What happens to my mail flow if you go down?
If AegisAI is unavailable, mail still flows. How it fits beside your gateway, identity platform and SIEM, what permissions it needs, and how to roll it back.
AegisAI Answers · Part 4
How AegisAI fits alongside your gateway, your identity platform and your SOC
Most AegisAI customers already run a secure email gateway or native filtering, a SIEM, and strict app-consent policies. Before they add anything, they want to know what it touches, what it can break, and how to turn it off. These are the questions their architects ask.
Questions in this article
- If AegisAI is unavailable, does mail stop?
- How quickly can we disable or roll it back?
- What permissions does the app need?
- Is the Microsoft app publisher-verified? How does it authenticate?
- Can AegisAI send detections into our SIEM?
- Which mail platforms do you support?
If AegisAI is unavailable, does mail stop?
No. AegisAI works post-delivery through the Microsoft 365 or Google Workspace API. It is not in the critical path of mail flow, so if our service or the API connection is unavailable, delivery to mailboxes is unaffected. Your gateway keeps doing its job.
How quickly can we disable or roll it back?
Immediately, and without touching mail flow. Revoke AegisAI's permissions in Microsoft Entra (Enterprise applications) or in the Google Workspace admin console, and access ends. There is no MX record to change back and no connector to unwind.
What permissions does the app need?
Only what the mode requires. A pilot runs read-only: the app can list users and read mail for classification, nothing more. Quarantine mode adds a single permission to move malicious messages. Every permission is shown on the consent screen before you approve it.
Is the Microsoft app publisher-verified? How does it authenticate?
Yes, AegisAI's Entra applications are publisher-verified by Microsoft. Each customer gets a dedicated application. It holds no persistent password or client secret: it uses workload identity federation, so only short-lived tokens issued to our production cluster can sign in. Credentials are never written to persistent storage.
Can AegisAI send detections into our SIEM?
Yes. AegisAI streams detection events (message metadata, verdicts, indicators and remediation actions) to your SIEM over webhook, and platform audit logs can be exported into your existing tooling. A REST API is also available and is enabled per account on request.
Which mail platforms do you support?
Microsoft 365 (Exchange Online) and Google Workspace. Organizations running their own on-premises mail servers over IMAP or POP aren't supported out of the box today; for very large deployments, talk to us about integration options.
More from AegisAI Answers
- Part 1: What happens when the attacker hides the payload? (coming soon)
- Part 2: Can I trust AI agents inside my inbox? (coming soon)
- Part 3: Wouldn't my current vendor catch what you catch? (coming soon)
- Part 4: What happens to my mail flow if you go down? (this article)
- Part 5: What happens to my data? (coming soon)
- Part 6: Will outbound DLP drown my team in false positives? (coming soon)
- Part 7: What if the attacker is already inside a trusted account? (coming soon)
- Part 8: How realistic are your simulations, and what about attacks outside the inbox? (coming soon)
Related posts
More from the AegisAI blog.