Security challenges

Used by many 100,000s of customers Used by many 10,000,000s of users Processing Billions of s a day Using Thousands of servers Across dozens of Datacenters worldwide Supported by SMEs who wrote the code 24x7x365

On-premises server - Inbound and Outbound filtered through EOP Corporate Network EOP

is routed to EOP DC based on MX record resolution (Contoso-com.mail.protection.outlook.com) IP-based edge blocks Envelope blocks Virus Scanning AV Engine 1 AV Engine 2 AV Engine 3 SPAM Protection Safe Sender/Recipient Policy Enforcement Custom Rules Content scanning and Heuristics Bulk Mail filtering SPF & Sender ID Filter Quarantine International Spam Advanced SPAM management Customer Feedback False +ve / -ve Customer Feedback False +ve / -ve Spam Analysts Corporate Network

High Risk Delivery Pool High Score Outbound Pool Low Score SPAM Protection Content scanning and Heuristics Advanced SPAM management Virus Scanning AV Engine 1 AV Engine 2 AV Engine 3 Policy Enforcement Custom Rules Quarantine Spam Analysts Corporate Network

1. Connection filtering Blocks up to 80% of all spam based on IP block/allow lists. 2. Sender-Recipient Filtering Blocks up to 15% of all spam based on internal lists and sender reputation. 3. Content Filtering Blocks up to 5% of all spam based on internal lists and heuristics. 10

Connection filtering Static IP allow/block list Opt-in to Microsoft-maintained reputable sender list Content spam categories Blatant spam High confidence spam Content Filtering Actions Delete Quarantine Add X-Header Modify Subject Redirect 11

Block external threats quickly Advanced fingerprinting technologies that identify and stop new spam and phishing vectors in real time. Enable more control Mark all bulk messages as spam Block unwanted based on language or geographic origin Block based on language Block based on geography

Suspect junk mail by default goes to the Outlook junk mail folder. Uses Outlook safe senders and block lists. SPAM Quarantine is currently available to administrators only, but end-users will get access shortly. Spam Notification for the end-users

14

Delete messages Delete attachments Robust, customizable notifications Sender notifications Admin notifications

16

Same rule set as Exchange Transport Rules Includes some new conditions: The sender…IP matches any of these addresses Attachment scanning Any attachment…has executable content The message…contains sensitive information The message…size exceeds 17

Same rule set as Exchange Transport Rules Includes some new actions: Generate incident report Require TLS Encryption Put message in quarantine mailbox Use the following outbound connector… 18

Same rule set as Exchange Transport Rules Includes some new options: Rules can be configured to run for a specific time period Rules can be run in Test Mode Information Rights Management and Office 365 Message Encryption can be applied to messages using a transport rule. 19

Helps to identify monitor protect sensitive data through deep content analysis.

Extended Message trace and improved reporting Directory Based Edge Blocking Match Sub-domains Remote PowerShell for customers without hosted mailboxes  End user access to Quarantine  DKIM for inbound  Support for IPV6

No Am APAC EMEA PRC

SessionTitleTimingRoom SPR.202Encryption in ExchangeTue 10:45 AM - 12:00 PMBallroom E SPR.201 Eliminate the Regulatory Compliance NightmareTue 9:00 AM-10:15 AMMR 19ab SPR.UN.305 Exchange Online Protection: Notes from the fieldWed 10:15 AM – 11:30 AMBallroom G SPR.UN.304 Experts Unplugged: EOP & Encryption Wed 8:30-9:45 AM Wed 1:00-2:15 PM MR 18d MR 17b SPR.401 Extending Data Loss Prevention For Your BusinessWed 4:45 PM- 6:00 PMMR 18bc SPR.203 Protect your Organization with Exchange Online Protection (EOP)Mon 4:30 PM - 5:45 PMMR 18bc SPR.301 So how does Microsoft handle my spam?Tue 4:45 PM – 6:00 PMMR 19ab SPR.401Using Connectors & Mail RoutingWed 2:45 PM - 4:00 PMMR 18bc ARC.304 Exchange Server 2013 Transport ArchitectureTues 9:00 AM - 10:15 AMBallroom F EDC.302 Advanced Data Loss Prevention in ExchangeTues 1:30 PM-2:45 PMBallroom F EDC.UN.301 Experts Unplugged: Data Loss Prevention Tue 3:00 PM-4:15 PM Wed 10:15 AM-11:30 AM MR 18d MR 13ab EDC.204 Data Loss Prevention in Exchange, Outlook, OWAMon 2:45 Pm-4:00PMMR 18bc MNG.304 Reporting On O365 Mail flow and Mailbox DataWed 1:00 PM-2:15 PMMR 17a