Three deployment patterns
| Pattern | Where to examine the design |
|---|---|
| Gateway / MX-based | An inline service receives inbound mail before the mailbox platform. Review routing, connectors, bypass routes and quarantine operations. |
| API-integrated | A service connects to the cloud platform. Verify its exact inspection and remediation timing, permissions and supported workloads. |
| Platform-native | Controls within the mailbox service. Verify licences, policy coverage and integration with incident response. |
Mimecast documents MX-based gateway protection; Proofpoint documents API-based Core Email Protection for Microsoft 365. [Mimecast: secure email gateway] [Proofpoint: API email security]
Preserve the original sending context
Microsoft’s Enhanced Filtering for Connectors addresses supported routes where a third-party service precedes Microsoft 365, helping the platform evaluate the original source rather than only the last gateway. Its supported topology and configuration constraints need checking. Do not assume that adding another filtering layer is automatically correctly integrated. [Microsoft: enhanced filtering for connectors]
Plan for detections after delivery
Microsoft’s Zero-hour Auto Purge can act on messages after delivery when they are subsequently identified as threats, subject to the documented workloads and policies. This illustrates why first-pass filtering is only part of the operating model. [Microsoft: zero-hour auto purge]
What a corporate evaluation should prove
- The supported inbound, outbound and internal routes, including applications and forwarding.
- The relevant phishing, impersonation, malware and URL/attachment capabilities in the proposed licence.
- How a false positive is reported, investigated, released and recorded.
- Who can search or remove messages, under which approvals and with which audit trail.
- What a connector or vendor outage does to mail flow, and how it is tested.
- How alerts and actions reach the existing incident system, with one owner and a linked record.
Use this checklist to test vendor claims against your business scenarios.
From selection to operation
Email Review establishes the current coverage. Email Projects designs and implements the agreed controls. Managed Email owns ongoing incidents and administration within scope. For a live fault, use Email Resolution. All changes follow the agreed corporate change process.
Primary sources
- Mimecast: secure email gateway
- Proofpoint: API email security
- Microsoft: enhanced filtering for connectors
- Microsoft: zero-hour auto purge
Provider requirements and product capabilities can change. Check the linked source before a production change.