Microsoft 365 Email Security Is a Settings Problem Before It’s a Vendor Problem
Microsoft 365 email security starts with Exchange Online Protection in every tenant. Defender for Office 365 Plan 1 adds link, attachment, and impersonation protection. A third-party gateway is a second layer, not a fix for unconfigured policies.
The buying question usually shows up first. Should we add Mimecast, Proofpoint, or one of the newer API tools? Reasonable question. It’s much easier to answer once you know what your tenant, meaning your company’s own Microsoft 365 environment, is set to do right now.
The money involved is real. The FBI’s 2025 Internet Crime Report put business email compromise losses at $3.05 billion. That’s the scam where someone poses as an executive or a supplier and asks for a payment, often with no malware and no link at all.
What every tenant already gets
Exchange Online Protection, or EOP, runs in every Microsoft 365 tenant with cloud mailboxes. It checks sender reputation, quarantines known malware, filters spam and spoofed senders, and pulls bad messages back out of inboxes when Microsoft learns about them after delivery. You can’t switch it off.
Its limit sits in one word from Microsoft’s own virus guarantee. Known. EOP is built for threats someone has already seen, and a first-time lure from a lookalike domain isn’t on anybody’s blocklist yet.
What Defender for Office 365 adds, and who has it
Plan 1 adds Safe Links, which checks a URL at the moment someone clicks it, and Safe Attachments, which opens files in a sealed test machine before delivery. It also adds impersonation protection against lookalike executives and domains, and it covers Teams, SharePoint, and OneDrive as well as Outlook. Plan 2 layers on investigation and automated response tools, which only pay off for a team that opens them.
Business Premium includes Plan 1. Under Microsoft’s 2026 packaging update, Microsoft 365 E3 and Office 365 E3 picked it up on July 1, 2026. If you renewed E3 this summer and also pay for a separate gateway, you may now be paying twice for link and attachment scanning.
What switches on by itself is narrower than the license. Microsoft’s Built-in protection policy applies Safe Links and Safe Attachments to everyone, but impersonation protection waits until an admin assigns the Standard or Strict preset policy.
The gap no filter closes cleanly
User impersonation protection has a documented blind spot. It doesn’t flag a sender the recipient has emailed with before.
An attacker inside a supplier’s real mailbox isn’t impersonating anyone. They write from the address your accounts payable team has used for years, often in the same thread, and SPF, DKIM, and DMARC all pass because the message really did come from that domain.
Some API-based tools sell behavioral detection for exactly this case. Test them against your own mail before you trust a datasheet. The control that reliably stops the payment is older and cheaper. Any change to bank details gets verified by phone, at a number already on file.
Get Consilien’s stories in your inbox
Join Medium for free to get updates from this writer.
Three ways to add a second layer
A secure email gateway changes your MX record, the DNS entry that tells the internet where to deliver your mail, so the vendor filters everything before Microsoft sees it. Microsoft fully supports this setup when Enhanced Filtering for Connectors is turned on, which lets Microsoft 365 see the real sender behind the gateway.
API tools connect inside the tenant through Microsoft Graph and scan mail after it lands. Microsoft’s guidance notes that this typically means granting the vendor full access to mailboxes, so the vendor’s own security practices become part of yours.
In-and-out routing sends mail from Microsoft 365 to another service and back again. Microsoft says it strongly recommends avoiding it, because returned messages look brand new, get counted twice in reporting, and weaken Defender’s detection.
Stacking has costs beyond the license, too. Both products want to rewrite every link, so Microsoft recommends switching link rewriting off in the other one. Staff end up with two quarantines. And Microsoft’s own integration page says false positives rise as more products are added.
Fix these first
Before a second tool, work through the settings you already pay for:
- Assign everyone to the Standard preset policy, and finance, executives, and IT admins to Strict.
- Run Configuration analyzer. It lists settings weaker than those presets.
- Delete mail flow rules that set spam confidence to -1 without a written reason, and stray IP allow entries with them.
- Block automatic forwarding to outside addresses.
- Move DMARC to enforcement.
- Put the call-back rule for payment changes in writing, with the controller’s name on it.
If that list is done and wire fraud still worries you, an API layer is a fair thing to trial. If it isn’t done, a new vendor adds a second set of settings nobody’s watching.
Consilien’s full guide includes a feature-by-license comparison of EOP and both Defender plans, Microsoft’s position on each integration model, and a decision table by business situation.
