Live Scanning
After activating the SaaS application, Email Security starts scanning all the files and emails for any threats in real-time.
The Overview page shows the security events found, if any. At the bottom of the overview screen, you can see the status of active scans of your SaaS applications. Depending on the amount of data, this stage may take time.
The number of active users may exceed the number of licensed users in the SaaS and does not necessarily reflect the number of Email Security licenses required.
Click Active users to review the list of users. This opens a query in the Custom Queries under Analytics tab.
For example, in Office 365, Shared Mailboxes do not require a separate license in Email Security but are counted as active users.
By default, after activating a SaaS application, policy gets created for threats (phishing and malware). For DLP, there is no default policy.