Microsoft 365 is the most widely deployed business productivity platform in India. It is also the #1 target for email-based attacks — phishing, Business Email Compromise, ransomware, and credential theft. The good news is that Microsoft 365 includes meaningful email protection. The bad news is that most Indian businesses are not using it properly — and even when fully configured, it has gaps that dedicated email security platforms are designed to fill.
This guide explains exactly what Microsoft 365's built-in email security covers, what it misses, and which third-party platforms are worth adding based on your subscription tier and threat profile.
What Email Security is Built into Microsoft 365?
Every Microsoft 365 subscription includes some level of email protection. What you get depends on your plan.
Exchange Online Protection (EOP) — Included in All M365 Plans
EOP is Microsoft's baseline email security layer, included in every Microsoft 365 subscription from Business Basic upward. EOP handles:
- Anti-spam filtering — reputation-based filtering using Microsoft's threat intelligence
- Anti-malware — signature-based malware scanning on attachments using the Microsoft Defender anti-malware engine
- Connection filtering — blocks emails from known bad IP addresses
- Outbound spam filtering — protects your domain's sending reputation
- Anti-spoofing (basic) — honours SPF and DKIM authentication
- Safe domain blocklist — bulk email filtering
What EOP does not include:
- AI-powered BEC detection or impersonation protection
- Attachment sandboxing (zero-day malware analysis)
- Time-of-click URL rewriting
- Advanced phishing protection
EOP is the email hygiene layer — it handles the bulk of commodity threats. It is not designed for targeted attacks.
Microsoft Defender for Office 365 Plan 1 — Included in Microsoft 365 Business Premium
If you are on Microsoft 365 Business Premium (₹1,500/user/month approximately), you have Defender for Office 365 Plan 1 included in your licence. Most Indian businesses on Business Premium have not activated or properly configured it.
Plan 1 adds:
- Safe Links — all URLs in emails and Office documents are rewritten; re-checked at click time if they become malicious after delivery
- Safe Attachments — attachments are detonated in a sandbox before delivery; stops zero-day malware in PDF, Office, and ZIP files
- Anti-phishing policies — impersonation protection for your domain and specific users; spoof intelligence; mailbox intelligence
- Real-time detections — basic threat hunting and detection view in the security portal
Important: Plan 1 capabilities are only effective when anti-phishing policies are configured. Default configuration provides limited protection. Cloudfy configures these policies as part of every Microsoft 365 Business Premium deployment.
Microsoft Defender for Office 365 Plan 2 — Enterprise Plans
Plan 2 is included in Microsoft 365 E3 and E5. It adds:
- Threat Explorer — real-time investigation of emails and threats
- Campaign views — see coordinated phishing campaigns targeting your organisation
- Attack Simulation Training — built-in phishing simulation and security awareness training
- Automated investigation and response (AIR) — automatically investigates and remediates threats
- Advanced hunting — Kusto query language (KQL) for proactive threat hunting
The Gaps: What Microsoft 365 Email Security Misses
Even with Defender for Office 365 Plan 1 fully configured, there are scenarios where dedicated third-party email security adds meaningful protection:
1. BEC Detection Depth
Microsoft's impersonation protection in Plan 1 is policy-based — you configure specific users and domains to protect. If an attacker uses a domain variant you haven't configured (or targets a user not in your protection policy), the email gets through.
Dedicated platforms like Sophos Email and Mimecast use AI models trained on billions of emails, detecting BEC patterns across all users without requiring explicit policy configuration.
2. Email Continuity
If your Microsoft 365 tenant goes down — during a Microsoft outage, during a ransomware incident that forces a tenant suspension, or during a forced reset — your email stops entirely. Microsoft does not provide a continuity inbox that operates independently of your tenant.
Mimecast's email continuity service maintains a live, independent copy of your mailbox. If your M365 goes down, users switch to the Mimecast portal and continue sending and receiving — the outage is invisible to your customers.
3. 99-Year Compliance Archiving
Microsoft 365 includes archiving (with Exchange Online Archiving licences), but it is tied to your M365 tenant and subscription. If you stop paying for M365 or your tenant is compromised, your archive is at risk.
Mimecast's email archiving is a separate, tamper-proof system with 99-year retention, eDiscovery, and legal hold — independent of your M365 subscription. Critical for SEBI, RBI, IT Act 2000, and similar compliance requirements.
4. Outbound DLP
EOP includes basic outbound spam filtering. Defender for Office 365 does not include strong outbound DLP (Data Loss Prevention).
If you need to prevent sensitive data — PAN numbers, client contracts, financial data — from being emailed out of your organisation, you need Microsoft Purview DLP (an additional licence) or a third-party gateway with outbound DLP (Sophos Email Advanced, Mimecast).
5. DMARC Reporting and Analysis
DMARC enforcement is important for preventing domain spoofing. Microsoft 365 supports DMARC, but it does not include a DMARC reporting and analysis tool. Understanding what sources are sending email from your domain, and moving safely from p=none to p=reject, requires a reporting tool.
Mimecast DMARC Analyser (included with most Mimecast plans) provides a visual dashboard of all email sources, helps you identify misconfigurations, and guides you safely to p=reject enforcement.
Third-Party Email Security Platforms for Microsoft 365 India
Here are the four most relevant third-party platforms for Microsoft 365 users in India:
Mimecast — Best for Continuity + Archiving + Compliance
Why it fits M365: Mimecast's three-pillar platform (threat protection + continuity + archiving) addresses the three biggest gaps in Microsoft's email security stack. MX gateway deployment or API connector for M365.
Key additions over M365 built-in:
- Email continuity — independent of your M365 tenant
- 99-year archiving — separate from your M365 subscription
- DMARC Analyser — included
- Superior AI impersonation detection at the gateway layer
Best for: Businesses on Microsoft 365 Business Standard or above that need regulatory compliance, email continuity, and better BEC protection.
→ View Mimecast Email Security
Barracuda Email Protection — Best for Quick M365 Deployment
Why it fits M365: Barracuda's API-native deployment uses Microsoft Graph API to connect directly to your M365 tenant — no MX record change required. You're fully deployed in under 2 hours.
Key additions over M365 built-in:
- AI BEC detection across all users (not just configured protection policies)
- Lateral phishing detection — catches attacks from compromised internal M365 accounts
- Incident response automation — remove malicious emails from all inboxes with one click
- Security awareness training — phishing simulation built in
- DMARC monitoring and enforcement tools
Best for: Businesses that want to enhance M365 email security quickly without touching DNS or MX records.
→ View Barracuda Email Protection
Sophos Email Security — Best for GWS + M365 Mixed Environments
Why it fits M365: Sophos Email is an MX gateway that deploys in front of Exchange Online. If your business uses both Microsoft 365 and Google Workspace (common for Indian companies during migrations or for specific teams), Sophos Email handles both in a single gateway — managed from Sophos Central.
Key additions over M365 built-in:
- Sophos Sandstorm sandboxing — more aggressive zero-day detonation
- Time-of-click URL rewriting across all email clients, not just Outlook
- Outbound DLP — included in Advanced edition without additional Microsoft licences
- Integration with Sophos Firewall and Sophos Endpoint via Sophos Central
Best for: Businesses using Sophos Firewall or Sophos Endpoint who want a unified Sophos security stack; businesses with mixed M365 + GWS environments.
Proofpoint Email Security — Best for Enterprise M365
Why it fits M365: Proofpoint is the enterprise standard for large Microsoft 365 deployments. Its Targeted Attack Protection and Very Attacked People (VAP) analysis complement Defender for Office 365 at the enterprise scale.
Key additions over M365 built-in:
- TAP (Targeted Attack Protection) — catches APT-level attacks that Microsoft's AI misses
- VAP analysis — identifies your most targeted employees and applies heightened protection
- Email Fraud Defence — superior domain spoofing and BEC protection
- Advanced archiving with eDiscovery for enterprise legal teams
- Security Awareness Training — the gold standard for enterprise phishing simulation
Best for: Enterprises on Microsoft 365 E3/E5 with 500+ users and complex threat profiles.
→ View Proofpoint Email Security
M365 Email Security Configuration Checklist
If you are on Microsoft 365 Business Premium and have not yet configured Defender for Office 365 Plan 1, run through this checklist before evaluating additional purchases:
SPF:
- Published SPF TXT record for your domain:
v=spf1 include:spf.protection.outlook.com ~all - No duplicate SPF records (only one TXT SPF record allowed per domain)
DKIM:
- DKIM enabled in Microsoft 365 Security admin center
- CNAME records published in DNS
- DKIM signing verified (send test email to Gmail, check Authentication-Results header)
DMARC:
- DMARC TXT record published at
_dmarc.yourdomain.com - Currently at p=none monitoring mode with rua= reporting address
- DMARC reporting tool configured to receive and parse reports
Defender for Office 365 Plan 1 (Business Premium):
- Anti-phishing policy configured: impersonation protection for CEO, CFO, finance team enabled
- Spoof intelligence enabled and reviewed
- Safe Links policy applied to all users
- Safe Attachments policy applied to all users (not just "monitor" mode)
- Anti-phishing mailbox intelligence enabled
Additional policies:
- Multi-Factor Authentication (MFA) enforced for all users via Conditional Access
- Legacy authentication protocols (SMTP AUTH, IMAP, POP) blocked for users who don't need them
- External email warning banner enabled (flags emails from outside your organisation)
Cloudfy provides M365 security configuration as part of every Microsoft 365 deployment and renewal engagement.
Choosing the Right Combination
Microsoft 365 Business Basic / Standard (no Defender Plan 1): Add a third-party gateway. Options: Sophos Email Advanced, Mimecast Core, or Barracuda Email Protection. These add BEC detection and sandboxing that EOP alone cannot provide.
Microsoft 365 Business Premium (Defender Plan 1 included, not configured): Step 1: Let Cloudfy configure Defender Plan 1 properly (Safe Links, Safe Attachments, anti-phishing policies, MFA). Step 2: Evaluate whether you additionally need continuity (Mimecast) or quick API-native enhancement (Barracuda).
Microsoft 365 Business Premium (Defender Plan 1 configured) + compliance requirement: Add Mimecast Email Security + Continuity or Advanced + Archiving. You get email continuity, 99-year archiving, DMARC Analyser, and layered BEC protection.
Microsoft 365 E3/E5 enterprise: Defender for Office 365 Plan 2 is included — configure it fully before purchasing additional platforms. Add Proofpoint if you need VAP analysis, enterprise-grade TAP, or advanced archiving separate from Microsoft's ecosystem.
FAQs
Does Microsoft 365 include email security?
Yes — Exchange Online Protection (EOP) is included in all plans. Defender for Office 365 Plan 1 is included in Business Premium. Plan 2 in Enterprise E3/E5. But "included" does not mean "configured" — most Indian businesses have not properly activated or tuned their included protection.
Do I need a third-party email security tool if I have Microsoft 365 Business Premium?
It depends. If Defender for Office 365 Plan 1 is properly configured with anti-phishing policies, Safe Links and Safe Attachments active, and MFA enforced, it covers a substantial range of threats. You still have gaps in email continuity, 99-year archiving, and advanced BEC detection — Mimecast or Barracuda address those specifically.
Can I use Mimecast and Microsoft Defender at the same time?
Yes — and this is a common configuration for enterprise M365 customers. Mimecast acts as the MX gateway (first scan), then delivers to Exchange Online where Defender Plan 1/2 applies additional scanning. Two independent scanning layers catch different threats. Cloudfy configures both to work together without creating delivery loops.
How much does third-party email security cost for M365?
Pricing is per-user per year and varies by platform and tier. As a rough guide: Barracuda and Sophos Email are mid-range; Mimecast is mid-to-upper range; Proofpoint is enterprise-priced. Contact Cloudfy for a same-day INR quote for any platform.
As a Microsoft authorised partner and email security specialist in India, Cloudfy handles the full Microsoft 365 email security stack — from Defender configuration to Mimecast, Barracuda or Proofpoint deployment. Contact us for a free email security assessment for your Microsoft 365 environment.