Just wanted to confirm the usability of some features of Defender for O365 when having a exchange hibrid scenario but still most of the mailboxes on-prem. From my understanding not all features will work
Safe Attachments (dynamic delivery will not work for onprem mailboxes)
Safe Links (works if the MX is pointing to EOP)
ATP for SharePoint, OneDrive, and Microsoft Teams (not applicable to EXO)
ATP anti-phishing protection (not sure if all settings will work for onprem mailboxes)
Real-time detections (reports)