MPmail Avanan offers three modes of protection for email outlined below:
Monitor only
Detect and Protect
Protect (Inline)
Monitor only mode scans emails when they arrive in the inbox but takes no action other than to alert and audit. In this mode manual and automated query based quarantines are available after delivery to the user mailbox.
Detect and Protect mode provides an increased level of protection. Emails are scanned after arriving in the inbox. This mode adds an automated policy action to quarantine malware, phishing attacks etc. In this mode user notifications and release workflows are available.
- Incoming email arrives in respective mailbox folder.
- MPmail Avanan detects new email and scans (10 sec - 5 min).
- If malicious, MPmail Avanan takes automatic action, otherwise, leave the email alone.
- Optional user notifications and release workflows are available.
Protect Mode provides the highest level of protection and scans email prior to delivery to the end user’s inbox. Scanning and quarantining takes place before email is delivered to the user’s inbox. This mode insures that threats are detected and remediated before the user has access to the email.
- Incoming email heads to the mail flow.
- MPmail Avanan redirects the mail to the MPmail Avanan platform for scanning (10 sec - 5 min).
- If malicious, MPmail Avanan takes action, otherwise, returns email to the mail flow.
- User notifications and release workflows are defined in policy.
Note : If adding Protect (Inline) to an account that has the MPmail lock down rules in the Microsoft 365 tenancy, you will need to add the MPmail Avanan IP address to the allowed IP's in the rule. See this article for a full list of required IP addresses.