Exchange Online Data Protection: The Settings That Matter in 2026

Each row names the decision, where the setting lives, and the lowest license that includes it (Microsoft list prices from the October 2026 price list, per user per month on an annual term).

A mailbox is only as protected as its sign-in. Three Conditional Access policies cover the ground: require MFA for all users, block legacy authentication, and require a compliant or hybrid-joined device for administrators. Conditional Access needs Entra ID P1, which Business Premium and E3 include; a tenant on Exchange Online Plan 1 or Plan 2 alone has security defaults and adds Entra ID P1 at $7.00 per user per month for policies.

One date belongs here. Microsoft's updated timeline for SMTP AUTH basic authentication, published in January 2026, leaves behavior unchanged through December 2026, disables it by default for existing tenants at the end of December 2026 (administrators can re-enable it), withholds it from tenants created after December 2026, and defers the final removal date to an announcement in the second half of 2027. Move the printers and applications that send with a username and password to OAuth or a connector-based relay. Our Conditional Access policy list has the settings.

Exchange Online Protection filters every tenant's mail, and Microsoft publishes two preset profiles that set all the related policies at once: Standard and Strict. Turn Standard on for everyone, then put finance, payroll, executives and anyone who approves payments into Strict.

Defender for Office 365 adds the controls that catch targeted attacks: Safe Links (URL checks at click time), Safe Attachments (detonation before delivery) and impersonation protection for your executives and domains. Plan 1 is $2.00 per user per month and included in Business Premium; Plan 2 is $5.00, included in E5, and adds Threat Explorer, automated investigation and response, and attack simulation training. Buy Plan 1 for any tenant that handles payments or client data, and Plan 2 only when somebody will work in Threat Explorer. Additional Spam and Phishing Protection ($800 per project) applies the presets, tunes the impersonation lists and sets the quarantine policies.

Email authentication stops someone else sending as your domain. Three records, in order:

1. SPF: one TXT record listing every system that sends as the domain (Exchange Online, the marketing platform, the ticketing system, the accounting package).
2. DKIM: turn on signing for each domain in the Defender portal and publish the two CNAME records Microsoft gives you.
3. DMARC: start at p=none with a reporting address, read the aggregate reports for four weeks to find the senders you forgot, move to p=quarantine, then to p=reject.

DMARC, DKIM, and SPF Email Authentication Implementation ($450 per domain plus a $950 tenant fee) takes a domain to p=reject with the third-party senders included.

The second most common way mail leaves is a forwarding rule created by an attacker who already has the password. Four settings close it:

• In the outbound spam filter policy, set automatic forwarding to Off, or to On with a list of the mailboxes that have a business reason to forward.
• Keep the default alert policies that fire on a new forwarding or redirect rule and on suspicious sending, and route them to a mailbox somebody reads.
• Confirm mailbox auditing is on (the default), so the inbox rule and the sign-in that created it are in the audit log when you need them.

Microsoft's Purview licensing guidance lists data loss prevention for Exchange Online, SharePoint and OneDrive among the capabilities included in Microsoft 365 E3, E5, F3 and Business Premium. The first three policies for a US firm:

1. US Social Security numbers and credit card numbers sent to external recipients: policy tip, then block with a business-justification override.
2. Financial and HR documents, by sensitivity label or the built-in financial information types, sent to consumer mail domains: block.
3. Any file carrying the "Confidential" label shared outside the organization: policy tip and an alert to the compliance owner.

Run each in simulation mode for two to four weeks, read what it would have blocked, fix the false positives, then turn on policy tips, then blocks. Endpoint DLP and Teams chat DLP need E5, the E5 Information Protection and Governance add-on ($7.00) or the Purview Suite ($12.00). Our five DLP policies for a 50-user firm gives the policy settings, and Configure and Enable DLP Policies ($8,000 per project) builds and tunes them.

Exchange Online encrypts mail at rest and uses opportunistic TLS in transit when the other side supports it, which protects the hop and not the message. Four options cover the real cases:

The pattern for a 10-to-500-person firm: a mail flow rule that applies Encrypt-Only to a "Secure:" subject prefix or a detected Social Security number, a "Confidential" label users apply themselves, and no S/MIME unless a customer mandates it. Microsoft 365 Encrypted Email (OME) Implementation ($525 per project) sets up the rules and the user instructions.

Three different things get called "keeping the mail", each with its own setting and license:

• Deleted item recovery. A user's permanently deleted items stay recoverable for 14 days by default; Microsoft documents raising it to a maximum of 30 days with Set-Mailbox and the RetainDeletedItemsFor parameter. Do that on every mailbox.
• Retention policies and labels. Microsoft Purview keeps or deletes content on a schedule across mailboxes and archives. Basic retention is included in Business Premium and E3; adaptive scopes, automatic labeling and records management need E5, the E5 Information Protection and Governance add-on or the Purview Suite. Microsoft Purview Data Lifecycle Management Implementation ($4,500 per project) builds the schedule.
• Litigation hold and the archive mailbox. Litigation hold preserves everything regardless of what users delete, and Microsoft's documentation ties it to an Exchange Online Plan 2 license (included in E3 and E5) or Plan 1 with the Exchange Online Archiving add-on. Plan 2 also carries the 100 GB mailbox and the archive; Plan 1 stops at 50 GB. October 2026 price list: Plan 1 $4.00, Plan 2 $8.00, Exchange Online Archiving $3.00 per user per month.

Audit retention follows the same split: 180 days in every plan, one year with Audit (Premium) in E5 or the E5 eDiscovery and Audit add-on ($6.00), and a 10-year audit log retention add-on.

Retention and holds protect against a user deleting mail inside the policy. They do not protect against the policy being wrong, a ransomware-encrypted file set synchronized into OneDrive, or a departing administrator's bulk deletion before the hold was set. That is point-in-time restore, a separate product.

Microsoft 365 Backup is Microsoft's option for Exchange Online, SharePoint and OneDrive. Microsoft's pricing page describes it as pay-as-you-go through an Azure subscription, charged per gigabyte of protected content per month; it is Microsoft's metered charge, on your bill. Whichever you pick, test it: Microsoft 365 Restore Drill and Recovery Runbook ($2,450 per project) restores a mailbox, a site and a OneDrive under the clock, and Microsoft 365 Backup (Native) Setup and Management ($2,950) sets up Microsoft's product.

Every setting above produces a signal: a quarantine, a DLP match, a DMARC report, a forwarding alert, a Secure Score recommendation. The minimum: a weekly quarantine and alert review of under an hour, a monthly Secure Score pass with each new recommendation assigned or declined in writing, and a quarterly review of permissions and DMARC reports.

If that person does not exist, the Microsoft 365 Security 30 Days Service ($2,000 per project) establishes the routine and the Microsoft 365 Security Baseline and Secure Score Remediation ($3,450 per project) clears the backlog. Every IT Partner service on this page is quoted in writing before work begins; Microsoft subscription and metered charges are always yours.

Does Exchange Online encrypt email by default?

At rest, yes, and in transit with opportunistic TLS when the receiving system supports it. That protects the hop, not the message; for control after delivery you need Purview Message Encryption or a sensitivity label with encryption, both included in Business Premium, E3 and E5.

Is litigation hold the same as a backup?

No. Litigation hold keeps content in the mailbox and searchable, which satisfies legal preservation; it needs Exchange Online Plan 2 or Plan 1 with Exchange Online Archiving. Restoring a mailbox to an earlier state needs Microsoft 365 Backup or a third-party product.

Does Microsoft 365 Business Premium include DLP?

Yes. Microsoft's Purview licensing guidance lists DLP for Exchange Online, SharePoint and OneDrive among the capabilities included in Business Premium, with basic retention and basic message encryption. Endpoint and Teams chat DLP need E5 or a Purview add-on.

What is the difference between Defender for Office 365 Plan 1 and Plan 2?

Plan 1 ($2.00 per user per month, included in Business Premium) adds Safe Links, Safe Attachments and impersonation protection. Plan 2 ($5.00, included in E5) adds Threat Explorer, automated investigation and response, and attack simulation training.

How long are Exchange Online audit logs kept?

180 days in every plan. Audit (Premium), included in E5 and the E5 eDiscovery and Audit add-on, keeps one year, and a separate 10-year audit log retention add-on exists.

• Microsoft Purview licensing guidance — Microsoft, checked 2026-10-11
• Preset security policies in EOP and Microsoft Defender for Office 365 — Microsoft Learn, checked 2026-10-11
• Change how long permanently deleted items are kept for an Exchange Online mailbox — Microsoft Learn, checked 2026-10-11
• Create a Litigation hold — Microsoft Learn, checked 2026-10-11
• Exchange Online limits — Microsoft Learn, checked 2026-10-11
• Use DMARC to validate email — Microsoft Learn, checked 2026-10-11
• Configure outbound spam policies in EOP — Microsoft Learn, checked 2026-10-11
• Microsoft Purview Audit solutions overview — Microsoft Learn, checked 2026-10-11
• Microsoft 365 Backup pricing — Microsoft Learn, checked 2026-10-11
• Updated Exchange Online SMTP AUTH Basic Authentication Deprecation Timeline — Microsoft Tech Community, January 2026, checked 2026-10-11
• Deprecation of Basic authentication in Exchange Online — Microsoft Learn, checked 2026-10-11