Understanding how EOP works

As mentioned previously, EOP is an important part of the security in Microsoft 365 when it comes to detecting and stopping malicious emails from landing in your users’ mailboxes. It is one of the core features in Defender for Office 365 and provides the backbone of your email security.

To understand the way EOP works, we can look at the following diagram and see how it would process an inbound email:

Figure 14.2 – How EOP processes an inbound email

This process can be described as follows:

1. The inbound email first passes through the connection filtering phase of EOP. This verifies the sender’s reputation, and if the message is caught here, it is most likely spam.
2. The message is then scanned for malware in the second phase of EOP. If malicious code is identified inside the message or any attachment to that message, the email will be delivered to quarantine, where, by default, only an administrator...