Out of the box #microsoft365 has basic spam filtering but doesn't include the advanced security needed to protect firm staff from hackers nor managing partners/owners from impersonation prevention.
For these #microsoftatp is Microsoft offers ATP:
Microsoft 365 Advanced Threat Protection (ATP) is a cloud-based email filtering service that helps protect your organization against unknown malware and viruses by providing robust zero-day protection, and includes features to safeguard your organization from harmful links in real time.
ATP has rich reporting and URL trace capabilities that give administrators insight into the kind of attacks happening in your organization.