Microsoft has renewed its warning to customers who route Exchange Online email through third-party security services before final delivery, forcing tens of thousands of organizations to re-examine a setup many thought was settled. Check Point, a major player in email security, responded this week with a detailed defense of its “Microsoft-first” architecture, but the exchange highlights a broader truth: a poorly implemented inline filter can quietly break authentication, weaken Microsoft’s native defenses, and create dangerous blind spots.
The Spark: Microsoft’s Refreshed Mail Flow Guidance
The trigger was Microsoft’s updated documentation on mail flow best practices, which explicitly calls out the risks of sending mail from Exchange Online to an external service and back again. The software giant isn’t telling customers to abandon third-party security entirely, but it’s making clear that letting email leave the Microsoft cloud after it has already been scanned can introduce a host of problems:
- Messages can be inspected multiple times, with conflicting verdicts.
- The original sender’s identity and reputation can be obscured.
- DKIM signatures may break if the intermediary modifies content.
- Mail loops, delays, and unexpected connector behavior can occur.
- Security verdicts from the first pass may no longer match the modified message.
- Compliance workflows, encrypted message handling, and journaling can be disrupted.
- Attackers might find a way to bypass the third-party hop entirely.
These aren’t theoretical. Microsoft has seen real-world incidents where wrongly configured connectors opened side doors for phishing campaigns, and where altered messages fooled Exchange Online Protection into treating malicious content as clean.
Check Point’s Counter: A Carefully Architected Second Layer
Check Point’s blog, published on July 21, 2026, pushes back. The company’s Email Security service (formerly under the Harmony brand) is designed so that Microsoft’s own defenses—Exchange Online Protection and Defender for Office 365—always process a message first. Only then is the mail routed to Check Point for a second round of scanning before it lands in the user’s mailbox. The path looks like this:
Internet sender → Microsoft 365 (first scan) → Check Point (second scan) → Microsoft 365 → mailbox
Check Point argues that this preserves Microsoft’s position as the internet-facing edge while adding a dedicated prevention layer for advanced threats like business email compromise, QR code phishing, and AI-generated attacks. To maintain authentication continuity, the service relies on Authenticated Received Chain (ARC), which cryptographically seals the authentication results from the first scan so that downstream systems can still verify the message’s origin even after content has been modified.
Crucially, Check Point also revealed that it made significant infrastructure changes during 2026 to tighten the integration. Those include new dedicated connectors, updated sending infrastructure, precise entries in Microsoft’s Tenant Allow/Block List, refined transport-rule exceptions, and better connection-filter handling. The company says these moves reduce the chances of mail loops, improper reprocessing, or accidental bypassing.
What This Means for You: Practical Impact by Audience
For IT Administrators and Security Teams
If your organization uses Check Point Email Security, or any similar inline filtering service, this debate isn’t academic. You now have a clear mandate to verify that your setup doesn’t weaken—or outright break—the Microsoft 365 security you’re already paying for. Even if the vendor’s design is sound on paper, a single misconfiguration in a connector, transport rule, or ARC trust setting can leave a gaping hole.
Microsoft’s guidance also introduces a new operational concern: if you ever need to open a support case about mail flow or security, the company may question a non-linear routing design and push you to simplify it first. That means your ability to get timely help could hinge on having a clean, well-documented architecture.
For Small Businesses and Microsoft 365-Only Shops
Smaller organizations often lack the staff to manage two security consoles, multiple quarantine locations, and the intricate mail routes that large enterprises can handle. If you’re only using Microsoft 365 Business Premium or Defender for Office 365 alone, this news reinforces the value of first tuning what you already have. Features like preset security policies, anti-impersonation controls, Safe Links, and automated investigation can stop the vast majority of threats without adding routing complexity.
Adding a third-party inline layer might still make sense if you need specific protections (e.g., against QR code phishing or AI-driven attacks) that Microsoft doesn’t yet cover, but the deployment must be done with meticulous care—preferably by a partner who monitors and manages the integration actively.
For Daily Users
Users won’t notice routing debates, but they will notice when legitimate emails are delayed, quarantined without explanation, or arrive with broken links and multiple warning banners. A messy inline setup can also train employees to ignore real warnings because they see too many false alarms. The goal should be stronger protection that remains invisible to the people who just need to get work done.
How We Got Here: The Evolution of Email Security in Microsoft 365
A decade ago, the standard model was simple: change your MX record to point to a secure email gateway, which filtered messages before forwarding them to your on-premises Exchange server. But when Microsoft built Exchange Online Protection (EOP) into Microsoft 365, its global filtering infrastructure became the natural front door for mail. That created two diverging paths for third-party security vendors:
- Gateway before Microsoft 365: The old model, still widely used, where the third party sits in front of Microsoft’s cloud. This keeps the provider as the first line of defense but requires careful configuration so that Microsoft can still see the original sender. Microsoft’s Enhanced Filtering for Connectors (also called skip listing) was built for this scenario.
- API-based inspection: Vendors that integrate via Microsoft Graph and other APIs can scan mail after delivery, inspect internal traffic, and remediate threats retroactively, all without touching SMTP routing. The trade-off is a time lag between delivery and detection—a dangerous gap when users or automated processes might act on malicious content immediately.
- Post-Microsoft inline scanning: Check Point’s approach is a hybrid: mail arrives at Microsoft first, gets scanned, then loops out to the Check Point cloud, and comes back. This avoids the MX record change but introduces the non-linear flow that Microsoft now warns about.
Microsoft’s stance has hardened as more customers adopt complex hybrid setups and as attackers exploit gaps created by misconfigured connectors. The company’s recent efforts to lock down unauthenticated sending and restrict “Direct Send” routes are part of the same trend: closing paths that can be abused.
What to Do Now: An Actionable Audit Checklist
If you’re using Check Point or any inline email security service that sits after Microsoft’s first pass, here’s a concrete plan to ensure your setup is safe:
- Map every mail path — Document exactly how inbound, outbound, internal, and relayed messages flow. Include hybrid scenarios and application-generated mail.
- Verify connector scoping — Ensure inbound connectors accept mail only from the specific IP ranges and certificates of your security vendor. A connector that is too broad can let attackers deliver directly to mailboxes.
- Check for bypass rules — Older deployments sometimes set the spam confidence level (SCL) to -1 for all mail from the gateway. Replace any such blanket bypasses with the more precise controls Microsoft now recommends.
- Test authentication preservation — Send test messages from multiple external domains and examine the headers. SPF, DKIM, DMARC, and ARC results should make sense end-to-end. If DKIM signatures are breaking, determine whether your vendor’s content modification is to blame.
- Review transport rules — Look for rules that mark messages as “processed” to prevent loops. These should use headers that can’t be forged and are still intelligible during incident response.
- Audit Tenant Allow/Block List entries — If your vendor added entries (as Check Point did in 2026), understand exactly what they allow or block and why.
- Measure pre- and post-delivery timing — Know how much latency the security scan adds and, for any API-based components, how long it takes to remove a malicious message after delivery.
- Correlate security verdicts — Make sure you can trace a single message through both Microsoft’s and the third party’s consoles. When quarantine releases or false-positive investigations happen, staff shouldn’t have to log into two systems and guess which one acted.
- Prepare for vendor changes — Ask your provider how they will notify you before updating IP ranges, certificates, or connector settings. Automatically applying such changes without warning can break mail flow silently.
- Define a rollback plan — If you ever need to remove the inline service, know which connectors, rules, and allow lists to clean up. An orphaned connector is a permanent risk.
Outlook: The Pressure Will Only Increase
Microsoft is investing heavily in its own AI-driven defenses, including native prompt injection protection for email and safeguards in Copilot. As these features mature, third-party vendors will need to prove they catch threats Microsoft misses—not just pile on redundant scanning. At the same time, regulatory pressure and sophisticated attacks will push more organizations toward defense-in-depth email strategies. The winners will be those that make layered security simple to manage, not just powerful on paper.
For now, the message is clear: an inline email security layer can still add real value, but only if it’s built and maintained with the same rigor as the Microsoft 365 boundaries it touches. If you haven’t audited your mail flow in the past year, this is the week to do it.