In plain English
Exchange Online is the email service behind every Microsoft 365 mailbox. Security controls including DMARC, DKIM, SPF, Defender for Office 365 Safe Links and Safe Attachments, DLP policies, and legal hold all operate at the Exchange Online layer — making it the primary surface for both attack and defence in most Australian organisations.
Full definition
Every mailbox runs on Exchange Online. It is the infrastructure layer behind Outlook, and it is where most organisations' security controls either work or fail. , , and records prevent attackers from spoofing your domain in outbound email. Safe Links rewrites URLs in emails and checks them at click time against Microsoft's , so a link that was clean when it arrived can still be caught if the destination later turns malicious. Safe Attachments detonates suspicious files in a sandbox before they reach the recipient's inbox.
Exchange Online is also where , archiving, and compliance controls sit. When an organisation needs to preserve communications for litigation or a regulatory inquiry, in-place holds freeze mailbox content so it cannot be deleted. This integrates with for search and export. Australian financial services firms and law practices in particular rely on this for their record-keeping obligations.
The attack surface Exchange Online presents is real. attacks target mailboxes directly, often through rather than . Attackers who access a mailbox can set inbox rules to quietly forward emails, monitor communications for months, and time a payment redirection fraud to coincide with a legitimate invoice. Defender for Office 365 Plan 2, included in Microsoft 365 Business Premium, covers attack simulation training and post-breach investigation tools specifically designed for this environment.