How to Choose AI Email Security for Office 365 in 2026: What Microsoft's Own Guidance Says
The best AI email security for Office 365 connects the way Microsoft supports: by API, with no MX change, deciding before mail reaches the inbox.
Gabrielle Letain-Mathieu Head of Growth · · 4 min read
Microsoft supports adding a non-Microsoft service as part of a "defense-in-depth strategy for email security," and its integration guide points customers to two ways to connect one: a gateway in front of Microsoft 365, or the Microsoft Graph API. It strongly recommends avoiding a third, called in-and-out routing.
Microsoft is candid about why a second layer can make sense. Its guide states that "total protection never reaches 100 percent," however many layers you run. It also publishes a separate step-by-step guide for running its protection side by side with another service.
For a closer look at the first two, see our explainer on API versus inline email security and pre-delivery protection.
Why is an API connection the simplest fit for Microsoft 365?
An API connection is the supported option that leaves your mail flow untouched: no MX change, no connectors to tune and no link rewriting to switch off. Mail reaches Microsoft 365 exactly as it was sent, so Microsoft's sender reputation, spoofing checks and machine learning keep working on the original message.
That matters because most of Microsoft's warnings concern mail that is re-routed or changed along the way. Microsoft explains that when messages leave and re-enter its service, the original sending IP addresses are lost and its models learn from altered data. A Graph API connection avoids that problem entirely.
Does an API-based tool act before or after a message reaches the inbox?
It depends on the tool, so ask. Microsoft's guide describes API services that scan messages after delivery and then remove the ones they judge malicious, which leaves a short window when a user can open the message. Newer API-based designs close that window by holding each message for a few seconds and deciding before it appears in the inbox.
The difference shows on fast attacks. A payroll change request that sits in an inbox even briefly can be previewed on a phone, opened or acted on. A message that is judged before it lands never gets that chance.
What should you check about mailbox permissions?
Microsoft notes that API integration "typically requires granting the non-Microsoft service full access to mailboxes," and asks you to understand the vendor's security and support practices first. That level of access is standard for API-based email security, so the real test is what the vendor does with it.
Good practice looks like this:
- Every permission is listed in writing, with the reason for each one.
- Clean mail is discarded as soon as it is cleared, with no logs or backups kept.
- Customer email is never used to train or fine-tune AI models.
- AI model providers have no access to your messages at runtime.
- Your data is purged on a fixed schedule, with written confirmation, when you leave.
Our privacy architecture page shows how we meet each of these.
Which attacks get past Microsoft 365's built-in filters?
The costliest attacks are the ones that look legitimate: in our Phishing Genome study, 86% of the attacks that reached the inbox passed SPF, DKIM and DMARC. Authentication confirms which domain sent a message. It cannot tell you whether the request inside is honest.
Three patterns come up again and again. A real supplier's mailbox is compromised and used to send new bank details. A lookalike domain is registered with its own valid records. A plain-text message from a "CEO" asks for an urgent payment, with no link and no attachment to scan.
The money sits in a small slice of attacks. Our study found that 3.6% of attacks carried 98% of the modeled financial risk, all in four types: CEO fraud, vendor-invoice redirect, payroll fraud and W-2 fraud.
The FBI sees the same thing nationally. Its 2025 Internet Crime Report recorded 24,768 BEC complaints and $3,046,598,558 in reported losses, against $2,770,151,146 in 2024. It also notes that businesses reported more than $30 million in losses to BEC scams involving AI in 2025.
What should AI email security decide that filters don't?
It should judge the request as well as the sender. Reputation scoring will pass a vendor-invoice redirect sent from a real, compromised supplier account, because the sender is genuine and there is nothing to scan. A tool that reads the request can flag "new bank details, urgent, first time this supplier has asked."
Ask every vendor to explain a verdict in plain words. A score with no reason sends your analysts back to investigate by hand. This is the approach we took with TRACE, which judges each message's intent and writes out why.
Final Thoughts: How do you test AI email security?
Run it in detect-only mode on live mail, alongside Microsoft's protection, and make sure the trial covers real invoice and payroll requests. Turn on Microsoft's preset security policies first, so you measure what gets past a well-configured tenant.
- Connect by API in alert-only mode. Nothing changes for users during the trial.
- Confirm each flagged message by hand. An analyst should agree it was malicious and would have reached an inbox.
- Count false positives per day. Include good mail the tool would have held, not only alerts.
- Time your analysts. Record investigations per day and minutes per investigation, before and during the trial.
- Sort findings by money risk. One stopped payroll diversion matters more than a hundred stopped spam messages.
Analyst time is the number buyers most often skip. At one StrongestLayer customer with about 5,000 seats, daily email investigations fell from 33 to 4 (from 660 minutes to 8) in 2026, and 0.4% of alerts were false positives.
Then ask every vendor these questions:
- Which of Microsoft's supported integration methods do you use?
- Do we need to change our MX record?
- Does a malicious message ever reach the inbox before you decide?
- Do you explain each verdict in plain words that analysts and employees can read?
- Is our email ever used to train AI models, and what do you keep after a clean verdict?
- Do employees get help inside Outlook, and is your add-in listed on Microsoft AppSource?
FAQ
Does Microsoft support API-based email security?
Yes. Microsoft's integration guide describes a Microsoft Graph API connection as one of the two options it points customers to. The method Microsoft strongly recommends avoiding is in-and-out routing, where mail leaves Microsoft 365 and comes back.
Is Microsoft 365's built-in email protection enough?
Microsoft itself says no number of layers reaches 100 percent, and it publishes guidance for running a second service alongside its own. Set up Microsoft's preset policies first, then run a detect-only trial and count the confirmed attacks that still reach inboxes.
Do I need to change my MX record to add AI email security?
Only for a gateway that sits in front of Microsoft 365. API-based tools connect through Microsoft Graph and leave the MX record with Microsoft 365.
Will an API-based tool interfere with Microsoft's own protection?
It shouldn't. Mail still arrives at Microsoft 365 exactly as it was sent, so Microsoft's filtering runs as designed. Microsoft's warnings about lost sender data and weaker machine learning apply to mail that leaves and re-enters its service.
Can AI email security stop BEC that has no link or attachment?
Only if it judges the request itself as well as the sender. Test it with plain-text samples such as a bank detail change or an urgent wire request, and ask the tool to explain each verdict.
How long does it take to set up API-based email security?
Because nothing in your mail flow changes, an API connection is usually live the same day. Ask each vendor for its typical setup time and whether the trial runs on your real mail. How we approach it at StrongestLayer. StrongestLayer connects to Microsoft 365 through the Microsoft Graph API, with no MX change, and is live in about 15 minutes. It holds each message for about three seconds and decides before it reaches the inbox, while Microsoft's own protection keeps running underneath. TRACE explains every verdict.