Activating Office 365 Mail

To protect Office 365 Mail, Avanan uses Avanan Cloud Security Platform - Emails V2 enterprise application that is automatically added to your Microsoft Azure cloud platform.

As a prerequisite to activate Office 365, make sure you have these:

  • You are a user with Privileged Role Administrator role or higher permissions, or you have the credentials of such a user.

  • You have the minimum supported SaaS license. See Minimum License Requirements to Activate SaaS Applications.

  • If some mailboxes are on an on-premises Exchange server, see Appendix H: Activating Office 365 Mail in Hybrid Environments.

  • When onboarding, Avanan assumes the Exchange Administrator role. To ensure successful onboarding, do not change the default permissions assigned to the Exchange Administrator role.

    Note:

    If you modify the default permissions of Exchange RBAC role groups or the Microsoft Entra ID role permissions assigned to the Exchange Administrator role, the system does not support onboarding, and it may fail.

  • If another Avanan tenant is currently connected to your Microsoft 365 account, all security settings in the Check Point Portal override the existing tenant's settings and become the only protection for that Microsoft 365 account. If you want to manage different parts of the Microsoft 365 account from two tenants, see Connecting Multiple Portals to the Same Microsoft 365 Account.

To activate Office 365 Mail:

  1. From the Getting Started Wizard click Start for Office 365 Mail.

    or

    Navigate to Security Settings > SaaS Applications and click Start for Office 365 Mail.

  2. Select the mode of operation for Office 365.

    • Automatic mode

      Avanan performs the necessary configurations to your Microsoft 365 environment and operates in Monitor only mode. For more information, see Automatic Mode Onboarding - Microsoft 365 Footprint.

    • Manual mode

      You must manually perform the necessary configurations in the Office 365 Admin Exchange Center before you bind the application to your Office 365 email account and every time you add or edit the security policy associated with Office 365 emails. For more information, see Appendix A: Avanan Manual Integration with Office 365.

    Note:

    If you are a FedRAMP customer, manual onboarding is not supported for GCC High and DoD licenses in Azure Government.

    Avanan recommends using Automatic mode, allowing better maintenance, management, and smoother user experience. Before using the Manual mode, contact Avanan Support to help resolve any issues raised with the Automatic mode for onboarding.

  3. In the Office 365 License section, select the required license type.

    • GCC High / DoD - For Azure Government

    • Office 365 / GCC (Excluding GCC High) - For Azure Commercial

  4. Enable the I Accept Terms Of Service checkbox.
  5. If you need to limit the license consumption and protection to a specific group of users or to connect multiple Avanan tenants to the same Microsoft 365 account:
    1. Enable the Restrict inspection to a specific group (Groups Filter) checkbox and click OK.
    2. In the Office 365 Authorization window that appears, sign in with a user with Privileged Role Administrator role or higher permissions.

      In the authorization screen, click Accept to grant permissions for Avanan Cloud Security Platform - Emails V2 application.

      To view the permitted IP addresses to access this application, see Appendix I: Permitted IP Addresses to access the Avanan Azure Application.

    3. In the Office 365 Mail - Group Selection pop-up, select Specific group.
    4. Enter the group name you need to protect with Avanan.
      Note:

      The group name must have an associated email address.

      Avanan supports these groups for group filtering:

      • Assigned Membership:

        • Microsoft 365 Group

        • Mail-enabled Security Group

        • Distribution List

      • Dynamic Membership:

        • Microsoft 365 Group

    5. If you need to connect multiple Avanan tenants to the same Microsoft 365 account, enable the Multiple portals will be connected to this Office 365 account checkbox.
      CAUTION:

      Before you enable the checkbox, see Connecting Multiple Portals to the Same Microsoft 365 Account.

    6. Click OK.

Now, the Office 365 Mail SaaS is enabled and monitoring begins immediately.

Note:

To scan auto-forwarded messages through Microsoft 365, contact Avanan Support.

Note:

By default, Monitor only mode is assigned for all the SaaS applications you connect to. This allows you to immediately see the value that Avanan brings as it recognizes security incidents that occurred before on your SaaS platform. To configure email protection, see Threat Detection Policy.