How does Microsoft Exchange Online + EOP + Defender for Office 365 compare to Google Workspace Gmail Enterprise?
Google Workspace Gmail Enterprise ships strong inbound spam and phishing analytics through the Google ML pipeline, native data loss prevention, and the Vault eDiscovery surface. Strengths against Microsoft are the simplicity of a single-product collaboration suite and the Google Search-anchored inbox classification. Weaknesses against the Microsoft mail-protection stack for the F500 cohort are (1) the lighter native integration with the Microsoft endpoint, identity, and CASB planes — Defender XDR fuses email, endpoint, identity, SaaS, and vulnerability signal into one incident graph that Gmail Enterprise cannot match for Microsoft-anchored estates; (2) the absence of a regulated-industry journaling archive ecosystem at the Smarsh and Global Relay maturity Microsoft mail enjoys for SEC 17a-4, FINRA, and FFIEC supervisory review; (3) the lighter line-of-business integration surface — Microsoft Graph mail/calendar/contacts is the canonical enterprise API surface and the SaaS ecosystem (Power Automate, Power Apps, Dataverse) assumes Exchange Online identity. Gmail Enterprise wins for Google-anchored estates and digital-native organizations under 5,000 seats. Exchange Online + EOP + MDO wins for the Microsoft 365 E3/E5 customer base.
How does Defender for Office 365 compare to Proofpoint Email Protection + Targeted Attack Protection (TAP)?
Proofpoint is the dominant pure-play secure email gateway (SEG). Strengths include the threat-intelligence depth of the Proofpoint cloud, the maturity of the impersonation detection model, and the Targeted Attack Protection investigation surface. Weaknesses against MDO P2 for Microsoft-anchored enterprises are (1) the cost stack — Proofpoint Email Protection plus TAP plus Email Fraud Defense plus Archive runs $20 to $40 per user per year above the M365 E5 Security bundle that already includes MDO P2; (2) the absence of integrated CASB, ITDR, and endpoint correlation — every Proofpoint alert exists in a separate analyst surface from the customer endpoint, identity, and SaaS plane; (3) the M&A consolidation friction — the EPC Group M&A integration playbook routinely retires Proofpoint inside the close+18 month window. Proofpoint wins for non-Microsoft-anchored estates or for very-high-volume regulated industries where the dual-stack overlap is mandated. MDO P2 wins for the Microsoft 365 E5 customer base on consolidation economics and on the cross-domain XDR investigation surface.
How does Defender for Office 365 compare to Mimecast?
Mimecast is the dominant SEG in the UK and ANZ markets with a strong U.S. mid-market presence. Strengths include the URL-protection maturity, the Targeted Threat Protection module, the Brand Protection module for outbound DMARC enforcement and lookalike domain monitoring, and the archive depth for regulated industries. Weaknesses against MDO P2 for Microsoft-anchored enterprises are (1) the SEG-in-front-of-EOP architectural friction — Mimecast becomes the primary inbound MX endpoint with EOP downstream, complicating the Microsoft Defender XDR fusion of email + endpoint + identity + SaaS signal; (2) the duplicate-license cost stack against M365 E5 Security; (3) the EPC Group M&A integration pattern routinely retires Mimecast inside the consolidation window for the same reasons it retires Proofpoint. Mimecast remains defensible for UK and ANZ regulated estates and for customers where the Brand Protection lookalike-domain monitoring is the load-bearing capability. MDO P2 wins for the Microsoft 365 E5 customer base on consolidation economics and on the cross-domain XDR investigation surface.
When does MDO Plan 1 suffice and when is MDO Plan 2 required?
MDO P1 ships the pre-delivery protection plane — Safe Attachments sandbox detonation, Safe Links time-of-click URL detonation, and anti-phish impersonation protection. P1 suffices for organizations under approximately 2,000 seats where the security operations function does not run dedicated email-borne incident investigation, where the AIR playbook engine is not load-bearing, and where the absence of Threat Explorer historical investigation is acceptable. MDO P2 adds the investigation, hunting, and training plane — Threat Explorer, AIR, Attack Simulation Training, Campaign View, the advanced hunting EmailEvents/UrlClickEvents/EmailAttachmentInfo tables, and the Defender XDR cross-domain correlation. P2 is the pragmatic floor for any enterprise above 2,000 seats with material BEC, phishing, or supply-chain exposure, for any regulated industry running supervisory review, and for any customer who has standardized on Microsoft 365 E5 or M365 E5 Security. EPC Group recommends the MDO P2 plane through the M365 E5 Security bundle for every enterprise above 2,000 seats.
What are the Exchange Online mailbox size limits, archive limits, and message limits?
Mailbox size — Plan 1 ships a 50 GB primary mailbox, Plan 2 ships a 100 GB primary mailbox plus auto-expanding archive up to 1.5 TB in 100 GB increments. Shared mailboxes — 50 GB free of license; assign a Plan 2 license for the 100 GB ceiling. Resource mailboxes (room and equipment) — 50 GB without separate license. Message limits — 150 MB attachment limit (recipient and sender), 500 recipients per message envelope, 1,000 messages per minute per mailbox SMTP submission limit, 10,000 recipients per day per mailbox external send limit (the anti-spoof and anti-spam threshold). Public-folder limits — 1 TB per tenant total, 1 GB per public folder by default with override available, 250,000 public folders per tenant. The auto-expanding archive grows in 100 GB increments only when the user has been mail-active for at least 30 days, which is the canonical archive growth gotcha for M&A migrations.
What is the difference between Litigation Hold, In-Place Hold, and Microsoft Purview Retention Policies?
Litigation Hold is the mailbox-wide preservation surface — once enabled, every item in the mailbox (including soft-deleted items and items modified after the hold is placed) is preserved indefinitely or until the hold is removed. Litigation Hold requires Exchange Online Plan 2 and is the simplest preservation pattern for legal-hold scenarios. In-Place Hold is the query-scoped preservation surface — preserves only items matching a specified KQL query (sender, recipient, date range, keyword, attachment type). In-Place Hold is being deprecated in favor of Microsoft Purview eDiscovery hold and Microsoft Purview retention policies. Microsoft Purview Retention Policies are the unified retention surface across Exchange Online, SharePoint Online, OneDrive, Teams chat, Teams channel, and Yammer — scoped through retention labels and adaptive policy scopes (department, location, role). Retention policies are the canonical retention pattern post-2024; In-Place Hold is for legacy preservation only. EPC Group ships Litigation Hold for active legal-hold cases plus Microsoft Purview retention policies for the steady-state retention floor; the two preservation models coexist without conflict.
How does EPC Group sequence the SPF, DKIM, DMARC deployment and DMARC enforcement progression?
EPC Group ships the canonical three-stage DMARC enforcement progression. Stage one — p=none with RUA aggregate reporting enabled (rua=mailto:dmarc@customer.com). Stage one runs for 60 to 90 days to inventory every legitimate sender across the customer estate, fix SPF includes for every legitimate Marketing Cloud, transactional email service, and partner-domain sender, deploy the dual-selector DKIM rotation (selector1 and selector2), and triage every unauthenticated source surfaced in the RUA reports. Stage two — p=quarantine with pct=25 ramping to pct=100 over 60 days. Stage two triages quarantine-routed legitimate mail and tunes SPF and DKIM until the legitimate fail rate is under 1 percent. Stage three — p=reject. Stage three runs steady-state with the RUA aggregate review as the ongoing change-detection plane. The full progression runs six to nine months for a Fortune 500 with a complex marketing automation footprint. EPC Group ships the staged progression as a fixed-fee deliverable inside the Phase 2 Foundation work.
How does Exchange Online + EOP + MDO integrate with Microsoft Sentinel, Microsoft Purview, and Microsoft Defender XDR?
MDO email signal feeds Microsoft Defender XDR through the native incident graph — every MDO incident appears in security.microsoft.com alongside MDE endpoint, MDCA SaaS, MDI on-prem AD, and MDVM vulnerability signal. The advanced hunting EmailEvents, EmailAttachmentInfo, EmailUrlInfo, EmailPostDeliveryEvents, and UrlClickEvents tables are joinable in KQL against DeviceProcessEvents, IdentityLogonEvents, and CloudAppEvents — the cross-domain hunt is one query, not three. Microsoft Sentinel pulls the MDO incident stream through the native Defender XDR data connector for SIEM-native correlation with non-Microsoft logs and SOAR playbook orchestration. Microsoft Purview Communication Compliance pulls Exchange Online + Teams + Yammer signal for supervisory review. Microsoft Purview DLP enforces policy at the Exchange Online transport layer for outbound data loss prevention. The four-product integration loop (Exchange Online + Defender XDR + Sentinel + Purview) is the Microsoft 365 reference architecture for the F500 customer base and is the practical deployment pattern EPC Group ships across every managed Exchange Online engagement.