AegisAI Perspectives · 088
A small school district with one or two IT staff can run email security with the built-in Google Workspace or Microsoft 365 settings and a weekly routine.
A small school district with one or two IT staff can run email security by switching on the built-in Google Workspace or Microsoft 365 controls and keeping one weekly review. That is the staffing in 66% of districts1. AegisAI reads mail through the Microsoft 365 or Google Workspace API after delivery, with no change to mail routing22. 51% of schools and districts had a cyber incident in the past 12 months, and the K-12 email security guide lists which threats to stop first.
Put staff and students in separate groups, then give each group its own protection level. In Google Workspace, all the Gmail security settings can be tailored for different users and teams using organizational units17. In Microsoft 365, assign each group to the Standard or Strict preset on the Preset security policies page.
Spam goes to the Junk Email folder for Standard protection users and into quarantine for Strict protection users15. Put the smaller staff group on Strict and students on Standard, so the quarantine you review holds staff mail, where requests to change payroll or bank details arrive. Some companies received phishing emails before requests to change direct deposit accounts26.
If you have not picked a product yet, use the criteria for choosing district email security for staff and student accounts before this routine.
They stop known attacks sent in volume. Microsoft says the built-in security features for all cloud mailboxes prevent broad, volume-based, known email attacks11. Gmail displays warnings by default and moves untrustworthy emails to the spam folder16.
Standard protection and Strict protection are likely turned off on your first visit to the Microsoft Preset security policies page14. The Built-in protection preset applies to all users in organizations with any number of Defender for Office 365 licenses13. Defender for Office 365 Plan 2 is included in some subscriptions, for example Microsoft 365 A512.
Turn on multifactor authentication for every staff account first, since it is the first goal in CISA's K-12 key finding 127. Google's education checklist tells Workspace admins to set up email authentication and customize spam filter settings18. It then says to turn on advanced phishing and malware protection plus MTA-STS, then enable pre-delivery message scanning. Configure SPF and DKIM first, then a DMARC record for your domain19.
Turn on advanced phishing and malware protection for both organizational units, since each unit holds its own settings.
Run these 7 steps on one day each week, in this order.
Move new hires into the staff organizational unit or the Strict preset group, and new students into the student unit.
Open quarantine for the Strict group and release or delete each held staff message.
Check that Standard and Strict are still turned on in Preset security policies, since both start off.
Call back every request to change bank or payroll details on a number already on file. The FBI's IC3 says to use secondary channels or two-factor authentication to verify requests for changes in account information21.
Suspend and reset any staff account that sent phishing, then search for the copies it sent inside the district.
Share incident details with CISA and the FBI, as CISA's key finding 3 asks. If money moved, file a complaint at www.ic3.gov regardless of the amount20.
Write the week's counts in a shared sheet: held messages, callbacks made, accounts reset.
Weekly checks catch accounts and messages; monthly checks catch settings that changed. None of the sources gives a time for these tasks, so time each one yourself in the first month.
| Task | How often | Where it lives | What it catches |
|---|---|---|---|
| Group assignment | Weekly | Google Admin console organizational units, Microsoft Preset security policies | New accounts on the wrong protection level |
| Quarantine review | Weekly | Quarantine for Strict protection users | Staff spam and phishing held for an admin |
| Bank change callback | Every request | Phone number on file | Payroll diversion through a changed account |
| Fraud complaint | Same day | www.ic3.gov or BEC.IC3.gov | Payroll or bank diversion of any amount |
| Authentication check | Monthly | Gmail settings health page | Missing SPF, DKIM or DMARC records |
| Checklist rerun | Monthly | Google Admin console Gmail settings | MTA-STS or pre-delivery scanning turned off |
| Preset check | Monthly | Microsoft Preset security policies page | Standard or Strict protection turned off |
Illustrative example, figures are fictional. Birch Creek Unified (fictional) has 2,400 students and 290 staff on Google Workspace for Education, with one IT director and one technician. Staff sit in one organizational unit and students in another. Every Monday the technician moves 4 new staff accounts into the staff unit. On Wednesday the payroll clerk gets an email from a teacher's real account asking to switch direct deposit to a new bank. The clerk calls the teacher on the number on file; the teacher never sent it. The IT director suspends the account and resets the password. A search finds 37 copies of a fake sign-in email sent to other staff, and the technician removes them. In the monthly check, the Gmail settings health page shows no DMARC record on the district's second domain, and the director adds one.
Free help now comes from CISA and your state, since MS-ISAC charges. As of June 23, 2025, MS-ISAC introduced a fee-based membership, and references to no-cost MS-ISAC services no longer apply3.
CISA's goals for districts short of resources start with partnering with state organizations and seeking cybersecurity grants8. The same list adds free or low-cost tools and services. Its key finding 3 tells districts to share information with CISA and the FBI. Call your state education agency before you buy.
Check the federal Cybersecurity Pilot Program first, then your license. The three-year Schools and Libraries Cybersecurity Pilot Program provides up to $200 million in universal service support to eligible schools and libraries10. Confirm with USAC that the email service you want is eligible before you put it in a budget.
Microsoft 365 A5 includes Defender for Office 365 Plan 2, so check which licenses the district holds before you buy that layer.
AegisAI reads mail through the Microsoft 365 or Google Workspace API after delivery, with no change to mail routing (MX records), as the inbound email security page describes. It runs in monitoring mode first, and removal needs write access your admin grants and can revoke. One bad email is pulled from every inbox it reached, forwards included. Every verdict comes with its reason in plain language, so your team can check it and share it.
You can test removal after delivery on your own tenant through the demo page.
Turn on the built-in Google Workspace or Microsoft 365 protection and split staff and student mailboxes into separate groups, then keep a weekly routine. 66% of districts run cybersecurity with one or two people. Automate email authentication and pre-delivery scanning, and review only what the Strict group holds.
No, staff go on Strict, where spam is quarantined, and students on Standard, where spam goes to the Junk Email folder. In Google Workspace, set each organizational unit separately.
No, MS-ISAC introduced a fee-based membership as of June 23, 2025. Share incident information with CISA and the FBI instead, and file fraud complaints at www.ic3.gov.
The pilot provides up to $200 million over three years to eligible schools and libraries. Confirm with USAC that a specific email service is eligible before you budget for it.
Suspend the account and reset the password, then remove the copies it sent. Call back any bank or payroll change it requested, on a number already on file. If money moved, file a complaint at www.ic3.gov regardless of the amount.
