You may already have more than you think
Phishing, malicious attachments and fake payment requests remain among the most common ways attackers reach a business. The usual response is another product: a gateway, a filtering service, another subscription. Sometimes that is right. First, ask whether the protection already in Microsoft 365 is set up properly.
Exchange Online Protection provides anti-spam, anti-malware and anti-phishing filtering for cloud mailboxes. Defender for Office 365 Plan 1 adds Safe Links, Safe Attachments and stronger impersonation protection. Plan 1 is included in Microsoft 365 Business Premium and, since 1 July 2026, in Office 365 E3 and Microsoft 365 E3. Plan 2, with further investigation and response tools, is included in enterprise plans such as Microsoft 365 E5.
Many organisations therefore have more email protection available than they realise. Available is not the same as configured.
Start with SPF, DKIM and DMARC
These three records help receiving mail systems decide whether a message claiming to come from your domain is genuine.
- SPF lists the servers allowed to send mail for your domain.
- DKIM adds a digital signature showing that signed parts of a message have not been altered.
- DMARC tells receiving systems what to do with messages that fail those checks, and can send you reports about them.
Roll authentication out carefully
Most businesses send mail from more places than they expect: Microsoft 365, the website, a marketing platform, the invoicing system. Each legitimate sender needs including. We recommend publishing DMARC in monitoring mode first, reading the reports, then moving gradually towards quarantine or reject once every genuine source is accounted for.
Authentication makes it harder to impersonate your own domain. It does not stop every phishing message. Microsoft notes that an attacker can send mail that passes SPF, and a compromised genuine account sends authenticated mail too.
Check the policies, not just the defaults
Microsoft provides Standard and Strict preset security policies containing its recommended settings. Built-in protection gives licensed users basic Safe Links and Safe Attachments coverage, but Standard and Strict are off until an administrator turns them on and chooses who they apply to. Default protection is not a reviewed configuration.
A review should cover the following.
- Anti-spam, anti-malware and anti-phishing policies, including spoofing and impersonation settings.
- Safe Links and Safe Attachments, where licensed.
- Protection for senior staff, finance and others who are frequently impersonated.
- Automatic forwarding, suspicious inbox rules and how quarantined mail is released.
- How staff report suspicious messages, and who looks at those reports.
- Sign-in security, because email filtering cannot protect a mailbox whose password has been stolen.
Different products, different detections
Security vendors share intelligence, but there is no compulsory global database that every email filter uses. Each combines shared information with its own research and detection methods, so two products can reach different conclusions about the same message.
That difference can be valuable. It does not show that every business needs two layers. The value of a second layer depends on what the first one is already doing.
When another layer makes sense
Additional email security can be justified by a specific detection need, mail continuity or archiving requirements, contractual or regulatory obligations, or evidence that your real threats are getting through. We provide managed email security for exactly those situations.
If Microsoft 365 is configured well, alerts are handled and a measurable gap remains, adding a layer is a sound decision. If the basics are incomplete and nobody reviews what is already there, another product adds cost and complexity without fixing the problem.
Configure first. Measure second. Buy third.
Work in this order and any purchasing decision rests on evidence. You should be able to explain why each security product is in place, what it protects and who is responsible for it.
A practical sequence looks like this.
- Confirm what your current Microsoft licences include.
- Review SPF, DKIM, DMARC and the threat policies against your risks.
- Test mail flow, and check false positives as well as threats that got through.
- Make sure suspicious messages are reported and someone acts on them.
- Compare any proposed product against that configured baseline.