It is possible to add Advanced Auditing to Windows (starting in Windows Server 2008) to monitor specific Registry keys/entries so that if they are modified, touched, etc. in any way, an event will be logged.
So in your case, you would want to monitor everything ...
EOP can be used with on-premises Exchange solutions.
Technically what happens is that you point your MX records at EOP, and then set up an outbound connector from EOP to your on-prem server(s). You can also use EOP for outbound filtering by using them as a “smart host”.
The same principle applies to other cloud-based or on-prem anti-spam solutions.