UPDATE: Linux guy having been asked to do entraid/echange online hybrid, more questions for the experts

Hello fellow sysadmins, I posted this some time ago: https://www.reddit.com/r/sysadmin/comments/1uoc55f/linux_guy_being_asked_to_do_windows_entraid_stuff/ and you were all very helpful, thank you. the entraid and exchange migration stuff went well, a few inboxes with too many folders, the local imap server serving folders with special name that broke the imap migration (fixed with -includefolder and -excludefolder list, obviously I generated all the stuff programmatically using a small DB where I wrote all the infos I needed that I got from the on prem email server, axigen) autoconfigurations, outlook clients, teams, calendar, signatures, everything seems to be working well. the MX record have been switched, mail deliverability, inbound and outbound seems good. now I need to prepare the environment for the support people at the company to handle stuff like quarantine release and such. any pointers? I see that under security.microsoft.com -> threat policies -> standard protection seems to have a bunch of decent defaults, is this something that people do? I will spend some time learning this stuff because I have to say exchange online does seem like a well crafted product and I'm curious now of this side of things, my understanding of emails comes from using them, having read the IMAP and SMTP RFCs and having had adiacent issues with it from applications and infra management. and yes, they will also get someone to at least audit this stuff, I was able to get at least this done from a proper expert on the subject.