Microsoft 365 (M365) Email Protection

Summary

Explains the two layers of Microsoft 365 email protection at Bowdoin — Exchange Online Protection (EOP) and Microsoft Defender for Office 365. Covers how spam, phishing, malware, and suspicious links are filtered, what users will see when protection is active, and what to do if a legitimate message is blocked.

Body

Questions

  • How does Microsoft 365 protect my Bowdoin email from phishing and malware?
  • Why are some emails going to my Junk folder automatically?
  • What is Safe Links and why does it rewrite URLs in my emails?
  • What happens when a malicious attachment is detected and removed from an email?
  • What do I do if a legitimate email or attachment was blocked?
  • What is Exchange Online Protection (EOP)?
  • What is Microsoft Defender for Office 365?

Environment

This article applies to all Bowdoin faculty, staff, and students with a bowdoin.edu email address. Microsoft 365 email protection applies to all incoming email automatically — no configuration is required by users.

Resolution

Microsoft 365 provides Bowdoin with two layers of email protection that work together automatically to protect against phishing, malware, spam, and suspicious links.

Diagram of Office 365 email security flow showing filtration of suspicious attachments and malicious links using sandboxing and safe links rewrite.

Layer 1: Exchange Online Protection (EOP)

EOP is the primary filter that scans all incoming email from outside Bowdoin before it reaches your mailbox. Here is what it does with different types of messages:

  • Bulk email: Delivered to your Junk Email folder.
  • Spam or phishing: Delivered to your Junk Email folder.
  • Known malware in an attachment: The attachment is removed and replaced with a file called Malware Alert Text.txt. The email body is delivered intact.
  • Suspicious links or attachments: Passed to Microsoft Defender for Office 365 for deeper analysis.

Layer 2: Microsoft Defender for Office 365

Defender for Office 365 provides a second level of protection against the most sophisticated and emerging threats. It includes two main features:

Safe Links

Safe Links scans every URL in incoming emails in real time at the moment you click the link. URLs from non-Bowdoin senders are rewritten so they pass through Microsoft's scanning infrastructure before taking you to the destination.

If you hover over a link in an email, you may notice the URL has been rewritten and begins with a Microsoft safety scanning address. The original destination URL is still visible within that rewritten link.

Email showing a Dell survey link with red labels explaining that hovering over a Safelink URL reveals the actual destination URL.

 

 

Phishing email example with annotations showing a suspicious hyperlink and Safelink URL containing the actual destination.

When you click a Safe Links URL, one of three things will happen:

  • Normal: You are taken directly to the intended webpage.
  • Scanning in progress: You briefly see a yellow message indicating the link is still being analyzed. Once scanning completes, clicking again will take you to the page.
  • Malicious link blocked: You see a red warning page indicating the link has been identified as malicious and access has been blocked.

Office 365 warning screens: one scanning a suspicious link, the other blocking access to a website classified as malicious.

Safe Attachments

Suspicious attachments are automatically analyzed in an isolated environment before being delivered. If the attachment is safe, it is delivered normally. If malware is detected, the attachment is removed and replaced with a file called Malware Alert Text.txt.

Phishing email claiming to be a UPS delivery notification with a suspicious file attachment labeled "Malware Alert Text.txt" circled in red.

The Malware Alert Text.txt file is safe to open. It contains information about the malware that was found in the original attachment.

Notepad window displaying a malware alert text stating that infected attachments were removed, listing three types of detected malware.

Received a Malware Alert Text.txt file? You do not need to report it. The malicious attachment was already detected, removed, and logged by IT. The email itself is safe to read.

What do I need to do?

Nothing. Both EOP and Defender for Office 365 work automatically in the background without any action from you. If you believe a legitimate email or attachment was incorrectly blocked, contact the Service Desk.

Additional Help

If you need further assistance, you have several options:

  • Bowdoin Bot: Chat with Bowdoin Bot directly from any KB page for instant answers.
  • Phone: Call the Bowdoin College Service Desk at (207) 725-3030.
  • In person: Visit the Tech Hub in Smith Union during business hours.
  • Submit a ticket: Request assistance through the Service Catalog.

Details

Details

Article ID: 40050
Created
Tue 10/3/17 5:01 PM
Modified
Mon 5/4/26 10:18 AM

Related Articles

Related Articles (7)

DMARC
Explains what DMARC is, how it works, and why Bowdoin uses it. DMARC is an email authentication protocol that prevents others from sending emails using the bowdoin.edu domain without Bowdoin's authorization. No action is required from faculty, staff, or students.
Junk Mail Folder
Explains what the Junk Mail folder is in Microsoft Outlook, how messages end up there, and how to check and manage it in Outlook Online and Outlook for Windows.
Manage Junk Email Settings
How to configure safe senders and blocked senders in Outlook Online to control which email goes to your junk folder, including how to allow entire domains or block specific senders.
Microsoft 365 External tag on new email messages
Explains the "External" tag that appears on email messages sent to Bowdoin addresses from outside the bowdoin.edu domain. Covers why the tag appears, what it means, and how to use it to identify potential phishing attempts.
Release Quarantined Email
How to review and release email messages that have been blocked by the Microsoft 365 spam filter and placed in quarantine, either from the quarantine notification email or directly from the Microsoft quarantine portal.
Reporting a Phish or Spam email
How to report a suspected phishing or spam email to Bowdoin IT using the Report Message option in Microsoft Outlook. Covers Outlook for macOS, Outlook Online, Outlook for Windows, and Outlook for iOS/iPadOS. No need to forward emails to IT directly.
Understanding Spam, Phishing, and Junk Email
Explains the types of unwanted email Bowdoin users may receive - phishing, bulk, and spam - how to identify them, and what to do if you receive or fall victim to one.