Office 365: E-mail Junk, Spam, Phishing Protection

Preset security policies - Microsoft Defender 

Enable at least standard protection.

https://security.microsoft.com/antiphishing

In the applicable policy, enable:

Spoof intelligence

First contact safety tip

https://security.microsoft.com/antispam

In the default inbound policy, enable:

Set BCL to 5

Set Links to .biz or .info websites to On