Email security for Microsoft 365

Prices are Microsoft list prices at the time of writing.

Impersonation protection in Defender works best once it is configured with the users and domains to protect. Without that tuning - and without Defender at all on Business Basic or Standard - targeted, low-volume mail still reaches inboxes:

• A supplier lookalike asking for an invoice to be paid to new details.
• A "from the CEO" request for a fast transfer, with no link or attachment.
• A login page on a domain registered this week, sent to one person.
• Mail from a real, compromised partner account.

The last one has its own post: vendor email compromise.

Zoes connects as an enterprise app through the Microsoft Graph API. It reads mail after Exchange Online Protection and Defender have run, so it does not conflict with either.

1. 1Sign in to Zoes with a Microsoft work account.
2. 2A Global Administrator approves the admin-consent screen once for the tenant.
3. 3Choose which users to protect from the synced directory.

Revoke access at any time by removing the Zoes enterprise app in the Entra admin center. For a side by side, see Zoes vs. Defender for Office 365.