Mimecast or Proofpoint to Defender for Office 365 Migration

No outage is planned and none is expected. The MX change is a staged DNS update per domain: mail simply starts arriving at Microsoft 365 directly instead of through the gateway, and during propagation both paths deliver. Defender policies have been protecting your users for days by that point, tuned on live traffic during coexistence — the cutover changes the mail path, not the protection. Rollback is pointing MX back at the still-active gateway.

Either works — they carry different Defender for Office 365 plans. Business Premium includes Plan 1: Safe Links, Safe Attachments, and anti-phishing with impersonation protection. E5 includes Plan 2, which adds Threat Explorer, automated investigation and response, and Attack Simulation Training. We verify exactly what your licensing includes in the first days and design policies to your plan; if you sit on Exchange Online Protection alone with no Defender plan, this migration is not the right fit yet and we will say so.

Nothing, in this engagement — and that is deliberate. Your archived mail stays in the vendor's store, and the decommission checklist explicitly warns against terminating archive access before you have decided what to do with that data. Exporting or migrating years of journaled mail is its own project with its own chain-of-custody and ingestion questions, and it is scoped separately. What this engagement does change is where retention happens going forward: new mail is governed by Microsoft Purview retention and Exchange Online archiving.

Honestly: nothing equivalent. Defender for Office 365 is a filtering and protection stack, not a continuity service — there is no standalone emergency mailbox that activates during a Microsoft 365 outage. You would be relying on Microsoft 365's own platform resilience. For some organizations that is acceptable; for others with hard continuity obligations, the right answer may be keeping the continuity component of the vendor subscription while migrating filtering. That is exactly the kind of decision the trade-off document exists to record.

We will not hand you a comparative catch-rate number — vendor benchmarks in this space are marketing artifacts, and we do not invent metrics. What we give you instead is your own data: during coexistence, Enhanced Filtering lets Defender evaluate the same live mail your gateway is filtering, and we read its verdicts with you before the MX moves. You see the false positives, the misses, and the tuning — on your traffic. That evidence, not a brochure claim, is what gates the cutover.

When mail routes through a gateway before reaching Microsoft 365, every message appears to come from the gateway's IP addresses — so Defender cannot evaluate the true sending infrastructure, and its spoof, phish, and connection verdicts degrade. Enhanced Filtering for Connectors (Microsoft's 'skip listing') tells Microsoft 365 which hops belong to your gateway so filtering looks past them to the original source. It is what makes an honest coexistence evaluation possible, and Microsoft's own migration guidance treats it as required.

After — never before — three things: the MX cutover is verified on every domain, the post-cutover tuning reading is done, and you have a decision about the archive. Cancelling early is the one genuinely destructive mistake in this migration: it deletes your rollback path and can strand archived mail behind a lapsed contract. Renewal timing is worth raising in the first call; if your renewal lands mid-project, we sequence around it.

The gateway's quarantine digest disappears and Microsoft's quarantine notifications take its place — different look, same job, and the user communications we prepare cover it. Users get a supported way to report suspicious messages that routes where you want reports to go. Links in mail may show Safe Links wrapping. That is roughly the whole visible surface; mailboxes, addresses, and Outlook stay untouched.

Differently, and this is one of the granularity trade-offs we document rather than hide. Defender handles bulk mail through a bulk complaint threshold you can tune per policy, plus user-level allow and block. Gateway-style managed newsletter digests and per-sender subscription workflows do not have an exact twin. For most organizations the bulk threshold tuned during the pilot lands well; if graymail management is a feature your users actively love, it goes in the trade-off document as a named consideration before cutover.

Split architectures are technically possible and occasionally justified — an outbound DLP or encryption dependency, for instance — but they keep a hop, a contract, and a set of failure modes alive, which is usually what this migration was meant to end. If something outbound genuinely needs the gateway, we will document it in the trade-off analysis with options: replicate it in Microsoft 365, keep a narrow vendor component, or scope follow-on work. The default destination is full consolidation with MX and outbound both direct.

Removing the gateway from the inbound path does not by itself break outbound authentication, but gateway-era records often carry vendor includes and outbound-relay assumptions worth cleaning up — and if the gateway signed DKIM on your behalf outbound, signing needs to be verified as Microsoft 365's. We check that your mail still authenticates correctly after cutover. A full authentication build-out — SPF restructuring, DKIM across all sending services, a monitored DMARC enforcement ramp — is the separate DMARC, DKIM, and SPF implementation engagement, and gateway removal is a natural moment to do it.

It is Microsoft's published path — the Defender for Office 365 documentation describes exactly this three-phase migration from a third-party protection service: prepare, set up with Enhanced Filtering and a pilot on preset policies, then onboard with an MX cutover once the pilot proves out. Our engagement adds the parts Microsoft's generic guidance cannot: your gateway's specific policy mapping, the user communications, the contract-timing guardrails, and the written trade-off document.