Microsoft 365 built-in filtering vs an inbound gateway

The short answer

Microsoft 365 includes Exchange Online Protection (EOP) for every tenant, and Microsoft Defender for Office 365 adds more on some plans. For many organizations, a well-configured Microsoft setup is solid. An inbound gateway like iBlockSpam is worth adding when you want per-user quarantine digests that work the same everywhere, mail held during outages, a predictable per-domain price, one portal across mixed platforms, or ongoing checks that your DNS hasn't drifted. It also adds a routing hop, which must be configured correctly.

What Microsoft does well

Be clear about this before buying anything:

• It's already there. EOP filters spam and malware for every Exchange Online mailbox at no extra cost.
• Deep integration. Microsoft 365 can act on messages after delivery (zero-hour auto purge), and Defender for Office 365, on plans that include it, scans links at click time and detonates attachments in ways a gateway in front of the MX doesn't replicate.
• One vendor, one admin center if your whole organization is on Microsoft 365.
• Large-scale signal. Microsoft sees a vast amount of mail, which informs its filtering.

If you are fully on Microsoft 365, have Defender configured and reviewed, and are happy with how quarantine works for your users, you may not need a gateway.

When an inbound gateway helps

The strongest reasons are usually practical: an MSP managing clients on several platforms, a business with shared mailboxes and many aliases where per-user add-ons get expensive, or a team that wants a second, independent layer with its own quarantine.

The risks, and how to handle them

Adding a gateway changes your mail flow. Microsoft documents this in Manage mail flow using a third-party cloud service with Exchange Online. The main points:

The extra hop hides the sender's IP

Microsoft sees mail arriving from the gateway, not from the original sender. That weakens SPF evaluation and other sender-reputation checks unless you enable Enhanced Filtering for Connectors on the inbound Partner connector. Our setup guide includes this step.

Don't switch Microsoft's filtering off

A common shortcut is a transport rule that sets SCL -1 for everything from the gateway. That turns off Microsoft's spam filtering for all that mail. Use Enhanced Filtering instead, and keep any bypass rules narrow and documented.

Lock down direct delivery

Attackers can send directly to your tenant's Microsoft host and skip the MX entirely. After testing, restrict inbound delivery so that mail for your domain is accepted only through the gateway's connector. Do this after verification, not before, or you can block legitimate mail.

Decide who makes the final call

With two layers, a message can be passed by one and held by the other. Agree where users look for missing mail (the iBlockSpam digest, Microsoft quarantine, or both) and tell them.

Test before tenant-wide change

Use a test mailbox or group first, check the message headers with the Email Header Analyzer, and keep the rollback steps from the setup wizard to hand.

How iBlockSpam sets this up

1. The guided setup wizard records your current MX, SPF and DMARC.
2. You create a restricted inbound Partner connector with Enhanced Filtering for Connectors.
3. You change MX to our filtering servers and send test messages.
4. After delivery is verified, you consider restricting direct-to-tenant delivery.
5. Domain monitoring then watches for drift.

The full steps are in the Microsoft 365 setup guide. If your plan includes Microsoft Defender, read Defender for Office 365 vs a gateway too. If you're moving from another gateway, start with migrating without losing email.