AegisAI Perspectives · 033
API-based email security leaves MX records alone, and an admin-approved app reads Microsoft 365 or Google Workspace mail after delivery to remove threats.
API-based email security leaves the MX record alone, and an admin-approved app reads Microsoft 365 or Google Workspace mail after delivery, within API limits such as 10,000 Microsoft Graph requests per mailbox every 10 minutes7. AegisAI connects this way, through the Microsoft 365 or Google Workspace API, with an OAuth grant your admin controls and can revoke15. Before you buy, check what the grant covers and how an admin takes it back.
API-based email security is a product that connects to the mailbox platform through its API and inspects mail that has already arrived. It does not receive mail itself. The built-in protection in Microsoft 365 is included in every organization with cloud mailboxes13. AegisAI's inbound email security page says 3 in 10 confirmed phishing emails cleared native Gmail and Microsoft filters in Q3 202624.
An integrated cloud email security (ICES) connection works in seven steps, from admin consent to removal. None of them touches DNS.
An admin grants consent. Only a Privileged Role Administrator or Global Administrator can consent to Microsoft Graph application permissions5. In Google Workspace, only a super admin can set up domain-wide delegation11.
The app runs under its own identity. In app-only access it calls Microsoft Graph without a signed-in user, using application permissions.
Mail keeps its route. RFC 5321 delivery first looks up the MX record for the destination name1, and lower preference numbers are more preferred. The API app never appears in that record.
The app hears about new mail. Microsoft Graph sends change notifications on messages by webhook to a URL the app supplies, and the app needs Mail.Read to receive them6.
The app reads within quotas. Microsoft Graph allows four concurrent requests per app and mailbox8. The Gmail API lists 6,000 quota units per minute per user per project12.
The app reads each delivered message. The change notification names the new message, and the app fetches it within the quotas above.
Removal uses a write grant. A read scope such as gmail.readonly only lets an app view email messages and settings, and Google classifies it as restricted10. Moving or deleting mail needs a write permission that the admin grants on its own.
A gateway sits in the delivery path and an API product sits beside the mailbox. Changing to Gmail, for example, means redirecting the domain's MX records to Google servers3.
| Criterion | API-based | Secure email gateway |
|---|---|---|
| Where it sits | Beside the mailbox, through the platform API | In the delivery path, named in the MX record |
| DNS change | None | MX records point at the gateway |
| When it acts | After delivery, by removing mail from mailboxes | Before delivery, by holding or rejecting mail |
| Access it needs | Admin consent to application permissions | DNS control and connector rules |
| Limits to plan for | API quotas per mailbox or per user | Gateway capacity and its own uptime |
| Rollback | Revoke the app's permissions | Restore the earlier MX records |
Illustrative example, figures are fictional. A 600-mailbox firm on Microsoft 365 trials an API product. On day 1 a Global Administrator consents to read-only application permissions, and the MX records stay as they are. Over 30 days the product reports 42 confirmed threats in delivered mail; the team checks each reason and agrees with 39. On day 31 the admin grants the write permission, and the median time from delivery to removal is 40 seconds. Had the trial failed, the admin would revoke the permissions in Entra ID and change nothing in DNS.
It means the deployment is an admin consent, with no DNS change window and no mail routed through new infrastructure. In Entra ID an admin opens Enterprise apps, selects the application, chooses Permissions and revokes what was granted for the whole organization9. In Google Workspace an app set to Blocked can't access any Google data14. The guide on how to replace a secure email gateway without a cutover weekend covers moving off a gateway in stages.
Evaluate them on what the connection is allowed to do.
More vendor questions are in the checklist on how to evaluate API-based email security.
Through the Microsoft 365 or Google Workspace API, with an OAuth grant your admin controls and can revoke15. There is no MX change and nothing in the delivery path. An admin to approve the API connection, which takes about five minutes, and a findings review at the end. Reads mail through the Microsoft 365 or Google Workspace API after delivery19. Runs in monitoring mode first.
Track three numbers from the first day of the trial.
They sell products that connect to Microsoft 365 or Google Workspace through the platform API, with no MX record change. The category is also called integrated cloud email security (ICES). Judge each one by the permissions it asks for and by how quickly it removes mail.
No. Mail delivery follows the MX record, and an API product never appears in it. The product reads mail through Microsoft Graph or the Gmail API after the platform has delivered it.
In Microsoft 365, a Privileged Role Administrator or Global Administrator consents to Graph application permissions. In Google Workspace, a super admin sets up domain-wide delegation.
Yes. In Entra ID, the admin revokes organization-wide permissions from the app's Permissions page. In Google Workspace, an app set to Blocked can't access any Google data.
No. The product sits outside the route RFC 5321 describes. Its own work runs alongside, capped at four concurrent requests per app and per inbox.
