Is the Microsoft 365 spam filter enough on its own?

It usually starts with one email. A fake document-share notice, or an invoice from a supplier who doesn't use that address, sitting in the inbox rather than in Junk. Somebody forwards it to the office manager with a question mark. By lunchtime the question has become whether Microsoft's filter is any good, and whether the business needs to buy something else.

The honest answer has two halves. The filter every Microsoft 365 mailbox gets is decent at what it was built for. What it was built for is not the kind of email that costs a small firm money. And a fair amount of the protection that does target those emails is either already paid for or switched off, or both.

What every Microsoft 365 mailbox already gets

If your email is in Microsoft 365, it is already being filtered. Microsoft calls this the built-in security features for all cloud mailboxes. Most IT people still say Exchange Online Protection, or EOP, which was its name for years and is still what the setup wizards call it.

It works in stages. Connection filtering checks the reputation of the server sending the message, and Microsoft says most spam is rejected at that point, before anything else runs. Then anti-malware scanning. Then anti-spam and anti-phishing filtering, which sorts what is left into bulk, spam, high confidence spam, phishing and high confidence phishing. High confidence phishing always goes to quarantine. Spoofed senders get flagged.

You cannot switch the default policies off. You can only override them with something stricter. Microsoft publishes service levels for it, too: spam effectiveness above 99%, false positives under one in 250,000, and 100% of known viruses blocked.

Read that last one again. Known viruses.

What it is not built to catch

Microsoft is unusually direct about the limits. Its Defender for Office 365 overview says the built-in features prevent broad, volume-based, known email attacks. The next layer up, Defender for Office 365 Plan 1, is described as protecting against zero-day malware, phishing and business email compromise.

That split maps neatly onto the three emails that do the damage in a small office.

The first is a link that was clean when it arrived. Attackers send a message pointing at a harmless page, wait for it to pass the filter, then swap what the page serves. Anything that only checks links on delivery has already said yes.

The second is an attachment nobody has seen before. Signature-based scanning catches files that match something already known to be bad. A document built this morning for your accounts team matches nothing.

The third has no link and no attachment at all. It is a short, polite email that appears to be from your managing director, asking the finance person to handle a payment quietly. There is nothing in it for a malware scanner to find. We covered how that one plays out in the invoice fraud article.

None of this is rare. The government's Cyber Security Breaches Survey 2025/2026, published on 30 April 2026, found phishing at 38% of UK businesses, well ahead of anything else, and 69% of those who had a breach named it as the most disruptive. People impersonating an organisation or its staff came second, at 12%.

What Defender for Office 365 Plan 1 adds

Three things matter for a small business, and each one answers one of those emails.

Safe Links rewrites links in incoming email so that a click goes through Microsoft first, and checks the destination at the moment of the click, not just at delivery. It covers Teams messages and supported Office apps as well as email. A link that was harmless at 3pm gets looked at again when somebody clicks it at 4pm, by which point Microsoft may well know what it has become.

Safe Attachments opens attachments in a virtual environment and watches what they do before the message is delivered. Microsoft says scanning typically finishes within 15 minutes. That delay is the usual complaint. A setting called Dynamic Delivery answers it by delivering the message at once with a placeholder where the attachment will be, and swapping the real file in when the scan is done.

Impersonation protection looks for mail pretending to be specific people or domains: a display name matching your MD from an outside address, or a domain one letter away from your own. It exists only in Defender, not in the built-in filtering.

On licensing, the service description says Plan 1 is included in Microsoft 365 Business Premium, and from 1 July 2026 in Office 365 E3 and Microsoft 365 E3 as well. On Business Standard or Basic it is a paid add-on. Whether Premium is worth it overall is a bigger question than email, and we went through it in Business Standard vs Premium. The rest of this article assumes you have Plan 1 or are about to.

The part that ships switched off

Buying the licence is the easy half. Microsoft's own documentation is clear that several of the protections it pays for do nothing until somebody turns them on.

Microsoft offers preset security policies called Standard and Strict, which bundle its recommended settings for anti-spam, anti-phishing, Safe Links and Safe Attachments. Its own documentation says that on your first visit to the page, Standard and Strict are likely to be turned off, and that until you turn them on and assign people to them they apply to no one.

What does apply by default, on a tenant with at least one Defender licence, is a third preset called Built-in protection. It gives everyone basic Safe Links and Safe Attachments. Basic is the word to notice. Compared with Standard and Strict, Built-in protection lets users click through a warning to the original link, checks links through an API instead of rewriting them, and does not scan links in email sent between your own staff.

That last difference is the one people skip, and it is backwards from how attacks actually run. When one mailbox in your business is taken over, the next round of phishing comes from inside. It comes from a real colleague, to everyone in the address book, with a link. Under Built-in protection those internal messages get no Safe Links check at all. Under Standard they do.

Then there is impersonation. The anti-phishing documentation says it plainly: by default, no sender email addresses are configured for impersonation protection. Turning Standard on does protect the domains you own automatically, and switches on mailbox intelligence, which learns who normally writes to whom. But the named people, the MD and the finance director and whoever signs off payments, have to be typed in by hand. You can add up to 350 of them per policy, and up to 50 outside domains, which is where your bank, your accountant and your biggest suppliers belong.

One limit worth knowing. With mailbox intelligence on, user impersonation protection doesn't fire when the sender and recipient have emailed each other before. It is designed for the stranger pretending to be someone familiar. A supplier whose real account has been taken over is a different problem, and no filter setting solves it. The phone call does.

Standard or Strict

Standard for everybody. Strict for a few.

Microsoft describes Strict as a more aggressive profile for high value targets or priority users, and the differences are mostly in what happens to grey-area mail. Under Standard, spam and bulk mail go to Junk. Under Strict they go to quarantine. Strict also lowers the bulk mail threshold from 6 to 5 and raises the phishing threshold from level 3 to level 4, the most aggressive. For malware and for Safe Links and Safe Attachments there is no difference between the two.

So the people on Strict will see less rubbish and will occasionally lose a genuine newsletter or quote to quarantine. That is usually the right trade for the person who can move money. It is the wrong one for a sales team living on inbound enquiries.

Quarantine, and who is reading it

Stricter filtering means more mail in quarantine. That is fine only if somebody looks.

By default, only admins can see or release messages quarantined as malware or high confidence phishing, and recipients can never release those two themselves, whatever the settings say. At most they can ask. For everything else, what users can see and release, and whether they get a notification email at all, is decided by quarantine policies. Check what yours say rather than assuming.

And it doesn't wait for you. According to Microsoft's quarantine documentation, spam caught by the default policy is kept for 15 days, and for 30 days under Standard or Strict. Malware is kept for 30. After that it expires. A real invoice that sits in quarantine for three weeks with nobody reading it has simply gone.

A related puzzle comes up every few weeks. Somebody saw an email at nine, and by eleven it has vanished. That is almost always zero-hour auto purge, or ZAP. When Microsoft's filters learn after delivery that a message is malicious, ZAP pulls it out of the mailbox, read or unread. It only looks back over the last 48 hours of delivered mail, and users aren't told when it moves something. The system did its job. It just did it silently.

What a filter can't do

The NCSC's guidance on defending your organisation against phishing splits the job into four layers, and filtering is only the first. On cloud email its advice is short: make sure the provider's filtering is sufficient for your needs, and that it is switched on by default for all your users. That second clause is exactly the preset problem above.

The other layers still matter. DMARC, SPF and DKIM stop other people sending email as your domain, which protects your customers rather than your inbox; we wrote the plain-English version. Training helps staff report the ones that slip through, and the number worth counting is reports rather than clicks, as the phishing training article argues. And when a password does get handed over, multi-factor authentication is what stops the attacker using it.

No setting stops every phishing email. Anyone who tells you theirs does is selling something. The goal is fewer reaching people, faster removal of the ones that do, and a payment process that doesn't depend on nobody ever being fooled.

Do you need a third-party filter as well?

For most small offices on Business Premium, no. Configure what you are already paying for first. A tenant with Standard presets applied, the right people on Strict, the impersonation lists filled in and someone reading quarantine is in a much better place than one with a second product bolted on and the Microsoft side left at defaults.

There are good reasons to add a separate gateway. Some businesses need archiving or encryption features Microsoft doesn't give them on their plan, or they run mail through something other than Microsoft. If you go that way, read Microsoft's own warning first: another service wrapping links before Defender may stop Safe Links processing them. If you run both, test what actually happens to a link before trusting either.

On Business Standard, the choice is between the Defender add-on, a move to Premium, or a third-party filter. Price all three against the rest of what Premium brings before deciding.

Checking your own tenant in ten minutes

You don't need Global Administrator for this. A Global Reader or Security Administrator role is enough to look.

First, open the Your products page in the Microsoft 365 admin center and check whether Business Premium or a Defender for Office 365 plan is listed. If neither is, you are on the built-in filtering only, and everything from Safe Links onwards is a purchase decision.

If one is, go to security.microsoft.com/presetSecurityPolicies. See whether Standard and Strict protection are on, and who they apply to. Then open the anti-phishing policy and check whether any users or domains are listed for impersonation protection. Remember the default is none.

Last, open quarantine and look at the oldest message in it. If it is two weeks old and nobody has touched anything, you know who has been reading it.

What it costs with us

Email security and anti-phishing are part of our managed IT Professional plan at £77 per user per month, together with EDR, managed backup with tested restores and staff phishing-awareness training. Complete, at £108, adds 24/7 cover and managed detection and response. Essential, at £50, does not include email security. The layers are set out on our cybersecurity page, and every number is on the pricing page.

Microsoft 365 licences, including Business Premium, are supplied at list price and not marked up. What we do depends on what your tenant already has. On Premium, the job is configuration. On Standard, we will tell you what the gap is and what each way of closing it costs before anything is bought.

If you only want a one-off review and setup, it is hourly work: £126 an hour without an agreement, £86 an hour on a plan, and £167 an hour out of hours with a two-hour minimum. Ask for an estimate first. For a small single-tenant office it is not a long job. All prices exclude VAT.

If you are not sure where the rest of your setup stands, our free IT health check is ten questions and takes two minutes. Question ten asks about phishing training. The filter comes before it.