What’s changing?
We are adding a screen to the onboarding workflow of new tenants. On that screen, you will be able to choose between three email security modes:
-
MX is the previous default mode when onboarding a new tenant. In this mode, we analyze and filter emails only before their reception
-
API is a new mode that does not require changing the tenant’s MX records. In this mode, we analyze emails only after reception thanks to journaling rules set on the M365 tenants and Microsoft’s Graph API
-
Hybrid is the best of the MX and API modes. In the mode, we analyze and filter emails both before and after reception. The technical difference between MX and Hybrid modes is the Ex-Post Deletion feature, that gives us the ability to rescan inboxes in M365.
Hybrid is the recommended mode thanks to its superior protection.
Limitations of MX and API modes
-
A tenant in MX mode does not benefit from Ex-Post Deletion
-
A tenant in API mode cannot benefit from the following products
-
Email Encryption
-
Email Signature & Disclaimer
-
Email Archiving
-
Email Continuity
-
Visibility of the email security modes
It is possible that some customers or partners do not see all three security modes due to specific sales or distribution agreements. If you believe this is a mistake, please reach out to your sales representative.
Microsoft permissions requested for each mode
MX
-
Sign in and read user profile
-
Read directory data
API
-
Sign in and read user profile
-
Read basic mail in all mailboxes
-
Read and write all directory RBAC settings
-
Read all users' full profiles
-
Read and write all applications
-
Read and write mail in all mailboxes
-
Read directory data
-
Manage app permission grants and app role assignments
Hybrid
-
Sign in and read user profile
-
Read directory data
-
Read basic mail in all mailboxes
-
Read all users' full profiles
-
Read and write mail in all mailboxes
-
Read and write all directory RBAC settings