Best tools · Microsoft 365Victor TräffWritten by Victor Träff · Security expert and co-founder, Sentaro Reviewed

11 best email security tools for Microsoft 365 (2026)

The best email security for Microsoft 365 for EU teams in 2026 is Sentaro, an API layer that runs alongside Microsoft Defender for Office 365, connects in four minutes with no MX change and costs a published $6 per protected account per month. The other strong options are Defender for Office 365 itself (the native baseline every tenant already has), Material Security, Check Point Harmony Email & Collaboration and Abnormal AI. We ranked 11 tools on what they add to Defender, using public documentation checked on 21 October 2026.

  • 11 tools ranked
  • Defender as the baseline
  • Weighted, sourced method
  • Last verified 21 October 2026
Start free with one accountSpeak to sales
Our recommendation

Sentaro is the best email security for Microsoft 365 for EU organizations that already run Defender for Office 365 and want the targeted attacks covered: it connects over the Microsoft 365 admin APIs in four minutes with no MX change, runs alongside Defender instead of replacing it, catches payload-free BEC and vendor fraud with reasoning you can audit, and costs a published $6 per protected account per month with every feature included. Sentaro publishes this list and ranks itself first; scores use the method below and public vendor documentation as of 21 October 2026.

Why Sentaro wins
it adds what Microsoft documents in other products or not at all: vendor-compromise and thread-hijack detection, an OAuth grant and AI-tool inventory with one-click revocation, and Google Workspace coverage, at a price you can read on sentaro.com/en/pricing before any sales call.
Keep Defender either way
built-in protection (formerly EOP) is on in every cloud mailbox, and Plan 1 is now rolling out to Microsoft 365 and Office 365 E3. Sentaro is designed to run with it.
Consider Plan 2 or a suite only if
you have a SOC that will use Threat Explorer and automated investigation, or you need archiving, encryption, backup and DMARC management from one vendor.

Quick picks

  • Best overall for EU teamsSentaro Our pickAPI layer next to Defender, live in four minutes, $6 per account per month, hosted in Sweden.
  • Best native baselineMicrosoft Defender for Office 365Already in Business Premium and, from 2026, E3; Plan 2 adds investigation and simulation.
  • Best published price after SentaroMaterial SecurityLists $4 and $6 per user per month plans, with post-compromise controls.
  • Best for collaboration appsCheck Point Harmony Email & CollaborationInline prevention via API plus Teams, SharePoint, OneDrive and Slack.
  • Best for large enterprisesAbnormal AIBehavioral baselines per employee and vendor, account takeover and a long certification list.
  • Best all-in-one suiteHornetsecurity 365 Total ProtectionFiltering, encryption, archiving, backup, training and DMARC in four tiered plans.

At a glance

What we compared
Email security you add to, or run instead of, the protection built into Microsoft 365, plus Defender for Office 365 itself as the baseline
Tools ranked
11: Sentaro, Defender for Office 365, Material, Check Point, Abnormal, IRONSCALES, Barracuda, Sublime, Mimecast, Proofpoint, Hornetsecurity
Audience
EU organizations on Microsoft 365 with lean IT, often regulated (NIS2, DORA), 20 to 2,000 mailboxes
Method
Seven weighted criteria, each tool scored 0–10 from its public documentation; unknown counts as not documented
Last verified
21 October 2026 (Microsoft and vendor pages accessed 18 October 2026)
Written by
Sentaro, which makes one of the tools ranked here

Email security for Microsoft 365 compared

One row per tool, in rank order. Setup times are each vendor’s own words. “Quote” means no public price.

CapabilityScoreDeploymentSetup (vendor-stated)Public priceEU hostingBest for
Sentaro (our pick)[1]8.7API, alongside Defender; no MX changeFour minutes$6 per account/month; first account freeHosted in Sweden on Microsoft Azure; DPA publicEU teams on Microsoft 365 and Google Workspace
Defender for Office 365[5]8.2Native to Exchange OnlineOn by defaultPlan 1 $2, Plan 2 $5 per user/monthEU Data BoundaryEvery tenant, as the baseline
Material Security[24]7.4APIAbout six minutes (customer quote)From $4 per user/month plus a Shared Drive feeNo EU region documentedPost-compromise containment
Abnormal AI[9]7.4API, no MX change60 secondsQuoteUS or EU (Ireland), by subscriptionLarge enterprises
Check Point Harmony Email[11]7.3API with inline preventionMinutesQuote (four tiers)Ireland region optionEmail plus many SaaS apps
IRONSCALES[16]7.1API at mailbox levelMinutesQuote (tiers published)AWS USA and Germany (subprocessor list)SMBs and MSPs wanting simulation bundled
Barracuda[22]6.7API-first, no MX changeMinutesQuote (three plans)Gateway: Frankfurt, London; API modules: USOne contract incl. backup and archive
Sublime Security[18]6.5API; managed or self-hostedNot statedFirst 100 mailboxes free; Enterprise quoteEU (Dublin) managed region, or self-hostSOC teams that write detection rules
Mimecast[15]6.4Gateway (MX) or APIUnder five minutes (API, 2022)QuoteFrankfurt data centres (2018)Archive, continuity, hybrid Exchange
Proofpoint[14]6.4API (Graph) or inline gateway48 hours (API)QuoteEU or US data centre (API); some US processingEnterprises wanting the full add-on range
Hornetsecurity[20]5.8MX, API or hybridNot statedQuote via partners12 regional data centres (vendor)All-in-one Microsoft 365 suite via MSPs

Editorial scores using the criteria and weights below; based on public documentation, not lab tests. Last verified 21 October 2026.

  • Yes
  • Partial
  • No
  • On roadmap
  • Paid add-on
  • Not publicly documented
Try it on your own tenant. API connection in about four minutes, alongside what you run today. $6 per account / month.Start freeSpeak to sales →

How we evaluated email security for Microsoft 365

The buyer here already has Microsoft’s protection in the tenant. So the method asks what each tool adds to Defender for a lean EU IT team, and what it costs to get there. Breadth and maturity count too, at a lower weight, because that is where the large suites lead.

CriterionWeightWhy it matters
Fit with Microsoft 365 and Defender20%Does it sit alongside Defender without moving MX, re-routing mail or a second quarantine to run? Native counts as a full fit.
Payload-free BEC and vendor fraud20%Fraud with no link or attachment (bank-detail changes, CEO requests, hijacked supplier threads) is what reaches inboxes after Defender. Microsoft documents impersonation protection; we looked for more.
Time to protection15%Vendor-stated time from signup to protection, and whether history is scanned. Lean teams cannot run a multi-week project.
Published price and total cost15%A published per-user price lets a small team budget without a sales cycle. Quote-only pricing scores low; included-in-licence scores high.
OAuth apps and shadow AI10%Consent phishing and risky OAuth grants enter through email. Microsoft places app governance in Defender for Cloud Apps, a separate product.
EU hosting and DPA transparency10%Where mail data is processed, and whether the DPA and subprocessor list are public. Matters for GDPR, NIS2 and DORA due diligence.
Suite breadth and maturity10%Archiving, encryption, backup, DMARC, training, SOC tooling and published certifications. The incumbents win this one.

Editorial scores using the criteria and weights above; based on public documentation, not lab tests. Not documented scores 4–5. Sentaro’s roadmap features (Identity, Behavioral, Q4 2026) score as not available.

The 11 best email security tools for Microsoft 365, ranked

Defender is ranked as the baseline you keep; every other entry is scored on what it adds on top of it, highest first.

  1. Sentaro

    Our pickOverall score: 8.7out of 10

    Best for: EU teams on Microsoft 365 (and Google Workspace) that keep Defender and want BEC, vendor fraud and OAuth risk covered without a gateway project.

    Sentaro is an API-based email and SaaS security platform built in Stockholm and hosted in Sweden on Microsoft Azure. An admin connects the tenant through the Microsoft 365 admin APIs in four minutes, with no agents and no MX change; historical visibility follows within 15 minutes. Microsoft Defender and Google’s built-in protection are, in Sentaro’s words, a good baseline for bulk attacks, and Sentaro is designed to run with them. Its Message vector scores intent, sender identity and relationship history on inbound and internal mail before interaction, including vendor-compromise and thread-hijack detection. Its App vector inventories every app, AI tool and OAuth grant in the tenant and revokes risky grants in one click.[1]

    Fit with Microsoft 365 and Defender
    10.0
    Payload-free BEC and vendor fraud
    8.0
    Time to protection
    10.0
    Published price and total cost
    10.0
    OAuth apps and shadow AI
    9.0
    EU hosting and DPA transparency
    8.0
    Suite breadth and maturity
    4.0

    Pros

    • Runs next to Defender: no MX change, no agents, connected in four minutes.
    • Vendor-compromise, thread-hijack and payload-free BEC detection on inbound and internal mail, with reasoning shown on every verdict in the console.
    • OAuth grants, AI tools and consent phishing covered in the same platform, which Microsoft sells separately as Defender for Cloud Apps.
    • Published price, every feature included; the same product covers Google Workspace.

    Cons

    • Detection only: no gateway, archiving, encryption, backup or DMARC report management.
    • Account-takeover and session-anomaly detection (Behavioral vector) reach general availability in Q4 2026.
    • SOC 2 and ISO 27001 certification in progress; younger vendor with a short public track record.
    Pricing
    $6 per protected account per month or $68 per year; first account free. Prices in USD.
    Deployment
    API via the Microsoft 365 and Google Workspace admin SDKs; no MX change, no agents
    Platforms
    Microsoft 365, Google Workspace; Slack and Teams listed as channels
    Hosting
    Hosted in Sweden on Microsoft Azure; subprocessors listed in the DPA
    Microsoft 365

  2. Microsoft Defender for Office 365

    Native baselineOverall score: 8.2out of 10

    Best for: Every Microsoft 365 tenant, as the layer you keep; Plan 2 for teams with a SOC.

    Microsoft documents three tiers. Built-in protection (formerly Exchange Online Protection) is in every cloud mailbox: anti-malware, anti-spam, spoof intelligence, quarantine and zero-hour auto purge. Plan 1 adds user and domain impersonation protection, mailbox intelligence, Safe Attachments and Safe Links, including QR-code attacks per Microsoft’s June 2026 blog, and protection in Teams. Plan 2 adds Threat Explorer, campaigns, automated investigation and response and attack simulation training. Plan 1 is included in Business Premium and is rolling out to Microsoft 365 and Office 365 E3 from 17 June 2026.[3]

    Fit with Microsoft 365 and Defender
    10.0
    Payload-free BEC and vendor fraud
    6.0
    Time to protection
    9.0
    Published price and total cost
    10.0
    OAuth apps and shadow AI
    3.0
    EU hosting and DPA transparency
    9.0
    Suite breadth and maturity
    9.0

    Pros

    • Already licensed in Business Premium, E3 (from 2026) and E5; no connector to install.
    • Covers Teams, SharePoint and OneDrive as well as mail.
    • Plan 2 brings Threat Explorer, automated investigation and response, and attack simulation training.
    • Published SLAs on built-in protection, including 99.999% monthly uptime.

    Cons

    • Microsoft names impersonation protection; we found no dedicated vendor-compromise or thread-hijack feature.
    • OAuth app governance, identity risk, archiving and backup are separate Microsoft products.
    • Microsoft 365 only; no Google Workspace coverage.
    Pricing
    Plan 1 $2, Plan 2 $5 per user/month, paid yearly; Plan 1 in Business Premium ($22) and E3; Plan 2 in E5 ($60)
    Deployment
    Native to Exchange Online, in the mail flow
    Platforms
    Microsoft 365 (mail, Teams, SharePoint, OneDrive)
    Hosting
    EU Data Boundary for tenants signed up in the EU/EFTA (Multi-Geo excluded)
    Sentaro vs Microsoft Defender for Office 365 Vendor site

  3. Material Security

    Overall score: 7.4out of 10

    Best for: Teams that want a published per-user price and controls that limit damage after an account is compromised.

    Material Security connects to Microsoft 365 and Google Workspace over API. It positions itself on protecting accounts even after a compromise or after a malicious message gets through, for example with message-level controls on sensitive content and password-reset emails. A customer quoted on its home page says integration took about six minutes. Pricing is public: Essentials $4 and Advanced $6 per user per month plus a Shared Drive fee, billed annually, with ATO Resilience as a $3 add-on.[24]

    Fit with Microsoft 365 and Defender
    9.0
    Payload-free BEC and vendor fraud
    7.0
    Time to protection
    8.0
    Published price and total cost
    9.0
    OAuth apps and shadow AI
    6.0
    EU hosting and DPA transparency
    4.0
    Suite breadth and maturity
    6.0

    Pros

    • Public per-user prices from $4 per month.
    • Post-compromise containment and ATO Resilience add-on.
    • Covers Microsoft 365 and Google Workspace.

    Cons

    • OAuth Security is documented for Google Workspace, not Microsoft 365.
    • No EU hosting region documented (subprocessor list: Google Cloud, U.S.A.); certifications not publicly documented.
    • A minimum annual Shared Drive fee applies.
    Pricing
    Essentials $4, Advanced $6 per user/month plus Shared Drive fee, billed annually; ATO Resilience +$3
    Deployment
    API (ICES)
    Platforms
    Microsoft 365, Google Workspace
    Hosting
    No EU region documented; subprocessor list names Google Cloud, U.S.A.
    Sentaro vs Material Security Vendor site

  4. Abnormal AI

    Overall score: 7.4out of 10

    Best for: Large enterprises that want behavioral detection plus account takeover and a long certification list.

    Abnormal AI (formerly Abnormal Security) deploys over API with no MX change; its product page says “Deploy in 60 seconds via API”. It describes behavioral AI that builds a baseline for every employee and vendor and flags deviations, reading authentication events and internal threads as well as mail. It sells Account Takeover Protection and AI Phishing Coach alongside inbound security, and its trust center lists ISO 27001, ISO 27701 and ISO 42001 certificates, a SOC 2 report and FedRAMP Moderate. Its public subprocessor list names AWS hosting in the US or the EU (Ireland), set by subscription. Prices are not published.[9]

    Fit with Microsoft 365 and Defender
    9.0
    Payload-free BEC and vendor fraud
    9.0
    Time to protection
    9.0
    Published price and total cost
    3.0
    OAuth apps and shadow AI
    4.0
    EU hosting and DPA transparency
    7.0
    Suite breadth and maturity
    9.0

    Pros

    • Behavioral baselines for employees and vendors.
    • Account Takeover Protection as a product.
    • Broad certification portfolio.

    Cons

    • No public pricing.
    • EU (Ireland) hosting is a subscription choice; the US is the other listed location.
    • Positioned for large enterprises.
    Pricing
    Quote-based
    Deployment
    API (ICES), no MX change
    Platforms
    Microsoft 365, Google Workspace
    Hosting
    AWS in the US or EU (Ireland), by subscription (subprocessor list)
    Sentaro vs Abnormal Security Vendor site

  5. Check Point Harmony Email & Collaboration

    Overall score: 7.3out of 10

    Best for: Organizations that want inline prevention through the API and the same product across Teams, SharePoint, OneDrive and Slack.

    Check Point Harmony Email & Collaboration (formerly Avanan) connects over API with no MX change and can enforce from monitor mode up to inline prevention, inspecting messages before they reach the inbox. Check Point describes 50+ AI engines, sandboxing, attachment sanitization and click-time URL protection. Account-takeover protection and shadow IT detection are in every tier; archiving, DMARC management and awareness training are add-ons. The admin guide lists an Ireland data-residency region.[11]

    Fit with Microsoft 365 and Defender
    9.0
    Payload-free BEC and vendor fraud
    7.0
    Time to protection
    9.0
    Published price and total cost
    3.0
    OAuth apps and shadow AI
    8.0
    EU hosting and DPA transparency
    7.0
    Suite breadth and maturity
    8.0

    Pros

    • Inline prevention via API, not only post-delivery removal.
    • Covers Teams, Slack, OneDrive, SharePoint, Google Drive, Box and Dropbox.
    • Account takeover and shadow IT detection in every tier.

    Cons

    • No public prices.
    • Archiving, DMARC and training cost extra.
    • Vendor-compromise detection not named on its pages.
    Pricing
    Quote-based; four tiers (Email Only or Email & Collaboration, Advanced or Complete)
    Deployment
    API with configurable inline prevention; no MX change
    Platforms
    Microsoft 365, Google Workspace and major collaboration apps
    Hosting
    Regions include Ireland (EMEA), per the admin guide
    Sentaro vs Check Point Harmony Email Vendor site

  6. IRONSCALES

    Overall score: 7.1out of 10

    Best for: SMBs and MSPs that want phishing simulation and email security from one vendor.

    IRONSCALES works at mailbox level over API, alongside an existing gateway, and says it “deploys in minutes, no MX changes”. Its adaptive AI builds behavioral baselines for every mailbox and adds intelligence crowdsourced from other customers’ reports. Plan tiers are published, but every plan is quote-only. Higher tiers add account takeover, encryption and DLP; Complete Protect adds human risk management and simulation.[16]

    Fit with Microsoft 365 and Defender
    9.0
    Payload-free BEC and vendor fraud
    8.0
    Time to protection
    9.0
    Published price and total cost
    4.0
    OAuth apps and shadow AI
    4.0
    EU hosting and DPA transparency
    6.0
    Suite breadth and maturity
    7.0

    Pros

    • Simulation and training bundled in Complete Protect.
    • Community threat intelligence.
    • Multi-tenant console for MSPs.

    Cons

    • Prices on quote only.
    • Subprocessor list names AWS in both the USA and Germany without saying who is hosted where.
    • Account takeover only in higher tiers.
    Pricing
    Quote-based; tiers published (Email Essentials to Complete Protect)
    Deployment
    API at mailbox level; alongside a gateway
    Platforms
    Microsoft 365, Google Workspace; Teams (deepfake protection)
    Hosting
    Subprocessor list names AWS in the USA and AWS Europe (Germany)
    Sentaro vs IRONSCALES Vendor site

  7. Barracuda Email Protection

    Overall score: 6.7out of 10

    Best for: SMBs that want security, Microsoft 365 backup and archiving under one contract.

    Barracuda describes its current Email Protection as API-first, without MX record changes, and “operational in minutes, not weeks”. Barracuda IQ is a multi-model AI analysing intent and identity anomalies, and “Bailey” explains detection decisions in plain language. Account takeover, DMARC reporting, encryption and DLP are listed in all three plans; backup starts at Premium and archiving and training at Premium Plus.[22]

    Fit with Microsoft 365 and Defender
    9.0
    Payload-free BEC and vendor fraud
    7.0
    Time to protection
    8.0
    Published price and total cost
    3.0
    OAuth apps and shadow AI
    4.0
    EU hosting and DPA transparency
    5.0
    Suite breadth and maturity
    9.0

    Pros

    • Backup, archiving and DMARC in the same plans.
    • Explainable verdicts (Bailey).
    • Account takeover in every plan.

    Cons

    • No public prices.
    • API modules (Impersonation Protection, Incident Response) are listed in US regions only.
    • OAuth app risk not documented.
    Pricing
    Quote-based; three plans (Advanced, Premium, Premium Plus)
    Deployment
    API-first, no MX change
    Platforms
    Microsoft 365, Google Workspace
    Hosting
    Trust center: Email Gateway Defense in Frankfurt and London regions; Impersonation Protection and Incident Response in US regions
    Sentaro vs Barracuda Vendor site

  8. Sublime Security

    Overall score: 6.5out of 10

    Best for: Security teams that want to read, write and test their own detection rules.

    Sublime connects to Microsoft 365 over API and runs as a managed cloud service or self-hosted in your own AWS or Azure account. Detection is written as code in its Message Query Language, with an open rule library on GitHub that includes BEC, QR-code and lookalike-domain rules, plus AI agents that triage user reports (ASA) and write and backtest rules (ADÉ). The managed cloud is free for the first 100 mailboxes; Enterprise is quote-based.[18]

    Fit with Microsoft 365 and Defender
    9.0
    Payload-free BEC and vendor fraud
    7.0
    Time to protection
    5.0
    Published price and total cost
    7.0
    OAuth apps and shadow AI
    4.0
    EU hosting and DPA transparency
    7.0
    Suite breadth and maturity
    5.0

    Pros

    • Transparent, open detection rules.
    • Free for the first 100 mailboxes.
    • Self-hosting for data control.

    Cons

    • Assumes staff who will work with rules.
    • Other subprocessor locations need checking in the DPA.
    • No suite extras.
    Pricing
    Managed cloud free for the first 100 mailboxes; Enterprise quote-based
    Deployment
    API; managed cloud or self-hosted
    Platforms
    Microsoft 365, Google Workspace, IMAP
    Hosting
    Managed-cloud regions include EU (Dublin) and UK (London); or self-host in your own AWS or Azure region
    Sentaro vs Sublime Security Vendor site

  9. Mimecast

    Overall score: 6.4out of 10

    Best for: Organizations that need archiving and continuity, or still run hybrid or on-premises Exchange.

    Mimecast offers two models: Cloud Gateway, an MX-based secure email gateway, and Cloud Integrated, an API product for Microsoft 365 that its 2022 launch release says typically deploys in under five minutes. It describes multiple AI/ML engines, social graphing, sandboxing and on-click URL protection, and names BEC and QR-code phishing. Email Archive, DMARC Analyzer and awareness training extend it; it supports on-premises and hybrid environments.[15]

    Fit with Microsoft 365 and Defender
    7.0
    Payload-free BEC and vendor fraud
    7.0
    Time to protection
    8.0
    Published price and total cost
    3.0
    OAuth apps and shadow AI
    4.0
    EU hosting and DPA transparency
    6.0
    Suite breadth and maturity
    9.0

    Pros

    • Gateway or API from one vendor.
    • Long archive and continuity heritage.
    • On-premises and hybrid Exchange support.

    Cons

    • No public prices.
    • Account takeover not documented.
    • Gateway mode means an MX project.
    Pricing
    Quote-based
    Deployment
    Cloud Gateway (MX) or Cloud Integrated (API)
    Platforms
    Microsoft 365, Google Workspace, on-premises and hybrid Exchange
    Hosting
    Frankfurt data centres announced in 2018; current footprint not re-confirmed
    Sentaro vs Mimecast Vendor site

  10. Proofpoint

    Overall score: 6.4out of 10

    Best for: Large enterprises that want the widest range of add-ons from one vendor.

    Proofpoint Core Email Protection deploys via API through Microsoft Graph without MX changes, or inline as a gateway; the product page says “Deploy via API in 48 hours”. Proofpoint describes multi-model behavioral AI tied to its Nexus threat intelligence and names BEC and supplier threats. DMARC (Email Fraud Defense), account takeover, DLP, archiving and awareness training (ZenGuide) are add-ons. Proofpoint has owned Hornetsecurity since December 2025.[14]

    Fit with Microsoft 365 and Defender
    7.0
    Payload-free BEC and vendor fraud
    8.0
    Time to protection
    6.0
    Published price and total cost
    3.0
    OAuth apps and shadow AI
    4.0
    EU hosting and DPA transparency
    6.0
    Suite breadth and maturity
    10.0

    Pros

    • Widest add-on range: DMARC, DLP, archiving, training, ATO.
    • API or inline deployment.
    • Large threat-intelligence base.

    Cons

    • Most capabilities are separate add-ons.
    • No public prices.
    • Some email data may be processed and stored in the US even for EU tenants (API privacy sheet).
    Pricing
    Quote-based
    Deployment
    API (Microsoft Graph) or inline gateway
    Platforms
    Microsoft 365, Google Workspace
    Hosting
    Core Email Protection API: EU or US data centre; some processing and storage in the US (privacy sheet, July 2026)
    Sentaro vs Proofpoint Vendor site

  11. Hornetsecurity 365 Total Protection

    Overall score: 5.8out of 10

    Best for: Microsoft 365 SMBs, usually buying through an MSP, that want one tiered licence for filtering, archiving, backup and training.

    Hornetsecurity, a Proofpoint company since December 2025, sells 365 Total Protection in four plans: filtering and encryption (Plan 1), AI-based advanced threat protection, continuity and archiving (Plan 2), Microsoft 365 backup (Plan 3), and awareness training, permission management and DMARC management (Plan 4). It runs in MX, API or hybrid mode and states it uses “12 regional data centers, independent of Microsoft’s infrastructure”.[20]

    Fit with Microsoft 365 and Defender
    7.0
    Payload-free BEC and vendor fraud
    5.0
    Time to protection
    5.0
    Published price and total cost
    3.0
    OAuth apps and shadow AI
    5.0
    EU hosting and DPA transparency
    8.0
    Suite breadth and maturity
    9.0

    Pros

    • Filtering, archiving, backup, training and DMARC in one tiered licence.
    • European data centres, independent of Microsoft (vendor).
    • Large MSP channel.

    Cons

    • BEC and account-takeover specifics not documented.
    • No public prices.
    • Google Workspace not on the 365 Total Protection page.
    Pricing
    Quote-based, sold through partners
    Deployment
    MX, API or hybrid
    Platforms
    Microsoft 365
    Hosting
    12 regional data centres, independent of Microsoft’s infrastructure (vendor)
    Sentaro vs Hornetsecurity Vendor site

How to choose email security for Microsoft 365

Is Microsoft Defender for Office 365 enough?

For bulk spam, known malware and spoofing, Defender’s built-in protection is a solid baseline, and Plan 1 adds impersonation protection, Safe Links and Safe Attachments. Microsoft now includes Plan 1 in Business Premium and is rolling it out to Microsoft 365 and Office 365 E3, so most tenants will have it by default. What it leaves to other products, or to an add-on, is the gap most buyers are asking about: fraud from a real supplier’s compromised mailbox inside an existing thread, OAuth grants and consent phishing, and coverage for any Google Workspace tenants in the group.

Add an API layer or replace with a gateway?

An API layer (Sentaro, Material, Check Point, Abnormal, IRONSCALES, Barracuda, Sublime) reads mail inside the tenant and runs alongside Defender, so nothing in mail routing changes and you can remove it without touching DNS. A gateway (Mimecast Cloud Gateway, Proofpoint inline, Hornetsecurity MX mode) sits in front of Microsoft 365 and needs an MX change; it is the route when you also need continuity, archiving or outbound controls from the same vendor.

What to check in a trial

  • Connect read-only first and compare what the tool flags in the last 30 days of mail against what Defender delivered.
  • Look for fraud with no link or attachment: changed bank details, invoice follow-ups from a real supplier, urgent CEO requests.
  • Count the alerts per week. A lean team needs automatic remediation and few decisions, not a second queue to triage.
  • Check whether one quarantine and one user-reporting flow remain, or whether users now see two.
  • Ask for the DPA and subprocessor list on day one, not at contract stage.

Questions to ask every vendor

  • What does it add over Defender Plan 1, and over Plan 2, on our own mail?
  • Does it scan internal mail and existing history, or only new inbound mail?
  • Which Microsoft Graph permissions does it request, and can we revoke them in one step?
  • Where is mail content processed and stored, and which subprocessors receive any of it?
  • What is the list price per mailbox, and what is in each tier?

Certification and compliance status

Sentaro’s own status, stated exactly.

SOC 2
In progressNo target date published. Evidence pack on request.
ISO 27001
In progressSentaro says it will announce it the day it is signed, and not before.
Google CASA
Verified API integration
DPA and subprocessor list
PublicHosted in Sweden on Microsoft Azure; subprocessors are listed in the DPA.[2]

Frequently asked questions

What is the best email security for Microsoft 365?

Sentaro, for EU organizations that already run Defender for Office 365. It connects through the Microsoft 365 admin APIs in four minutes with no MX change, adds vendor-compromise and payload-free BEC detection plus an OAuth and AI-tool inventory, and costs a published $6 per protected account per month. Keep Defender as the baseline; Sentaro is designed to run with it. Sentaro publishes this list.

Is Microsoft Defender for Office 365 good enough on its own?

For bulk spam, known malware and spoofing, yes: built-in protection is in every cloud mailbox and Plan 1 adds impersonation protection, Safe Links and Safe Attachments. Microsoft documents OAuth app governance, identity risk, archiving and backup as separate products, and we found no dedicated vendor-compromise feature. Teams facing supplier fraud or consent phishing usually add an API layer.

Does Microsoft 365 E3 include Defender for Office 365 now?

Microsoft announced on 17 June 2026 that Defender for Office 365 Plan 1 is rolling out to Microsoft 365 E3/G3 and Office 365 E3/G3. Microsoft’s licensing page says the features are complete by 1 August 2026; its Defender blog says by fall 2026. Plan 2 remains in E5, A5 and G5, or $5 per user per month standalone.

Do I need to change MX records to add email security to Microsoft 365?

Not with an API-based tool. Sentaro, Material, Check Point, Abnormal, IRONSCALES, Barracuda and Sublime connect over API and leave mail routing to Microsoft. Gateways such as Mimecast Cloud Gateway, Proofpoint inline and Hornetsecurity MX mode sit in front of Microsoft 365 and need an MX change.

What is the cheapest add-on email security for Microsoft 365?

Among tools with public prices, Defender Plan 1 is $2 per user per month and Plan 2 $5. Material lists $4 and $6 per user per month plus a Shared Drive fee. Sentaro is $6 per protected account per month or $68 per year, with the first account free. Sublime’s managed cloud is free for the first 100 mailboxes. Prices checked 18–21 October 2026, in USD.

Which Microsoft 365 email security tools are hosted in the EU?

Microsoft 365 is an EU Data Boundary service for tenants signed up in the EU or EFTA. Sentaro is hosted in Sweden on Microsoft Azure and lists its subprocessors in a public DPA. Check Point documents an Ireland region, Abnormal’s subprocessor list offers EU (Ireland) hosting by subscription, Hornetsecurity states 12 regional data centres, Mimecast announced Frankfurt data centres in 2018, and Sublime offers an EU (Dublin) managed-cloud region. Proofpoint assigns API tenants to an EU or US data centre with some US processing, IRONSCALES lists AWS in the USA and Germany, and Barracuda lists only US regions for its API modules. Material does not document an EU region.

Does Sentaro replace Defender for Office 365?

No. Sentaro is designed to run alongside Defender and Google’s built-in protection, which it treats as a good baseline for bulk attacks. It adds detection of targeted, payload-free fraud and covers OAuth grants and AI tools in the same platform. It does not offer a gateway, archiving, encryption, backup or DMARC report management.

Sources and method

Sentaro publishes this list and ranks itself first; scores use the method above and public vendor documentation as of 21 October 2026. Product capabilities change; check each vendor’s current documentation. Trademarks belong to their owners. Corrections: contact Sentaro.

  1. Sentaro pricing
  2. Sentaro Data Processing Agreement and subprocessor list
  3. Microsoft Learn: Why do I need Microsoft Defender for Office 365? (accessed 2026-10-18)
  4. Microsoft Learn: Built-in security features for all cloud mailboxes (EOP) (accessed 2026-10-18)
  5. Microsoft: Defender for Office 365 pricing (accessed 2026-10-18)
  6. Microsoft Tech Community: Defender for Office 365 Plan 1 rolling out to Microsoft 365 E3 (2026-06-17)
  7. Microsoft licensing news: 2026 Microsoft 365 packaging and pricing updates
  8. Microsoft Learn: EU Data Boundary (accessed 2026-10-18)
  9. Abnormal AI: Inbound Email Security (accessed 2026-10-18)
  10. Abnormal AI: Trust center (certifications)
  11. Check Point: Harmony Email & Collaboration (accessed 2026-10-18)
  12. Check Point: Harmony Email & Collaboration pricing tiers (accessed 2026-10-18)
  13. Check Point: Harmony Email & Collaboration admin guide, data residency
  14. Proofpoint: Core Email Protection (accessed 2026-10-18)
  15. Mimecast: Email Security (accessed 2026-10-18)
  16. IRONSCALES: Home page (accessed 2026-10-18)
  17. IRONSCALES: Pricing (accessed 2026-10-18)
  18. Sublime Security docs: Installation (accessed 2026-10-18)
  19. GitHub: sublime-security/sublime-rules detection rules
  20. Hornetsecurity: 365 Total Protection (accessed 2026-10-18)
  21. Hornetsecurity: Email security modes
  22. Barracuda: Email Protection (accessed 2026-10-18)
  23. Barracuda: Email Protection plans (accessed 2026-10-18)
  24. Material Security: Pricing (accessed 2026-10-18)
  25. Material Security: Home page (accessed 2026-10-18)
  26. Mimecast: Email Security, Cloud Integrated launch release (2022)
  27. Datacentre News: Mimecast opens two Frankfurt data centres (2018)
  28. Proofpoint: Proofpoint completes acquisition of Hornetsecurity (December 2025)
  29. Check Point: Acquires Avanan (2021)
  30. Sentaro platform: Vord engine and deployment
  31. Abnormal AI: Subprocessors (updated 31 July 2026, accessed 2026-10-21)
  32. IRONSCALES: List of current sub-processors (PDF, December 2024; accessed 2026-10-21)
  33. Barracuda Trust Center: Data center locations (accessed 2026-10-21)
  34. Sublime Security docs: Sublime Cloud regions (accessed 2026-10-21)
  35. Proofpoint: Data privacy information sheet, Core Email Protection API (updated 24 July 2026; accessed 2026-10-21)
  36. Material Security: Subprocessors (updated 12 June 2025; accessed 2026-10-21)
RelatedEmail security for Microsoft 365Sentaro vs Defender for Office 365Defender Plan 1 vs Plan 2Best email security for Google WorkspaceBest AI email securitySentaro pricing

Add Sentaro next to Defender in four minutes.

API connection, no MX change. The first account is free.

Speak to salesStart free