BlakJak:

 

In an enterprise environment, being able to accurately withdraw known malicious emails from users inboxes is a neat feature. My team had a bunch of canned powershell scripts for this purpose when we had on-prem exchange. I'll admit to not knowing how to do it with EOL.

 

If you're looking to do it with EOL, you would be hard-pressed to look past O365 ATP which can ZAP emails out of the user mailboxes. Had a couple of ATP vs SMX vs Proofpoint vs Mimecast along with some frustrating calls where the customer acknowledges that ATP will be better in the short to long term but goes with the more expensive and longer to implement product.