Do you still need Mimecast if you have Microsoft Defender for Office 365?

Why nobody gives you a straight answer on this

Because almost everyone writing about it sells one of the two. Microsoft's material explains that Defender covers what you need. Mimecast's material explains that a native-only approach leaves gaps. Both are arguing their own book, and both make reasonable points, which is exactly what makes the question hard to resolve from public sources.

Systech resells Mimecast and is a Microsoft partner. We make money either way, and we would rather tell you not to buy something than sell you a licence you do not need and have the conversation about value at renewal instead.

Where Defender genuinely is enough

If you are on Business Premium or E5, your mail is entirely in Exchange Online, you have no regulatory archiving obligation, and nobody has asked you to demonstrate vendor separation in your security stack, then Defender for Office 365 configured properly is a reasonable place to stop.

The word doing the work there is configured. A very large share of the gaps we find in Microsoft 365 estates are not gaps in what the licence covers, they are features included in a licence the business already pays for and has never turned on. Safe Links and Safe Attachments policies left at defaults, no anti-phishing policy with impersonation protection, no Conditional Access. Buying a second product to sit in front of an unconfigured first one is an expensive way to avoid a configuration exercise.

That is genuinely the most common honest answer to this question: before adding a gateway, find out whether what you already own is switched on.

Where a gateway still earns its place

Continuity. If Exchange Online is unavailable, a gateway with continuity keeps mail flowing and gives users somewhere to read and send from. Whether that matters depends entirely on what an hour without email costs you, and for some businesses the answer is genuinely not much.

Independent archiving. If you have a retention obligation, or you may need to produce mail for a dispute or a regulator, an archive held separately from the platform that generates the mail is a stronger position than retention policies inside the same tenant. This is the one that most often decides it for regulated firms.

Vendor separation. If your mail platform and your mail security are the same vendor, a compromise or a misconfiguration in that vendor's stack affects both at once. Some sectors and some insurers now ask about this directly. Whether it is a real risk or a procurement preference varies, but it is increasingly a question you have to have an answer to.

Notably, none of those three is about catching more phishing. If a vendor is selling you a gateway primarily on detection rates, ask them to explain the continuity and archiving position instead.

If you decide to move off Mimecast

We will help you do that, and it is worth saying so explicitly on a page that could be read as a sales pitch for keeping it.

The part that catches people out is not mail flow, which is a straightforward connector and MX change. It is the archive. Mail already in a Mimecast archive does not automatically appear in Exchange Online, and archive extraction is slow, occasionally expensive, and much easier to plan before you give notice than after.

The other piece is policy parity. A gateway typically accumulates years of rules, allow lists and exceptions. Migrating those without review reproduces every historical mistake in a new system; not migrating them at all breaks things nobody remembers configuring. It needs a proper review either way.