Microsoft 365
MailThreatZero sits at your MX record and scans inbound mail before Exchange Online accepts it. Your tenant, your mailboxes and your licensing stay exactly as they are. Defender stays on.
Priced per protected domain, not per mailbox. A domain with 4 users and one with 200 cost the same to protect, within the included 250-address allowance.
Three things, and only three.
your-domain.mail.protection.outlook.com. Mail arrives here first.Nothing is installed, no mailbox is migrated, and no Microsoft license changes. Mail delivery to your users looks the same to them on the day of the switch.
Both of these are invisible until after cutover, and both make a gateway look like it is working while it quietly is not. The console generates the exact steps for your tenant, with the values filled in, at the point you connect a domain.
Put any gateway in front of Exchange Online and Microsoft starts seeing every message as coming from the gateway rather than from the real sender. SPF is then evaluated against us, so it fails for almost everything, and DMARC fails with it. Enhanced Filtering tells Microsoft to look past the gateway to the true source.
Skip this and your authentication results become noise — on both sides of the handover.
Pointing MX at a gateway does not stop anyone delivering straight to
your-domain.mail.protection.outlook.com, and your published MX
history tells an attacker exactly where to aim. Until the tenant is told to
accept inbound mail only from the gateway's addresses, filtering is optional
for anyone who knows to skip it.
The setup guide includes the connector restriction and the gateway addresses to allow.
Defender is already part of your subscription, and MailThreatZero is built to sit in front of it as a second layer, not to replace it.
The case for a second layer is that two engines built by different people, on different data, disagree — and the disagreement is where you learn something. A message Microsoft delivered and this gateway would have held is a data point about your own mail, not a marketing claim about ours.
Measure it on your own mail. We publish no catch-rate comparison with Microsoft; Monitor Mode records what this gateway would have held, message by message. The longer version of this argument is on the comparison page.
Microsoft licenses per user, and so does almost every add-on sold alongside it. A customer who hires ten people gets ten more bills. MailThreatZero charges for the domain: from $39 per protected domain per month, on one rate card for every account, with up to 250 receiving addresses on every protected domain.
For an MSP that is the difference between a margin you can predict and a margin that moves every time a customer's headcount does. Rates and a calculator.
Mail does not travel through Microsoft Graph. It arrives over SMTP and it leaves over SMTP. Graph is used for three things, each one separately authorized by you:
Current status. Each of the three Graph uses above is built and covered by tests against a simulated Microsoft API, and is not yet in use on a live customer tenant. The mail path is separate and is ordinary SMTP: domains protected today relay to customer-operated mail servers, and no production domain delivers through an Exchange Online inbound connector yet, so a Microsoft 365 evaluation comes with a cut-over we work through with you.
Monitor Mode runs the full pipeline on one domain’s real traffic and records what it would have done without enforcing the verdict. It is not a zero-change trial: the domain’s MX still points at the gateway, the Exchange Online inbound connector still has to accept mail from it, and a few things still apply while it monitors. After a couple of weeks you are comparing verdicts on your own mail rather than reading anyone’s numbers.
As noted above, a Microsoft 365 evaluation comes with a cut-over we work through with you.