AegisAI Perspectives · 015
Configure what E3 and E5 already include, then add a layer only for a named gap. The order of changes and the routing Microsoft supports.
Configure what E3 and E5 already include first. Defender for Office 365 Plan 1 comes with E3 from July 1, 20261, and Plan 2 comes with E52.
A third-party layer is the last step, not the first. Microsoft documents three ways to attach one, and it advises against one of them19. The order of changes matters more than the product you add.
Every Microsoft 365 subscription carries built-in security features. Microsoft names Defender for Office 365 the primary email security solution on top of them6.
E3 now includes Plan 1. Plan 1 brings Safe Attachments and Safe Links. It also brings anti-phishing policies and preset security policies, plus the Configuration Analyzer and real-time reports4. It does not include Plan 2 capabilities.
E5 includes Plan 2. Plan 2 adds advanced threat hunting and automation, plus investigation tools. Threat Trackers and Campaign Views are Yes for Plan 2 and No for Plan 1. So are automated investigation and response and attack simulation training, along with Defender XDR integration3. For investigation, Plan 1 gives real-time detections and Plan 2 gives Threat Explorer5.
An E3 tenant that wants Plan 2 features can start the 90-day Plan 2 trial in the Defender portal27. Older guides still describe Plan 2 as the E3 add-on. Check the licence line before you buy anything.
Non-Microsoft services integrate in three ways: an MX record that points to the service, the Microsoft Graph API, or in-and-out mail routing. The table below sets out what Microsoft says about each.
Pick the pattern before you pick the product. If the service sits in front of Microsoft 365, Microsoft fully supports Enhanced Filtering for Connectors20. That setting preserves the source IP address and sender information through the extra hop25. If the service reads mail through the Graph API, Microsoft says the route typically requires giving it full access to mailboxes21.
In-and-out routing is the one to avoid. Threat Explorer and Advanced Hunting count each message twice, and Microsoft strongly recommends against this route22.
Publish SPF first, then DKIM, then DMARC, for every custom domain. Include parked domains and subdomains10.
Remove bypasses. Mail flow rules that set SCL -1 and IP Allow List entries in the connection filter policy must be dealt with before other protections go on16.
Turn on the Standard preset security policy for all recipients. Microsoft recommends it as the starting point, and it is off until an admin turns it on1112.
Add the Strict preset for the users attackers target. Strict takes precedence over Standard, so a user placed in both gets the Strict settings13.
Tag priority accounts: up to 250 high value users get separate reports and extra heuristics14.
Send user reports to a reporting mailbox. Reported messages land on the User reported tab of the Submissions page15.
Only now add the layer. If it sits in front of Microsoft 365, set Enhanced Filtering for Connectors with the EFSkipLastIP parameter on the inbound connector, and turn off link wrapping in the service24.
Steps 1 to 6 need no new product. Step 7 is where a licence or contract changes.
| Pattern | Where the MX record points | What Microsoft says | Source fact |
|---|---|---|---|
| Service in front | The non-Microsoft service | Fully supported with Enhanced Filtering for Connectors | |
| Graph API | Microsoft 365 | Typically needs full mailbox access for the service | |
| In-and-out routing | Microsoft 365, then out and back | Counted twice in reporting, strongly recommended against | |
| Service after Microsoft 365 | Microsoft 365 | Enhanced Filtering is not intended for services that scan mail after Microsoft 365 | 26 |
Illustrative example, figures are fictional. Northgate Freight runs 900 mailboxes on Microsoft 365 E3. In week 1 the admin publishes DMARC at p=quarantine on 3 domains and finds an old SCL -1 rule for a logistics partner. The rule is removed. In week 2 the Standard preset goes to all recipients and the Strict preset to 40 finance and executive users. In week 3 the team routes mail through a cloud service placed in front of Microsoft 365 and enables Enhanced Filtering on the inbound connector. In week 4 users report 6 missed messages. Five were phishing links the Strict preset now blocks for the finance group. One is a payment change request with no link. That one gap is the case for an added layer, and the admin writes it down before any contract is signed.
Read spam quarantine inside its retention window. The default policy keeps spam 15 days and the Standard and Strict presets keep it 30 days8. The bulk email threshold also moves: 7 in the default policy, 6 in Standard and 5 in Strict7. Expect more mail marked as bulk after step 4.
Microsoft notes more cost and more complexity, plus a rising false positive rate as products are added, and says total protection never reaches 100 percent23. For a method to run a new layer next to an old one, read how to replace a secure email gateway without breaking mail flow. For the questions to ask about an API-based layer, read how to evaluate API based email security. For the settings that sit around these controls, see the Microsoft 365 and Google Workspace hardening guide.
Configure Plan 1, which E3 includes from July 1, 2026. Turn on the Standard preset for all recipients. Publish SPF, DKIM and DMARC, then remove bypass rules. Add a layer only for a gap you can name and measure.
Yes. Microsoft lists Plan 2 as included in enterprise subscriptions such as Microsoft 365 E5 or A5, and GCC G5. It adds advanced threat hunting and automation to Plan 1, plus investigation tools.
Only with Enhanced Filtering for Connectors. Microsoft fully supports a service in front of Microsoft 365 when the MX record points to that service and the setting is on. The setting keeps the source IP address and sender information visible to Microsoft.
Microsoft says integration through the Graph API typically requires giving the service full access to mailboxes. Check what the service stores, who at the vendor can read mail and how access is revoked before you grant it.
Messages leave and re-enter Microsoft 365, so Threat Explorer and Advanced Hunting count each one twice. Microsoft strongly recommends avoiding it.
Yes. Defender for Office 365 Plan 2 has a 90-day trial in the Microsoft Defender portal trials hub. Run it with the Standard preset on first, so the trial shows what the default policies leave out.
