Out of the box #microsoft365 has basic spam filtering but doesn't include the advanced security needed to protect firm staff from hackers nor managing partners/owners from impersonation prevention.
For these #microsoftatp is Microsoft offers ATP:
Microsoft 365 Advanced Threat Protection (ATP) is a cloud-based email filtering service that helps protect your organization against unknown malware and viruses by providing robust zero-day protection, and includes features to safeguard your organization from harmful links in real time.