AegisAI Perspectives · 076
Choose email security for office and plant staff by counting mailboxes by type, then check that each product covers every type you find in your tenant.
Count your mailboxes by type, then choose the product that covers every type. Manufacturing tops the IBM X-Force target list for the fifth year1 and accounted for 27.7% of the incidents it observed2. AegisAI reads mail through the Microsoft 365 or Google Workspace API after delivery20, and the criteria below apply to any product you test. For the full buying guide, read email security for manufacturing companies.
Microsoft 365 F1 does not include rights to an Exchange mailbox10. On Office 365 F3, a user mailbox is limited to 2 GB and no archive mailbox is available3. Microsoft lists company information addresses and support addresses as shared mailbox uses, along with front-desk mailboxes8.
Write four rows: office users, shared mailboxes, frontline users with a mailbox, frontline users without one. Exchange Online gives shared mailboxes no login credentials, so licensed users reach them by delegation13.
Ask the vendor: which of these four types does the product read today, and how do I check that in the trial?
For Microsoft's own Defender for Office 365, a shared mailbox must be licensed for the feature before it applies4. A shared mailbox needs no licence to exist and holds up to 50 GB without one5. A protection model that follows licences skips every shared mailbox nobody licensed.
Ask every product how it counts mailboxes, and whether a newly created shared address is covered on day one.
Ask the vendor: is a shared mailbox covered from the day it is created, and does that change the price?
Microsoft 365 F3 and Exchange Online Kiosk do not include EWS application support or Outlook for Windows11. Microsoft's schedule starts phased disablement of Exchange Web Services on October 1, 2026 and ends with permanent retirement on April 1, 202712. A product that reads mail through Exchange Web Services loses its read path on those dates.
An F3 user can open other mailboxes but cannot have delegates open their own14. Ask the vendor to export its own record of what arrived in each F3 mailbox, because a delegate cannot open it.
Ask the vendor: which Microsoft API reads each mailbox, and does the trial read an F3 mailbox?
Microsoft says to block sign-in for the shared mailbox account and keep it blocked7. Microsoft requires delegate access to a shared mailbox to go through the delegate's own mailbox9. A shared mailbox supports up to 25 users6, and each one is a route in.
The Exchange permissions Send As and Send on Behalf let a delegate send mail as a shared mailbox16. Review the Send As grants on every shared mailbox, because a taken-over delegate account sends with the company's address.
Ask the vendor: does the product see mail sent as a shared mailbox, and does it flag a delegate account that starts behaving differently?
Information and support addresses are the shared mailboxes outsiders know about. Attackers used the Contact Us form on manufacturers' websites to start a conversation with employees15. For payment-change emails from suppliers, read how manufacturers stop supplier invoice fraud.
Find which shared mailbox receives your contact form, and which receives quote requests and support mail. Put those first in the trial.
Ask the vendor: can the trial start with the shared mailboxes that face the public?
Decide who reads an alert before you buy. In a plant that person is a shift lead or a supervisor, and a score with no explanation gives them nothing to act on.
Ask for three things on every alert: what the message asked the reader to do, the warning signs found, and the next step.
Ask the vendor: show me an alert for a message to a plant mailbox, written for someone who is not a security analyst.
A Secure Email Gateway is inline mail infrastructure. Traffic is routed through it with an MX record change, so every inbound message physically passes through the gateway before it reaches the mailbox24.
Get the answer in writing. When the product stops, does mail still reach the plant mailboxes, and does protection pause or does delivery?
Ask the vendor: what is the failure mode, and who tells me when the service is down?
Does the vendor's coverage list name office users, shared mailboxes, F3 or Kiosk users, and users with no mailbox as separate rows?
Does protection of a shared mailbox depend on a per-mailbox licence?
Which API reads F3 and Kiosk mailboxes, and is it free of EWS?
Does the trial read your public-facing shared mailboxes first?
Can the product show mail sent as a shared mailbox?
Does it watch the delegate accounts, up to 25 for each shared mailbox?
Does every verdict carry a reason a shift lead can read?
What happens to inbound mail if the product stops?
Can you start read-only and revoke access from your own admin console?
| Criterion | API-based | Gateway | Built-in platform controls | Managed service |
|---|---|---|---|---|
| Reach into shared mailboxes | Ask for the list of shared mailboxes it reads | Every inbound message passes through it | Defender features need the shared mailbox licensed | What the contract scopes |
| Reach into F3 and Kiosk mailboxes | Needs an API path that does not rely on EWS | Works on mail flow, so it does not read the mailbox | Same tenant, but no Outlook for Windows on F3 | What the provider's tools read |
| Reason a shift lead can read | Ask for a plain language reason on each verdict | A rule match or a score | A policy name and a verdict | The analyst's write-up |
| If the service stops | Depends on the product, so ask | Mail routing is affected | Part of the platform | Depends on the contract |
| Removal after delivery | Needs write access through the API | Limited once the mail is delivered | Needs the right licence per mailbox | Done by the provider |
Illustrative example, figures are fictional. Harlan Components (fictional) has 1,100 staff on Microsoft 365. 240 work in offices, 700 on the plant floor have F3 mailboxes, and 160 have F1 licences and no mailbox. Three shared mailboxes exist, named quotes, dispatch, reception. On a Monday a message titled "Revised shift rota" reaches the 700 F3 mailboxes and dispatch. In the trial, the product reads the 240 office mailboxes, the 700 F3 mailboxes and two shared mailboxes, quotes and dispatch. It convicts the message and removes 701 copies. The reception mailbox shows as not covered, because nobody had licensed it. The vendor adds it before the trial ends, and the shift leads receive one alert each with the reason in plain language.
AegisAI's agents investigate every inbound email for what it is trying to do, and remove the ones that fail from every mailbox they reached17, as the inbound email security page describes. A removed message leaves every inbox it reached, forwards included22. Every verdict comes with its reason in plain language18, and each alert gives a summary, the warning signs found and a recommended next step23. AegisAI runs in monitoring mode first, and removal needs write access your admin grants and can revoke2119. When the service stops, mail keeps flowing while detection pauses until the service returns25.
You can run that trial on your own tenant through the demo page. Ask the vendor to confirm in writing that shared mailboxes and F3 mailboxes are in scope.
Count mailboxes by type: office, shared, frontline with a mailbox, frontline without one. Then require every product to cover each type, state which API it uses, and give a reason a shift lead can read. Test it read-only on your own tenant before any removal rights are granted.
No. Microsoft 365 F1 does not include rights to an Exchange mailbox. A product that reads Exchange mailboxes has nothing to read for those staff. Check which channel carries their work messages and what protects it.
For Microsoft's Defender for Office 365, the shared mailbox must be licensed for the feature. Ask every other vendor how it counts shared mailboxes. Get the answer before the trial starts.
Microsoft says to block sign-in for the shared mailbox account and keep it blocked. Access runs through each delegate's own mailbox, so the delegate accounts need the same protection as the shared mailbox.
It affects any tool that reads mail through Exchange Web Services. Phased disablement begins October 1, 2026, and retirement is permanent on April 1, 2027. Ask which API the product uses for each mailbox type.
Start with the shared mailboxes that face the public: information and support addresses. Attackers have used the Contact Us form to reach manufacturers' employees. Then add a sample of F3 mailboxes and the office users.
