Email Security & Archive

What does Microsoft 365's built-in email protection already cover?

More than people assume, and it is worth being precise about it before spending money on top. Exchange Online Protection, included with every mailbox, handles connection filtering, anti-spam, anti-malware and basic anti-phishing, plus outbound spam control and the quarantine that holds what it catches.

Defender for Office 365, included in some plans and available as an add-on to others, layers on link rewriting and detonation, attachment sandboxing, impersonation protection for named people and domains, and the investigation tooling that lets somebody trace where a message went after delivery.

The honest position is that most organisations are not using what they already pay for. Anti-phishing policies sit at defaults with no impersonation protection configured for the finance team or the directors who are actually targeted, domain authentication is published but not enforcing, quarantine is never reviewed, and inbound mail rules created by users are never audited.

Turning on and tuning what is already licensed is the cheapest security improvement available in most tenants, and it should always come before a purchase decision about an additional layer.

What does a dedicated email security layer add on top?

Three things principally: independence, continuity and depth of archiving. Independence matters because a layer sitting in front of or alongside Microsoft's own filtering uses different detection engines and different threat intelligence, so the messages one misses are not automatically the messages the other misses. It also means the protection and the mail platform do not share a single failure: when the platform has a bad day, the filtering layer is still standing.

Continuity is the capability Microsoft's own stack does not really offer, because the platform cannot provide a fallback for itself. Depth of archiving is the third: a dedicated archive is written outside the mailbox and outside the tenant, which is what makes it defensible as an independent record rather than a copy of something an administrator could change.

Why is business email compromise the expensive one?

Because it contains no malware, no suspicious link and often no spelling mistake, so there is very little for a filter to detect. The pattern is consistent: an attacker gets into one mailbox, usually through a convincing credential-harvesting page rather than anything technical, and then reads quietly for a while.

They learn how invoices are worded, who signs off what, when the finance manager is on leave, and which supplier is mid-project. Then they send an entirely ordinary email asking for bank details to be updated, from a real address, in the middle of a real thread.

That is why the controls that stop the loss are split across technology and process. The technical side is impersonation protection for your executives and key suppliers, domain authentication that stops your own domain being spoofed, and alerting on the tell-tale signs of a compromised mailbox, particularly newly created inbox rules that forward or delete.

The process side is the one that actually saves the money: any change to bank details is verified by telephone, on a number already held on file, never a number taken from the email. Most successful invoice frauds would have been stopped by a single phone call.

What do SPF, DKIM and DMARC do, and why is DMARC usually wrong?

They are the three records that let a receiving mail server decide whether a message claiming to be from your domain really is.

Without all three, spoofing your own domain is trivial, which is exactly the scenario your staff are least equipped to spot.

DMARC is where most estates fall down, and always in the same way: the record is published in monitoring mode and left there. That produces reports nobody reads and instructs receivers to deliver failing mail anyway, so the protection is nominal.

Miss one and its mail stops arriving. That is why it is staged, with reporting reviewed between each step, rather than switched on in an afternoon.

What does email continuity actually mean in practice?

It means a separate service accepts, queues and holds your inbound mail when the primary platform is unavailable, and gives your people a way to read and send in the meantime, usually through a web interface.

When the platform comes back, the queued mail delivers into the mailboxes as normal. The point is not that mail is never delayed. It is that nothing is bounced back to the sender as undeliverable, and the business can still communicate rather than sitting and waiting.

Two things are worth understanding about it. First, continuity is deliberately limited: it is a way to keep trading through an outage, not a full replica of Outlook, so historic mail and the usual integrations may not be there.

Second, it is only useful if people know it exists before they need it, which means the access route, the sign-in method and the announcement plan have to be documented and, ideally, rehearsed. A continuity service nobody can find the URL for during an outage is a line on an invoice.

Archiving, retention and backup: what is the difference?

They answer three different questions and are routinely confused. Retention is a policy inside the mail platform that governs how long items are kept and when they are removed. Archiving is a separate, written-once record of every message that passed through, kept independently of the mailbox so it survives deletion, mailbox limits and administrator action, and built to be searched.

The practical consequence is that the answer to 'do we have a copy of that email from three years ago' depends on which of the three you actually have. Most organisations need retention configured properly whatever else they do, an archive if they have regulatory, contractual or litigation exposure, and backup because Microsoft's shared responsibility model puts your data in your hands. Our backup service covers the recovery side of that in detail, and the two are usually scoped together.

What does a compliant archive need to do?

Capture everything, keep it unaltered, and let you find it. Capture means journaling at the point of transmission so inbound, outbound and internal mail are all recorded, rather than depending on what happens to remain in a mailbox afterwards.

Unaltered means the stored copy cannot be edited or removed inside the retention period, including by an administrator, which is the property that makes an archive worth anything in a dispute. Finding it means search that works across the whole estate, including attachments, quickly enough that a request is answered in minutes rather than being a project.

Beyond that, the operational requirements are the ones that get overlooked at purchase and matter at use. Legal hold that can be applied to a person or a subject and reliably overrides normal disposal. An audit trail showing who searched, when and for what, because unlogged access to everyone's correspondence is its own problem.

Defensible export in a format a solicitor or a regulator will accept. And a stated route for getting your data out if you leave the supplier, because an archive you cannot extract has quietly become a hostage rather than an asset.

How do you handle quarantine without burying people?

By deciding deliberately who reviews what, rather than letting the default decide for you. There are two failure modes and they pull in opposite directions. Send every user a digest of everything held and they stop reading it within a fortnight, then release something malicious because it was in a list they skimmed.

Route everything to IT and the queue grows faster than anyone can work it, so genuine business mail sits undelivered and people start asking suppliers to resend to a personal address, which is worse than the original problem.

What works is separating the categories. High-confidence malware and phishing should never be user-releasable at all: there is no legitimate reason to let somebody talk themselves into a message the system is confident about. Bulk and graymail can go to a user digest with a simple release, because the cost of a mistake is low.

The uncertain middle needs a named owner with the time to look, and a fast route for a user to ask about a specific message. Then review the pattern monthly, because a category that repeatedly holds legitimate mail is a tuning problem, and repeatedly releasing from it teaches people the wrong instinct.

What happens after a mailbox has been compromised?

The order matters, because the instinctive first move is the wrong one. Resetting the password alone leaves an attacker with a valid session, so the first actions are to revoke active sessions and refresh tokens, reset credentials, and re-register multi-factor authentication if there is any chance the attacker enrolled their own method.

Then remove what they left behind: inbox rules that forward or delete, added mailbox delegates, changed forwarding settings, and any application consent granted from the account, which is the persistence mechanism most often missed.

Only then does the investigation start, and this is where an archive and good logging earn their cost. What did they read, what did they send, and to whom? Did any message ask a client or supplier to change payment details, and if so those parties need telling immediately, by phone.

Whether the incident is notifiable to the ICO is a decision to be taken deliberately and on the basis of evidence, within the statutory timescale, and personal data in a mailbox somebody else has read is squarely the kind of thing that has to be assessed rather than assumed harmless. Trying to reconstruct any of this from a mailbox the attacker had time to tidy is exactly the position an independent archive avoids.

Where does staff training fit, and where does it not?

It fits as the layer that catches what technology cannot, which for email means the well-written message with no payload. The training that works is short, specific and about your own processes rather than generic awareness: what our invoices actually look like, that we never change bank details by email, that a request to buy gift cards is never real, and that reporting something that turns out to be legitimate is always the right call. The single most valuable habit you can build is a one-click report button people use without embarrassment.

Where it does not fit is as a substitute for controls, or as a way to move blame. Sophisticated phishing is designed to fool attentive people under time pressure, and any programme whose implicit message is that a click is a personal failing will produce staff who hide their mistakes, which is far more expensive than the click.

Simulated phishing is useful when it is used to measure whether reporting rates are rising, and counterproductive when it is used to name individuals. The technology should be good enough that people are the last line, not the first.

How much of this do you actually need, and where does our scope end?

Start with what you already own, because the sequence saves money. Tune the built-in protection, configure impersonation protection for the people who are genuinely targeted, get domain authentication to enforcement, and establish a quarantine process with an owner.

If that work has been done and the risk profile still justifies more, an additional layer is a reasonable next step, and it is more clearly justified where email downtime would stop the business trading, where a regulator or a client contract requires a retained searchable record, or where nobody internally has the time to review quarantine and alerts daily.

Archiving is a separate decision from filtering and should be taken on its own merits: what you are obliged to keep, for how long, and who might one day ask you to produce it. Our scope here is the email layer, from filtering and authentication through continuity to archive, alongside the Microsoft 365 configuration it depends on.

Broader identity hardening, Conditional Access and endpoint protection sit on our cyber security service, and recovering data rather than producing a record sits on our backup service. We would rather scope those separately and honestly than sell one thing labelled as another.