AegisAI Perspectives · 028
Yes, one email security layer can run across Google Workspace and Microsoft 365 at once, connecting each tenant by MX routing or its API after delivery.
Yes. One security layer can cover Google Workspace and Microsoft 365 at once, and Microsoft lists three ways an outside service connects to Microsoft 365: DNS mail routing, the Microsoft Graph API or in-and-out mail routing1. AegisAI reads mail through each platform's API after delivery22, so the MX record stays where it is23.
Mail flow decides how email security across Google Workspace and Microsoft 365 is set up, because the MX records for a public domain name one primary server13. Each platform on its own is covered in how cloud email security works for Microsoft 365 and for Google Workspace. Workspace alone is covered in how to add a third-party security layer to Google Workspace.
Start from the MX record, choose one connection method per platform, then connect both tenants to the same layer. Each step names the setting it changes.
Look up the MX records for the public domain. The server they name is the primary server. By default, Google Workspace delivers all incoming email to Gmail17.
Split delivery requires that the domain's MX record uses Google15. Each user then has an address in Gmail or in the other system, and never in both. For dual delivery, Google recommends Gmail as the primary server14.
Graph API integration typically requires granting the service full access to mailboxes2. In-and-out routing counts each message twice in Threat Explorer, Advanced Hunting and automated investigation and response3.
With a third-party filtering service in front of Microsoft 365, the MX record must point to that service4. Lock the Partner inbound connector to the service certificate or IP addresses, so mail smart-host routed straight to Exchange Online is rejected.
Microsoft built it for domains whose MX record does not point to Microsoft 3656. It keeps the source IP address and sender information of mail that passed through the service in front.
If Google Workspace sends through an outbound gateway, set the gateway to accept and forward mail only from Google Workspace server IP addresses18.
Each platform has its own API, and the layer reads mail through the Microsoft 365 or Google Workspace API after delivery. Microsoft Defender for Cloud Apps, for example, connects to Google Workspace through an API connector11. Read results per tenant before the layer acts on mail.
If all messaging moves to the cloud, point the MX record at the cloud first and protect all inbound mail there8. If both systems stay for good without cloud email protection, the MX record can stay as it is.
AegisAI reads mail through the Microsoft 365 or Google Workspace API after delivery. It makes no change to mail routing, so the MX records stay as they are. It runs in monitoring mode first.
Each setup changes a different setting, and in-and-out routing counts each message twice in Threat Explorer and Advanced Hunting. Use the table to match a setup to the domain's MX record.
| Setup | Platform | MX record | Effect on reports or headers | Setting to check |
|---|---|---|---|---|
| DNS mail routing | Microsoft 365 | Points to the service | Source IP and sender kept with Enhanced Filtering | Partner inbound connector locked to the service |
| Graph API connection | Microsoft 365 | Unchanged for an API layer | Outside the double count warning for in-and-out routing | Full mailbox access granted to the service |
| In-and-out mail routing | Microsoft 365 | One of three listed options | Each message counted twice | Connectors out to the service and back in |
| Split delivery | Google Workspace | Must use Google | Each user lives in one system | Default delivery to Gmail changed |
| Dual delivery | Google Workspace | Names the primary server | Gmail recommended as primary | Legacy server may be primary in a pilot |
Illustrative example, figures are fictional. Northfield Analytics (fictional) has 600 staff on one domain: 420 in Microsoft 365 after an acquisition and 180 in Google Workspace. The MX record points to Google, so the admin sets up split delivery, and each of the 600 addresses lives in one system. The admin adds no in-and-out route, so Microsoft 365 reports avoid the double count. Both tenants connect to one API layer in monitoring mode. In week one it flags 41 messages in Microsoft 365 and 17 in Google Workspace. Six of the 17 come from one campaign that also reached 9 Microsoft 365 mailboxes, and one review view shows all 15 together. The admin reviews the 58 flags, then turns on removal for both tenants.
No. They are separate platforms with separate mail routing and separate built-in security. Google Workspace delivers all incoming email to Gmail by default, and every Microsoft 365 subscription with cloud mailboxes includes built-in security features10.
One domain can still serve users on both. A Microsoft Q&A answer says you can keep your existing domain with both platforms without buying another domain12. A layer that covers both connects to each platform's API separately.
Yes. Attackers go after accounts on both platforms, as two recent incidents show. Nikkei said an employee's Google Workspace account was accessed in late July and that a second employee email account was also breached20.
In one campaign against Microsoft 365 accounts, an attacker completed hundreds of successful sign-ins at nearly 30 organizations over four days19. Sign-in abuse of this kind is covered in how email account takeover works. Put both tenants in one review queue so a campaign that touches each shows up once.
Architecture decides whether the layer sits in front of delivery or reads mail after it. With DNS mail routing the MX record points to the service, so it sits in front of Microsoft 365. Enhanced Filtering for Connectors then keeps the source IP address and sender information.
An API-native layer reads mail after delivery through each platform's API. It leaves the MX records unchanged, which fits a domain whose MX records name only one primary server. The trade is access: Graph API integration typically requires granting full access to mailboxes. Moving from an MX-routed gateway to an API layer is covered in how to replace a secure email gateway without a cutover weekend.
Write one policy, then connect each tenant to it separately. The policy names which messages are held, who reviews them and who can release them.
During a migration, keep the old platform connected until its last mailbox moves. Google says a legacy server might be primary during a pilot or migration to Gmail, and Microsoft calls pointing the MX record at the cloud first a logical choice when all messaging moves there.
Keep one written standard and map it to each platform's own settings. Use NIST SP 800-177 Rev. 1, which gives recommendations and guidelines for enhancing trust in email, as the shared reference for both tenants21.
Authentication for a shared domain is one set of DNS records, so roll it out once using the DMARC rollout steps that avoid breaking mail. For shared files and data, the Google Workspace connector in Microsoft Defender for Cloud Apps monitors user activity and protects shared data. Send outbound Workspace mail only through a gateway that accepts Google Workspace server IP addresses.
Track three numbers, each split by platform, from the day both tenants connect.
Yes. Built-in security features for cloud mailboxes are included in all Microsoft 365 subscriptions with cloud mailboxes. What each paid tier adds is covered in the Microsoft 365 E3 and E5 email security breakdown.
Yes. For Microsoft 365, Microsoft lists three options: DNS mail routing, the Graph API or in-and-out routing. AegisAI reads each tenant through its API after delivery and leaves the MX record alone. Record which method each tenant uses.
Yes. A Microsoft Q&A answer says you can keep your existing domain with both platforms without buying another domain. With split delivery, the MX record must use Google, and each user has an address in Gmail or in the other system.
Yes. Messages are counted twice in most reporting tools, including Threat Explorer, Advanced Hunting and automated investigation and response. Remove the double count before you compare numbers across the two platforms.
Google recommends Gmail as the primary server for dual delivery, and says a legacy server might be primary during a pilot or migration to Gmail. The primary server is the one the MX records name.
Microsoft says integration through the Microsoft Graph API typically requires granting the service full access to mailboxes. Review that grant in Microsoft 365, and review the Google Workspace API connection on its own.
