Dec 21 2016 06:05 AM
It’s impossible for an email hygiene service like Exchange Online Protection (EOP) to suppress every possible piece of malware that attempts to penetrate Office 365. Even the broad array of anti-malware techniques will let some small percentage of spam through. Email administrators need to be on guard all the time.
https://www.petri.com/exchange-online-protection-battle-malware