MailGuard 365 Plan 1: a layer, not a replacement

What it is

A third party email security product that layers on top of Microsoft 365 rather than sitting in front of it. The vendor describes it as working inside Microsoft 365 and complementing Defender and Sentinel.

Who makes it

MailGuard Pty Limited. Microsoft's marketplace lists that company as the publisher and Pax8 carries a MailGuard 365 vendor page under the same name. It is not a Microsoft product, although it is transacted on the Microsoft commerce rail, which is why a third party product can appear under Microsoft in a partner catalogue.

How it deploys, and why that matters commercially

The vendor states that activation uses a Microsoft sign in, with no MX or DNS changes and no extra console.

That mechanism has a consequence worth being explicit about. Because mail routing is unchanged, messages still arrive through Microsoft's own path, so Exchange Online Protection continues to do its work and any Defender for Office 365 licence continues to be needed and billed. This is a layer added to the stack. It does not remove a line from the existing licence position, and a business case that assumes it does is wrong before it starts.

That is also the argument in its favour: nothing has to be unpicked to trial it, and nothing breaks if it is switched off. Confirm the claim against your own configuration during a trial, particularly if a gateway already sits in front of the tenant.

The tier structure

Four tiers, set by number of users rather than by feature set, each available monthly or annually.

• Plan 1, 1 to 100 users
• Plan 2, 101 to 2,000 users
• Plan 3, 2,001 to 10,000 users
• Plan 4, 10,000 users and above

Because the band follows headcount, the tier changes as an organisation grows rather than as its requirements change. Plan 4 addresses organisations well outside the range this practice serves.

What this page deliberately does not repeat

The vendor publishes comparative detection speed figures against Microsoft's native controls. We have not measured them, we have no way to verify them, and we do not restate them here.

Evaluate on a trial against your own mail flow and your own volumes, and compare what it catches against what your existing Defender licence already caught. That comparison is the only one that settles the purchase, and it is one you can run yourself.