Email threat protection Available now
Gateway filtering checks mail before it reaches Microsoft 365 and holds impersonation, payment-change scams, risky links and malware, each with readable reasons.
Microsoft 365 · Exchange Online
Email protection and backup for Microsoft 365
Stop invoice fraud and phishing before it reaches Outlook, keep an independent copy of every Exchange Online mailbox, and bring lost mail back through restores your administrator approves.
KnoxDefender is not affiliated with or endorsed by Microsoft.
- Your admin approvesAn app in Microsoft Entra with only the permissions your plan needs, each explained first.
- Choose mailboxesPick which mailboxes are protected and who approves restores.
- Point MX (optional)For filtering before delivery, MX goes to KnoxDefender and a connector delivers to Exchange Online.
- Monitor and recoverBackup freshness, restore tests, held mail and account alerts in one console.
What you get on Microsoft 365
Six email pillars, each with its real status
Email backup and recovery In provider verification
Daily encrypted backups outside Microsoft 365, with a key per organization; restores go to a new "Recovered <date>" folder in the same mailbox.
SPF, DKIM and DMARC Available now
Checks your records, reads DMARC reports by sender and explains each fix with the record to copy.
Mailbox account security In provider verification
Alerts on forwarding to outside addresses, hidden rules, new delegates and suspicious sign-ins where licensing provides them.
Archiving and former staff In provider verification
Search retained mail across mailboxes, legal holds with recorded reasons, mail kept after an account is removed.
Awareness training Available now
Short lessons and authorized phishing simulations using invented brands only.
Filtering
Checked before the inbox
With gateway filtering, your MX record points to KnoxDefender. Clean mail is delivered to Exchange Online through an inbound connector; we guide you through restricting that connector so attackers cannot go around the gateway. Outbound filtering through a smart host is also available.
Gateway filtering needs no Microsoft 365 API permission: only DNS records (MX, a TXT ownership check) and a setting in your admin console.
Reporting phishing: an Outlook "Report phishing" add-in, the staff portal, or forwarding the message as an attachment.
Good to know
- Sign-in alerts need Microsoft Entra ID P1 (included in Business Premium); risky sign-in signals need P2.
- In Exchange Online, deleted items are kept 14 days by default (an admin can raise it to 30). KnoxDefender keeps its own copy for the retention you choose.
- API mode (no MX change) checks mail shortly after delivery. It is not pre-delivery blocking.
- Email only: OneDrive, SharePoint and Teams are not backed up.
Permissions
Exactly what we ask for, and why
Your administrator approves these before anything connects. We request only what your plan uses.
| Permission | Used for |
|---|---|
User.Read.All | Finding mailboxes in your directory |
Mail.Read | Backing up messages and scoring delivered mail |
MailboxSettings.Read | Mailbox type and inbox-rule checks |
MailboxItem.ImportExport.All | Full-fidelity backup and restore |
MailboxFolder.ReadWrite.All | Creating the "Recovered" folder during a restore |
Mail.ReadWrite | Moving delivered threats to quarantine (API mode, protection plans only) |
AuditLog.Read.All | Sign-in alerts (mailbox security plans; needs Entra ID P1) |
Office 365 Management APIs: ActivityFeed.Read | Forwarding, delegation and app-consent alerts (mailbox security plans) |
Does Microsoft 365 already back up my email?
Microsoft keeps the service running and keeps deleted items for 14 days by default (up to 30 if an admin changes it). Point-in-time recovery after that, or after an attacker or a departing employee deletes mail, depends on having your own copy.
Do we have to change our MX record?
Only for filtering before delivery. Backup, archiving, domain protection, mailbox security and training work through the approved app without touching mail flow.
Which Microsoft 365 plans work?
Any plan that includes Exchange Online. Sign-in alerts additionally need Microsoft Entra ID P1, which is included in Business Premium.
Where do restored messages go?
Into a new "Recovered <date>" folder in the mailbox, after an administrator approves the request. Nothing is overwritten.
Protect your Microsoft 365 email.
Tell us how many mailboxes you have. We reply with a written quote, including nonprofit pricing.