Office 365 includes some basic spam filtering but it is by no means full proof. There are many additional steps that can be taken to improve the security of your accounts. 

We strongly recommend these features are enabled as a minimum, they are disabled by default but with your permissions we would be very happy to set them up for you.

1. Two factor authentication - no additional licence cost
2. Customised Office 365 login (so users can easily identify if they are on the wrong login page) - no additional cost
3. User training and reporting with the email phishing attack simulator - billable time
4. Lock down access to your 365 accounts to specific countries (e.g. users can only login from the UK) - additional cost requires Azure Active directory Plan 1 licence
5. Deploy the Outlook plugin to report suspicious email
   1. From within Outlook, click the store icon 
   2. In the Search add-ins area, enter report message and press enter. Locate the Report Message add-in and click Add.
   3. You should see this new icon which can be used to report messages to Microsoft.
6. Purchase 'Microsoft Advanced Threat Protection' licences to enable more advanced phishing, link and attachment protection. - these incur an additional licence cost per user

Please get in touch if you'd like to learn more and/or enable any of the above.