Email is the only IT service every person in the organisation uses daily, and at the same time the main attack vector. I write about filtering and quarantine in Exchange Online, about SPF, DKIM and DMARC without breaking your own deliverability, about applications that still send mail over plain SMTP, and about how to tell users what they cannot see.
Publishing a strict policy in one day ends with your own invoices and newsletters being rejected. Sender authentication is rolled out in a specific order, with reports as the guide.
A message caught by a filter does not always generate a notification. Whether the user ever finds out depends on the quarantine policy assigned to the filter that caught it.
Older applications, printers and scripts send mail to port 25 with no encryption and no authentication. A cloud mail service will not accept that. One internal relay solves the problem better than twenty exceptions.