Policy Modes

Monitor only - Monitors the emails and creates the relevant event.
Detect and Remediate - Creates an event, and also performs retroactive enforcement for Inbound emails already delivered to users.
Protect (Inline) - All emails are reviewed before delivery to the user.

Monitor only and Detect and Remediate have the same configuration and are sometimes referred to as Detect modes in this document.

Note:

Best Practice - We recommend that you start with the configuration for Detect modes and later change to Protect (Inline). If you are already in one of the Detect modes and want to start with Protect (Inline) mode, skip to Step 7 - Protect (Inline) Protection Mode Policy Configuration on Avanan.

Note:

For the system to work properly, you must follow the steps in the order they appear.