· cyber security · 5 min read
Email Security Beyond the Microsoft 365 Spam Filter
Microsoft 365 blocks a lot of junk on its own, but targeted phishing still reaches inboxes. Here is what to layer on top, and how co-managed IT splits quarantine tuning and the daily "is this safe?" questions.
Microsoft 365 filters a lot of mail before your staff ever sees it. The filtering built into every mailbox stops known spam, known malware, and messages from senders with a bad reputation. That is a good baseline, and nobody should switch any of it off.
The mail that causes trouble is written for you. Picture an accounting firm in tax season. A message appears to come from a managing partner, or a client sends a “revised return” link that opens a fake login page created yesterday. Filters that lean on reputation have little to go on when the sender is new.
What the built-in filter does well
Reputation and signature checks are fast and cheap, and they handle bulk junk. If a message matches a known bad pattern, it never arrives.
Targeted mail is different. A short note from a “colleague” asking someone to review a shared document has no malware in it and may come from a real, hijacked account. There is nothing for a basic filter to flag.
Layers to add on top
Some come as add-on licenses from Microsoft. Others come from a third-party filter that sits beside Microsoft 365. Either way, here is what each layer does:
- Advanced filtering and sandboxing. Attachments and links are opened in an isolated environment before delivery, so a file that looks clean but misbehaves gets caught.
- Impersonation protection. The filter watches for display names and look-alike domains that copy your executives, your finance team, and your regular vendors.
- Link rewriting. Links are checked again when someone clicks, which covers pages that turn malicious hours after the message arrived.
- Banners on mail from outside. A short line at the top of any message that came from outside the organization. A “message from the CEO” with an external banner on it gets noticed.
- Post-delivery removal. When a message is later found to be malicious, the system pulls it out of every mailbox that received it.
None of these catches everything. Together they shrink the number of bad messages a person has to judge by eye. You can read more about how we set these up on our email security page.
Who tunes the quarantine in co-managed IT
A filter that holds mail needs someone to look at what it holds. Too tight, and a client contract or a supplier invoice sits in quarantine while the team waits. Too loose, and the extra layers do little.
In a co-managed IT arrangement, the split usually looks like this:
- Your internal IT team knows which customers, banks, payroll providers, and suppliers send mail the business depends on. They approve allow-list requests and tell the MSP when a new vendor is about to start sending.
- The MSP runs the filter policies, reviews quarantine on a set schedule, tunes the rules after a miss, and documents each change.
Allow-listing a sender skips filtering for that sender, so each entry needs a named approver and a written reason. Decide up front who may release a message from quarantine. Without that decision, the answer is whoever is in a hurry.
Who answers “is this safe?”
Staff will forward suspicious messages. Some of them will forward the fake ones that already got through, and that is a good sign. It means people are looking.
Pick one place for those reports, either a shared mailbox or a report button in Outlook. Then agree on who responds first.
Your in-house IT person usually should. They know the people, they know whether the company really expects an invoice from that vendor, and they can walk to the desk or send a quick chat message. The MSP backs them up with the technical work: reading message headers, checking where a link goes, and pulling the same message from every other mailbox.
Set a response time that staff can count on, even if it is “same business day.” People stop reporting when the answer takes a week. Tell staff to report a message even if they already clicked. A report in the first few minutes gives you far more room to act than one that shows up after the weekend.
Questions to ask this week
Your IT manager can probably answer these in an afternoon:
- Does our filtering scan attachments and links beyond the Microsoft 365 defaults?
- Do messages from outside the organization carry a banner?
- Who reviews quarantine, and how often?
- Who approved each entry on the allow list, and why?
- Can we remove a delivered message from every mailbox? Has anyone tested it?
- Where do staff send “is this safe?” questions, and who answers?
Write the answers down. Customer security questionnaires, cyber insurance applications, and frameworks such as SOC 2 all tend to ask how email is protected, and written answers save time.
How we help
Kayak Cyber works alongside your in-house IT manager. We run email security layered on Microsoft 365, including the quarantine review. When a phish does get through and someone types in a password, we look for the odd sign-in that follows and can cut off that account before it is used to email your clients. Your IT person keeps authority over changes and the knowledge of your vendors and staff. Our co-managed IT page explains the model.
Call us at 405-253-5101 or schedule a discovery call to get on the calendar.