed in the following locations:
  • South America: Exchange Online mailboxes are located in datacenters in Brazil and Chile. All messages are routed through local datacenters for EOP filtering. Quarantined messages are stored in the datacenter where the tenant is located.
  • Canada: Exchange Online mailboxes are located in datacenters in Canada. All messages are routed through local datacenters for EOP filtering. Quarantined messages are stored in the datacenter where the tenant is located.
  • United States: Exchange Online mailboxes are located in U.S. datacenters. All messages are routed through local datacenters for EOP filtering. Quarantined messages are stored in the datacenter where the tenant is located.
• For the Government Community Cloud (GCC), all Exchange Online mailboxes are located in U.S. datacenters and all messages are routed through U.S. datacenters for EOP filtering.

EOP features

This section provides a high-level overview of the main features that are available in EOP.

For information about requirements, important limits, and feature availability across all EOP subscription plans, see the Exchange Online Protection service description.

Notes:

• EOP uses several URL block lists that help detect known malicious links within messages.
• EOP uses a vast list of domains that are known to send spam.
• EOP uses multiple anti-malware engines help to automatically protect our customers at all times.
• EOP inspects the active payload in the message body and all message attachments for malware.
• For recommended values for protection policies, see Recommended settings for EOP and Microsoft Defender for Office 365 security.
• For quick instructions to configure protection policies, see Protect against threats.