Microsoft email security: EOP (Exchange transport rules) vs Microsoft defender (Policy rules)

Question

We currently use Microsoft defender/Exchange as our email security solution. I wanted to know which rules get applied first the Exchange transport rule or the Microsoft defender policies. We have a rule in exchange to block all html attachments, but when I whitelist an external email address within Microsoft ant-phishing policy allow email domains, the messages still get stuck in quarantine.

So, my thought process is that that the exchange rules get applied first and the Microsoft defender anti-spam or ant-phishing policies. So if I need to whitelist an email address I should be doing this in Exchange transport rules as well.

**We use Exchange online

Answer 1

Transport Rules will be processed first, yes, so create there:

https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/zero-hour-auto-purge?view=o365-worldwide#what-if-im-using-safe-senders-mail-flow-rules-or-allowedblocked-sender-lists

This refers to ZAP, but its the general rule and applies: