The configuration of Exchange Online Protection depends on the whitelisting measures set up on the Exchange Server. If you implement our whitelisting recommendations for Exchange Online, they will also be implemented in Exchange Online Protection.
Further information concerning this issue can be found here.