In short: Microsoft Defender for Office 365 is Microsoft's own protection, built into Microsoft 365 mail flow and the Defender portal. Check Point Harmony Email & Collaboration, now named Check Point Email Security, is a third-party layer that connects by API, inspects mail after Microsoft's filtering and before the inbox, and covers Google Workspace, Slack and file-sharing apps. Many organisations run both.
At a glance
| Microsoft Defender for Office 365 | Check Point Harmony Email & Collaboration | |
|---|---|---|
| What it is | Microsoft's email and collaboration security, on top of Exchange Online Protection | Check Point's API-based email and collaboration security (originally Avanan; officially Check Point Email Security since March 2026) |
| Architecture | Native: part of Microsoft 365 mail flow | Connected by API inside the tenant, no MX change |
| When it acts | During Microsoft's own processing, with zero-hour auto purge afterwards | Monitor mode, Detect & Remediate after delivery, or inline prevention after Microsoft's filtering and before the inbox |
| Microsoft 365 email | Yes | Yes, including internal mail between users |
| Teams, SharePoint, OneDrive | Yes (Safe Links and Safe Attachments in Plan 1) | Yes, with Email & Collaboration coverage |
| Google Workspace | No | Yes |
| Slack, Box, Dropbox, ShareFile | No | Yes, with Email & Collaboration coverage |
| Investigation and response | Plan 1: Real-time detections. Plan 2: Threat Explorer, automated investigation and response, advanced hunting in Defender XDR | Check Point portal with its own investigation and quarantine tools; optional Incident Response as a Service add-on |
| Data loss prevention | Through Microsoft Purview DLP rather than Defender itself | Included in the Complete Protect package, not in Advanced Protect |
| How it is licensed | Per user, in bundles (Plan 1 in Business Premium and E3, Plan 2 in E5) or as an add-on | By package (Advanced Protect or Complete Protect) and coverage (Email Only, or Email & Collaboration) |
Native protection vs an API layer
Defender for Office 365 is part of Microsoft's own service. There is nothing to connect, policies are managed in the Defender portal alongside your other Microsoft security, and its alerts become incidents in Microsoft Defender XDR together with endpoint and identity signals. Plan 1 brings Safe Links, Safe Attachments and impersonation protection; Plan 2 adds Threat Explorer, automated investigation and response, advanced hunting and attack simulation. Our Defender for Office 365 guide covers the plans.
Harmony Email & Collaboration connects to Microsoft 365 or Google Workspace by API after an administrator grants consent. Microsoft's or Google's own filtering still runs first; Check Point then applies its own detection, including URL emulation, sandboxing and attachment sanitisation, to each message, including internal mail. Because it does not depend on Microsoft's detection, it gives you a second, independent opinion on every message rather than a stronger version of the same one.
Neither approach means changing MX records, which is why running them together is common.
Inline, pre-delivery behaviour
The question buyers most often ask is whether a malicious message can reach the inbox before it is removed.
- Defender for Office 365 acts as Microsoft processes the message. Safe Attachments can hold a message while an attachment is detonated, Safe Links checks URLs at the time of click, and zero-hour auto purge removes messages later found to be malicious.
- Harmony Email & Collaboration can run in a monitor mode, where it reports what it would have caught without touching mail flow, in a post-delivery Detect & Remediate mode, or in inline prevention, where Check Point inspects each message before it reaches the inbox so suspicious mail is held before the user ever sees it. For Microsoft 365, Detect & Remediate and inline prevention can be combined.
Most organisations start Harmony in monitor mode for a short trial, compare its findings with what Defender caught, and then switch to prevention.
Coverage beyond email
If everything you use is Microsoft 365, both products can cover email, Teams, SharePoint and OneDrive; on the Check Point side the collaboration apps need the Email & Collaboration coverage option rather than Email Only. The difference shows when you use anything else.
| App or platform | Defender for Office 365 | Harmony Email & Collaboration |
|---|---|---|
| Exchange Online mail | Yes | Yes |
| Microsoft Teams | Yes | Yes |
| SharePoint and OneDrive | Yes | Yes |
| Gmail and Google Drive (Google Workspace) | No | Yes |
| Slack | No | Yes |
| Box, Dropbox, ShareFile | No | Yes |
Organisations that run Google Workspace, or a mix of Microsoft 365 and Slack, get one policy and one console from Harmony rather than separate tools for each app. Check Point sells it in two packages, Advanced Protect and Complete Protect, where Complete Protect adds data loss prevention. It also sells add-ons on the same platform, including archiving, DMARC management, security awareness training, SaaS security posture management and an incident response service, which are covered on Check Point Harmony UK.
Management, licensing and running both together
Defender for Office 365 suits teams who already live in the Defender portal: one set of incidents, one hunting language and one licence relationship with Microsoft. If you own Business Premium you already have Plan 1, and Plan 2 features are available through the Microsoft Defender Suite add-on. Harmony adds a second console, but also a second detection engine and coverage for non-Microsoft apps.
Running both is a deliberate, common design rather than duplication. A typical pattern is:
- Keep Exchange Online Protection and Defender for Office 365 configured with the preset security policies
- Connect Harmony Email & Collaboration by API in monitor mode and compare findings for a few weeks
- Switch Harmony to inline prevention and agree which product quarantines what, so users are not confused
- Route user-reported phishing to one place and make sure someone triages it, either your team or a managed service
Pricing for both depends on what you already own, the package and the coverage you need, so ask us for a quote.
Which should you choose?
There is no single right answer, but the pattern is consistent:
- Defender for Office 365 alone suits Microsoft-only organisations that already own it, configure it well and have someone, internal or managed, using the Defender portal. It is the natural choice when you want everything in Microsoft Defender XDR.
- Harmony Email & Collaboration alongside Defender suits organisations heavily targeted by phishing and invoice fraud, those who want an independent second engine and inline prevention, and those with sensitive data shared through collaboration apps.
- Harmony as the main layer suits Google Workspace organisations, mixed Microsoft and Google estates, and businesses using Slack or third-party file sharing, where Defender cannot reach.
Whichever you choose, configuration matters more than the logo: preset policies, impersonation protection, an enforced DMARC policy and a tested process for user reports. For other approaches, see the options on our email security hub.
How we help
We are independent and supply both, so we can run a fair comparison on your own mail. We review your current Defender configuration, connect Harmony in monitor mode for a trial, show you side by side what each caught, and then recommend Defender alone, Harmony alone or both, with a clear licensing plan.
Contact us to arrange a side-by-side trial.
How Forever Systems helps with cloud security
We are an independent UK IT and cyber security provider. We supply and support a wide range of security platforms, so we recommend what fits your organisation rather than one vendor's answer to everything.
- Assess first: we review what you already own, especially your Microsoft 365 licences, before suggesting anything new
- Vendor-aware advice across secure access, email, identity, data protection, endpoint, MDR, cloud infrastructure, browser, AI and backup, including Cisco Secure, Check Point Harmony and Sophos
- Deployment and migration from a UK team, from tenant hardening to replacing a VPN or an endpoint product
- Ongoing support: policy tuning, alert handling, renewals and regular reviews
- People and certification too: security awareness training and Cyber Essentials
We work with businesses, schools, charities and public sector organisations.
Want an independent view of your cloud security?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Does Harmony Email & Collaboration replace Defender for Office 365?
It can, but it does not have to. Harmony connects by API and inspects mail after Microsoft's filtering, so it works alongside Defender for Office 365. Some organisations use it instead of buying Defender Plan 2; others keep Defender for its integration with Microsoft Defender XDR and add Harmony as a second engine.
Is Harmony Email & Collaboration the same as Avanan?
Yes. Check Point acquired Avanan in 2021 and its technology became Harmony Email & Office, then Harmony Email & Collaboration. In March 2026 Check Point renamed it Check Point Email Security. It is the same product, and it still connects to Microsoft 365 and Google Workspace by API.
What is Check Point Email Security?
Check Point Email Security is the name Check Point has used since 25 March 2026 for Harmony Email & Collaboration. Check Point describes it as a change of name: the protection and the portal are the same, so everything on this page applies under either name.
Do I need to change MX records for either product?
No. Defender for Office 365 is part of Microsoft 365 mail flow, and Harmony Email & Collaboration connects by API inside the tenant, so neither requires an MX change.
Can Defender for Office 365 protect Google Workspace?
No. Defender for Office 365 protects Microsoft 365 email and the Microsoft collaboration apps. For Gmail and Google Drive you need Google's own protection or a third-party product such as Harmony Email & Collaboration.
Which is better for a small business on Business Premium?
Start by configuring the Defender for Office 365 Plan 1 you already own, which is also included in Microsoft 365 E3. If you still see targeted phishing or invoice fraud getting through, or you use Google Workspace or Slack too, a trial of Harmony in monitor mode will show whether a second layer adds value.