Which routes could bypass the mail protections your team relies on?
Review mail flow, forwarding, authentication and effective protection for the recipients that matter.
Begin with the business decision and the affected population. A targeted workload review may be sufficient; an interconnected tenant assessment may be more useful where the same identity, device or data dependency affects several services.
Evidence we agree to examine
- Connectors, transport rules, mailbox forwarding and inbox-rule review within agreed boundaries
- Accepted and sending domains, SPF, DKIM and DMARC alignment
- Defender protection policy assignments, exclusions, precedence and protected recipients
- Mailbox auditing, role assignments, investigation ownership and available evidence
Why context changes the conclusion
A configured anti-phishing policy can coexist with an excluded executive group or a higher-priority policy. Review the recipient’s effective coverage, not just the policy list.
Treat this as an assessment question, not a finding about your organisation. During an engagement, a conclusion must identify the dated evidence, the sampled population and any exceptions that could not be corroborated.
The output your team can use
A mail-security coverage and exception register, with domain-authentication and safe rollout actions.
Each action should identify its accountable owner, licence or business dependency, proposed rollout safeguards and the record that will demonstrate successful closure. A policy screenshot alone is not enough when the finding concerns coverage or sustained operation.
Access and boundaries
Mail content collection, phishing simulations and live incident investigation are not included by default. Defender features depend on licensing.
We agree evidence access before work begins. Your team can lead supervised sessions and provide approved, minimised exports. The assessment does not require you to send passwords, grant access through this website or permit production changes. See access and data handling.
Prepare your audit request
Use the Microsoft 365 Audit Planner for a licence-aware starting scope, or the detailed scoping assistant. Review the brief and send it with your enquiry. You can attach your NDA or RFP in the contact form.
Sources & further reading
Reviewed 6 October 2026. Product names, licence entitlements and guidance can change. Confirm applicability to your tenant and agreed assessment date.
