Mimecast for Microsoft 365 India — Why M365 Email Security Isn't Enough

Microsoft 365 includes email security features — but most organisations that evaluate them seriously choose to add a third-party gateway on top. Mimecast is the most commonly deployed add-on security layer for Microsoft 365 in India. This guide explains what Microsoft's native email security does and does not cover, why Indian organisations add Mimecast, and what the combination delivers.

What Microsoft 365 Includes for Email Security

Microsoft 365 Business and Enterprise plans include varying levels of email protection:

Microsoft Defender for Office 365 Plan 1 (included in Business Premium, Microsoft 365 E3 Business):

• Exchange Online Protection (EOP) — basic spam and malware filtering
• Safe Attachments — sandbox analysis of email attachments
• Safe Links — URL rewriting and click-time scanning
• Anti-phishing policies — display name impersonation detection

Microsoft Defender for Office 365 Plan 2 (included in Microsoft 365 E5):

• Everything in Plan 1 plus:
• Threat Hunting and Explorer
• Automated investigation and response (AIR)
• Attack simulation training
• Priority account protection

On paper, this looks comprehensive. The limitations become apparent in practice.

The Gaps in Microsoft's Email Security

Gap 1 — Business Email Compromise (BEC) Detection Depth

BEC attacks — where an attacker impersonates your CEO or CFO to instruct finance teams to transfer funds — are the highest-value attack category for Indian businesses. Manufacturing, trading, pharma, and financial companies are regularly targeted.

Microsoft's anti-impersonation relies primarily on display name matching and basic header analysis. Sophisticated BEC attacks that use legitimate-looking display names, subtle domain variations, or compromised legitimate accounts frequently bypass Microsoft's detection.

Mimecast's impersonation protection uses a more layered detection model: it analyses From header, Reply-To header, content patterns, sending infrastructure reputation, and lookalike domain detection simultaneously. Mimecast's VIP protection list specifically identifies your most at-risk executives and applies heightened scrutiny to any message appearing to come from them.

Gap 2 — Email Archiving

Microsoft 365 includes In-Place Archiving, but with important limitations:

• Archive mailboxes have storage limits (varies by licence)
• Litigation Hold and eDiscovery require E3 or higher licences
• Search is limited by the Microsoft Purview interface

Mimecast Archive is purpose-built for long-term email retention, legal hold, and eDiscovery. Key advantages over M365 archiving:

• Unlimited storage — Mimecast archive is not bounded by mailbox size
• Instant search — search millions of archived emails in seconds; Microsoft's compliance search can be slow on large mailboxes
• Legal hold management — granular custodian-level hold management, critical for legal disputes
• Data independence — archived mail is stored in Mimecast's infrastructure separately from your M365 tenant; if your M365 tenant is compromised or suspended, the archive remains accessible
• Tamper-proof — archived mail cannot be deleted by end users or even by tenant admins (important for regulatory compliance)

For Indian companies in BFSI, legal, and pharma that must retain email records for regulatory periods (SEBI requires 5 years; RBI has its own requirements), Mimecast Archive is far more robust than M365 In-Place Archiving.

Gap 3 — Email Continuity

If Microsoft 365 experiences an outage — and M365 outages do occur, including several significant ones affecting India — your users cannot send or receive email.

Microsoft does not include an email continuity service. During an M365 outage, email queues at the sending server; once the outage resolves, queued mail is delivered. But your users cannot access their email for the duration.

Mimecast Email Continuity allows your users to continue sending and receiving email through Mimecast's Emergency Inbox during an M365 outage. Users access their emergency inbox through the Mimecast portal or mobile app. For businesses where email interruption means lost revenue — logistics, banking, customer service — this is a significant operational resilience feature.

Gap 4 — Large File Sharing (Secure Messaging)

Microsoft 365 has a 150 MB attachment size limit. Large file sharing workarounds (SharePoint links, OneDrive) add friction and are often bypassed by users sending large attachments through personal email.

Mimecast Large File Send allows users to send attachments up to 2 GB via a secure Mimecast-hosted link embedded in the email. The recipient receives the email with a download link; the file never enters email infrastructure. This is particularly useful for Indian companies in video, media, legal, and architecture where large file transfer is routine.

Gap 5 — Outbound DLP and Encryption

Microsoft Purview includes DLP policies, but outbound email DLP requires Microsoft 365 E3 or higher. Many Indian organisations on Business Standard or Business Premium do not have access to Microsoft's DLP capabilities.

Mimecast includes outbound content inspection at all tiers, covering:

• AADHAAR number pattern matching
• PAN card detection
• Bank account and IFSC code detection
• Credit card number detection
• Custom content policies (keywords, regex patterns)

Actions: block outbound mail, hold for admin review, apply encryption (Mimecast Secure Messaging), or notify the sender.

Mimecast + Microsoft 365 — What the Combination Delivers

Microsoft 365 Licences and What They Get You

Not all M365 licences include Defender for Office 365. Here's what Indian businesses on common plans actually have:

Many Indian SMBs are on Business Basic or Business Standard — these plans have only Exchange Online Protection (basic spam/malware filtering). There is no sandboxing, no URL rewriting, no impersonation protection. For these organisations, Mimecast provides the most significant uplift.

Deployment: Mimecast Alongside Microsoft 365

Mimecast does not replace Microsoft 365 — it enhances it. The deployment model:

1. MX records changed to point to Mimecast's infrastructure
2. Clean mail delivered from Mimecast to your M365 tenant
3. Microsoft 365 configured to only accept inbound mail from Mimecast IPs
4. Outbound mail can be routed through Mimecast for DLP scanning, or sent directly from M365

Both inbound and outbound protection can be active simultaneously. The typical Indian mid-market deployment routes inbound mail through Mimecast (for BEC, phishing, spam protection) and keeps outbound through M365 unless DLP is required — simplifying the outbound SPF configuration.

Indian Regulatory Context — Why Archiving Matters

Indian regulatory requirements for email retention:

• SEBI (for listed companies): 5-year retention of business communications
• RBI (for banks and NBFCs): Specific data retention periods under IT governance frameworks
• Companies Act 2013: Board meeting communications and related records
• Income Tax Act: Documentation supporting transactions must be retained

Mimecast Archive provides retention policies that automatically enforce these periods, with audit trails showing what was retained, when, and who accessed it — critical for regulatory inspections.

Getting Mimecast for Your Microsoft 365 Environment in India

Cloudfy Systems is an authorised Mimecast email security partner in India. We deploy Mimecast alongside Microsoft 365 with:

• MX record changes and Microsoft 365 connector configuration
• SPF, DKIM, and DMARC alignment setup
• Mimecast policy configuration (anti-spam, ATP, BEC protection, archiving)
• User onboarding and quarantine digest configuration
• INR billing with GST invoice

Contact us for a same-day Mimecast pricing proposal for your Microsoft 365 mailbox count.