# Microsoft Defender for Office 365 vs an inbound email gateway

URL: https://iblockspam.com/compare/defender-for-office-365-vs-email-gateway
Last updated: 2026-10-09

> Microsoft Defender for Office 365 Plan 1 and Plan 2 compared with an MX-level email gateway: what each covers, how licensing works, and how to run both.

Defender for Office 365 protects mail inside Microsoft 365 and reaches into Teams, SharePoint and OneDrive. An inbound gateway filters mail before it reaches Microsoft. They do different jobs, and many organizations run both.

Microsoft Defender for Office 365 and an inbound email gateway are often presented as rivals. They aren't really. Defender works inside Microsoft 365; a gateway works in front of it. This page explains what each one covers, where Defender is clearly stronger, and how to run both without the layers getting in each other's way.

## The short answer

If you have Defender for Office 365 configured and reviewed, you already have strong protection that an MX gateway can't replace, especially after delivery and outside email. A gateway like iBlockSpam adds a separate filtering layer before Microsoft, a personal quarantine with digests for every user, mail held during outages, per-domain pricing and one portal across mixed platforms. If you add one, keep Defender, enable Enhanced Filtering for Connectors, and avoid double link rewriting.

## What Defender for Office 365 includes

Microsoft describes a [protection ladder](https://learn.microsoft.com/en-us/defender-office-365/mdo-about) with three steps.

### Built-in protection for every cloud mailbox

Exchange Online Protection (EOP) comes with every Microsoft 365 subscription that has cloud mailboxes. It includes anti-spam, anti-malware, spoof protection, quarantine and the Tenant Allow/Block List. It also includes [zero-hour auto purge (ZAP)](https://learn.microsoft.com/en-us/defender-office-365/zero-hour-auto-purge) for email, which acts on spam, phishing and malware found after delivery. Microsoft says ZAP's search covers the last 48 hours of delivered mail.

### Plan 1

Plan 1 adds prevention and detection features:

- **Safe Attachments** for email, and for files in SharePoint, OneDrive and Teams.
- **Safe Links** in email, Office apps and Teams.
- **Impersonation protection** for users and domains, plus mailbox intelligence, in anti-phishing policies.
- **Real-time detections**, ZAP for Teams, and user-reported Teams messages.

### Plan 2

Plan 2 adds investigation, response and training: Threat Explorer, Threat Trackers, campaign views, automated investigation and response (AIR), attack simulation training, priority account protection and Microsoft Defender XDR integration.

### Which subscriptions include it

According to Microsoft's [Defender for Office 365 service description](https://learn.microsoft.com/en-us/office365/servicedescriptions/office-365-advanced-threat-protection-service-description), Plan 1 is included in Microsoft 365 Business Premium and, from July 1, 2026, in Office 365 E3 and Microsoft 365 E3. Plan 2 is included in enterprise subscriptions such as Microsoft 365 E5. Both plans are also sold as add-ons. We don't quote Microsoft prices here; check Microsoft's current pricing for your agreement.

### Licensing is per user

Microsoft's [licensing terms](https://learn.microsoft.com/en-us/office365/servicedescriptions/microsoft-365-service-descriptions/microsoft-365-tenantlevel-services-licensing-guidance/microsoft-defender-service-description) say you need licenses for any user who accesses a mailbox that benefits from Defender protections, and for shared mailboxes that benefit. If Safe Attachments for SharePoint, OneDrive or Teams is on, all users of those services need licenses. The same applies to users of Microsoft 365 apps or Teams when Safe Links is on.

## Where Defender is stronger

Be honest about this before you buy a gateway:

- **After delivery.** Defender works on messages already in mailboxes. A gateway in front of the MX makes its decision once, at the door.
- **Internal mail.** Microsoft lists advanced protection for internal mail in Plan 1. Mail between users in your tenant never passes through an MX gateway.
- **Teams, SharePoint and OneDrive.** Safe Links, Safe Attachments and ZAP for Teams reach collaboration tools that a gateway never sees.
- **Investigation and response.** Plan 2's Threat Explorer and AIR give security teams tools that a filtering gateway isn't built for.
- **One stack.** For an organization fully on Microsoft 365, one vendor and one portal is simpler.

## What an inbound gateway adds

| Need | Defender for Office 365 | With iBlockSpam in front |
|---|---|---|
| Where filtering happens | Inside Microsoft 365, including after delivery | Before mail reaches Microsoft 365 |
| Internal mail, Teams, SharePoint, OneDrive | Covered (Plan 1 and up) | Not covered |
| User quarantine digests | Depends on your quarantine policies | Personal quarantine and digests (hourly, daily, weekday or custom) for every user |
| Mail during a destination outage | Depends on the sending server's retries | Spooled for up to 5 days, then delivered |
| Mixed platforms | Microsoft 365 only | Microsoft 365, Google Workspace, cPanel and Exchange |
| Pricing basis | Per user, including shared mailboxes that benefit | Per domain, unlimited mailboxes (count, not message volume) |
| DNS drift alerts for MX, SPF, DMARC | Not the focus | Weekly on Protect, daily on Plus |

## How to run both

Microsoft supports placing another service in front of Exchange Online, and documents the trade-offs in [integrating non-Microsoft security services](https://learn.microsoft.com/en-us/defender-office-365/mdo-integrate-security-service). It names more cost, more complexity, and more false positives as products are added. It also says users shouldn't have to think about which quarantine to check. Those are fair points. Plan for them.

1. **Enable Enhanced Filtering for Connectors.** With a gateway in front, Microsoft sees the gateway's IP instead of the sender's. [Enhanced Filtering for Connectors](https://learn.microsoft.com/en-us/exchange/mail-flow-best-practices/use-connectors-to-configure-mail-flow/enhanced-filtering-for-connectors) skips that hop so Microsoft can use explicit SPF, DKIM and DMARC checks again. Microsoft says it also improves anti-spoofing, anti-phishing and AIR.
2. **Remove SCL -1 bypass rules.** Microsoft says to disable mail flow rules that bypass spam filtering for mail through the connector once Enhanced Filtering is on. Its ZAP documentation notes that ZAP may not act on high confidence phishing when the MX points elsewhere and a bypass rule is in place.
3. **Avoid double link rewriting.** Microsoft advises against using Safe Links alongside a service that also rewrites links, and recommends turning off link wrapping in the other service.
4. **Lock down direct delivery** to your tenant after you've verified mail flows through the gateway.
5. **Agree where users look.** Decide whether users check the gateway digest, Microsoft quarantine, or both, and tell them.

Our [Enhanced Filtering setup guide](https://iblockspam.com/blog/microsoft-365-third-party-spam-filter-enhanced-filtering) and the [Microsoft 365 platform page](https://iblockspam.com/platforms/microsoft-365) cover these steps in detail.

## Who should choose which

### Defender alone is likely enough if

- You run only Microsoft 365 and already have Plan 1 or Plan 2 through your subscription.
- You've configured Safe Links, Safe Attachments and impersonation protection, ideally using Microsoft's preset policies.
- You have someone who reviews quarantine and alerts regularly.

### Add a gateway in front if

- You manage domains across several platforms, as many MSPs do, and want one filtering policy.
- You have many shared mailboxes or aliases, and [per-domain pricing](https://iblockspam.com/compare/per-domain-vs-per-user-pricing) is easier to budget than licensing each one.
- You want every user to get [quarantine digests](https://iblockspam.com/features/quarantine-and-digests), mail held during outages, and DNS drift alerts.
- You want a second, independent layer before Microsoft, while keeping Defender for what happens after delivery.

If your Microsoft 365 plan has no Defender at all, start with [Microsoft 365 built-in filtering vs a gateway](https://iblockspam.com/compare/microsoft-365-built-in-vs-gateway). For tools that connect to mailboxes by API instead of MX, read [secure email gateway vs API email security](https://iblockspam.com/blog/secure-email-gateway-vs-api-email-security).

## Sources

- [Microsoft Learn: Why do I need Microsoft Defender for Office 365?](https://learn.microsoft.com/en-us/defender-office-365/mdo-about)
- [Microsoft Learn: Microsoft Defender for Office 365 service description](https://learn.microsoft.com/en-us/office365/servicedescriptions/office-365-advanced-threat-protection-service-description)
- [Microsoft Learn: Microsoft Defender service description (licensing terms)](https://learn.microsoft.com/en-us/office365/servicedescriptions/microsoft-365-service-descriptions/microsoft-365-tenantlevel-services-licensing-guidance/microsoft-defender-service-description)
- [Microsoft Learn: Zero-hour auto purge in Microsoft Defender for Office 365](https://learn.microsoft.com/en-us/defender-office-365/zero-hour-auto-purge)
- [Microsoft Learn: Integrate non-Microsoft security services with Microsoft 365](https://learn.microsoft.com/en-us/defender-office-365/mdo-integrate-security-service)
- [Microsoft Learn: Enhanced Filtering for Connectors in Exchange Online](https://learn.microsoft.com/en-us/exchange/mail-flow-best-practices/use-connectors-to-configure-mail-flow/enhanced-filtering-for-connectors)

## Frequently asked questions

### What does Defender for Office 365 Plan 1 add over Exchange Online Protection?

Microsoft lists Safe Attachments, Safe Links, impersonation protection in anti-phishing policies, Safe Attachments for SharePoint, OneDrive and Teams, real-time detections, and ZAP for Teams. Exchange Online Protection, the built-in layer for every cloud mailbox, already includes anti-spam, anti-malware, spoof protection, quarantine and zero-hour auto purge for email.

### What does Plan 2 add over Plan 1?

Plan 2 adds investigation, response and training tools: Threat Explorer instead of real-time detections, Threat Trackers, campaign views, automated investigation and response, attack simulation training, priority account protection and Microsoft Defender XDR integration. It's aimed at organizations with security staff who investigate incidents.

### Is Defender for Office 365 licensed per user?

Yes. Microsoft's service description says licenses are needed for any user who accesses a mailbox that benefits from Defender protections, for shared mailboxes that benefit, and, with some features on, for users of SharePoint, OneDrive, Teams or Microsoft 365 apps. Check the current terms with Microsoft or your reseller.

### Can I use Safe Links if my gateway also rewrites links?

Microsoft advises against it. Double link wrapping can stop Safe Links from checking link status and detonating links, and can trigger one-time-use links. Microsoft recommends turning off link wrapping in the other service. Ask your gateway provider whether it rewrites links and how to disable that.

### Does an MX gateway protect internal email or Teams messages?

No. An MX-level gateway only sees mail arriving from the internet for your domain. Mail between users in the same Microsoft 365 tenant, and Teams, SharePoint and OneDrive content, never passes through it. Defender for Office 365 covers those. That's a main reason to keep Defender when you add a gateway.

---

Source: iBlockSpam, https://iblockspam.com/compare/defender-for-office-365-vs-email-gateway (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt