In short
Integrated cloud email security (ICES) is email protection that connects to Microsoft 365 or Google Workspace by API instead of through an MX change. It inspects mail after the built-in filtering, including internal mail, and can hold suspicious messages before delivery or remove them from every inbox afterwards. Many products also protect collaboration apps.
Get a quote for ICES (integrated cloud email security)
Tell us roughly how many users or sites you have and we will reply by email with options and a quote.
What ICES means
Integrated cloud email security, usually shortened to ICES, is an industry term for email security products that integrate with a cloud mail platform through its APIs. You will also see it called API-based email security. The idea is simple: rather than rerouting all mail through a third-party filter, you let a specialist product work inside the mail platform, alongside Microsoft's or Google's own protection.
ICES grew up as organisations moved to Microsoft 365 and Google Workspace. The platform providers' own filtering handles high-volume spam and known malware well, so ICES products concentrate on what gets past it: targeted phishing, impersonation, business email compromise and compromised accounts. They are designed to add to the built-in protection, not to replace it.
How an ICES connects to Microsoft 365 and Google Workspace
Deployment is an administrator consent rather than a mail-flow change:
- An administrator signs in to the vendor's console and grants the product permission to read and act on mailboxes in the Microsoft 365 or Google Workspace tenant
- The product discovers users and mailboxes, often syncing groups so policies can differ for finance, directors or shared mailboxes
- It starts inspecting mail as it arrives, after Microsoft's or Google's filtering, and can scan recent mail already in inboxes
- Policies decide what happens to a suspicious message: alert only, banner, move to junk or quarantine, or remove from every mailbox
Because MX records do not change, mail keeps flowing exactly as before and the product can be connected during working hours. It also means the built-in protection keeps running underneath, so the configuration of Exchange Online Protection and the Gmail settings in our Google Workspace email security hub still matter.
Monitor, post-delivery and inline modes
ICES products differ most in when they act. Ask any vendor which of these modes it supports and which it recommends.
| Mode | What happens | Trade-off |
|---|---|---|
| Monitor | The product inspects mail and reports what it would have caught, without touching delivery | Ideal for a trial; no protection until you switch to enforcement |
| Post-delivery (detect and remediate) | Mail is delivered, inspected as it arrives and removed from inboxes if found malicious; later re-scans can remove mail that turns bad | Simple and low risk to mail flow; a short window when a user could open the message |
| Inline | The product inspects each message after Microsoft's or Google's filter and before it reaches the inbox | Suspicious mail is held before anyone sees it; depends on the product supporting inline for your platform |
Examples from the products we supply: Check Point Email Security runs from monitor mode through to inline prevention without MX changes; TrendAI Vision One Email and Collaboration Security has an optional inline mode for Exchange Online and Gmail in its Essentials and Pro packages; FortiMail Workspace Security offers an inline method and a Microsoft Graph API method for Microsoft 365; IRONSCALES, Vade for M365, ThreatDown Email Security and Bitdefender in Microsoft 365 API mode concentrate on removing threats from every mailbox after delivery, and Bitdefender also has a monitor mode.
Not sure which option fits? Ask us
Tell us what you need and we will recommend the right option for your organisation, with a quote.
What an ICES sees that a gateway does not
Sitting inside the tenant gives an ICES a different view from a secure email gateway:
- Internal mail: messages between colleagues, which is how a compromised account spreads phishing inside the organisation
- Mailbox context: who normally writes to whom and how, which helps detect payload-free BEC attack messages and supplier impersonation
- Post-delivery removal: one action pulls a message out of every inbox, including copies users have already opened
- Account takeover signals: suspicious sign-ins, new inbox rules and unusual sending, linked to email account takeover detection in products such as IRONSCALES Email Protect Pro and Complete Protect, Check Point Email Security, Trend Micro and FortiMail Workspace Security
- Collaboration apps: files and links shared through Teams, SharePoint, OneDrive, Google Drive, Slack and other services, depending on the product
Check Point Email Security lists Teams, SharePoint, OneDrive, Google Drive, Slack, Box, Dropbox and ShareFile; Trend Micro covers Exchange Online, OneDrive, SharePoint, Teams, Google Workspace, Box and Dropbox; Acronis offers Collaboration Security for Teams, SharePoint and OneDrive; and FortiMail Workspace Security has a separate collaboration component.
Microsoft's ICES vendor ecosystem
Searches for "Microsoft integrated cloud email security" usually mean Microsoft's ICES Vendor Ecosystem for Defender for Office 365. According to Microsoft Learn, it lets approved third-party ICES vendors pass their verdicts to Defender for Office 365, so their detections appear in the Defender portal's quarantine, Threat Explorer, the email entity page, advanced hunting and reports. It needs Defender for Office 365 Plan 2 or Microsoft 365 E5, and only the vendors Microsoft lists are supported.
At the time of writing Microsoft lists four approved products, and none of the ICES products we supply is among them, so they keep their own consoles and quarantines. That is the normal arrangement for ICES and works well; it simply means agreeing which product quarantines what, so users and administrators are not confused. Microsoft's guidance also recommends keeping its Standard or Strict preset security policies on alongside any third-party layer, which matches what we advise. Our Microsoft 365 phishing protection guide covers those policies, and our sister site covers Microsoft Defender for Office 365.
Is ICES (integrated cloud email security) the right fit for you?
We will check it against your systems and requirements and recommend the right option.
ICES products we supply
| Product | How it runs | Microsoft 365 | Google Workspace | More detail |
|---|---|---|---|---|
| Check Point Email Security (formerly Harmony Email & Collaboration) | Monitor, detect and remediate, or inline prevention | Yes | Yes | Check Point Harmony UK |
| IRONSCALES | API with automatic remediation | Yes | Yes | IRONSCALES guide |
| FortiMail Workspace Security (formerly Perception Point) | ICES for email, plus browser and collaboration components | Yes | Yes | Perception Point guide |
| Acronis Email Security | API for Microsoft 365, no MX change | Yes | Supported; method confirmed at quote | Acronis Email Security |
| Vade for M365 | API with auto-remediation | Yes | Vade for Google Workspace, confirmed at quote | Vade for M365 |
| TrendAI Vision One Email and Collaboration Security | API; inline for Exchange Online and Gmail in Essentials and Pro | Yes | Yes | Trend Micro |
| Bitdefender GravityZone Extended Email Security | Microsoft 365 API with post-delivery remediation (or with MX perimeter) | Yes | Not by API; perimeter (MX) mode confirmed at quote | Bitdefender |
| ThreatDown Email Security | API, no MX change, no agents | Yes | Confirmed at quote | ThreatDown |
| Sophos Email | API integration with Microsoft 365, or gateway | Yes | Gateway mode | Sophos Email |
Compare these with gateways on email security platforms compared, or see IRONSCALES vs Avanan for two ICES products head to head.
Limits and what to check
ICES is not the answer to everything. Before choosing one, check:
- Continuity: an ICES cannot hold or deliver mail if Microsoft 365 or Google Workspace itself has an outage; gateways usually can
- The post-delivery window: in post-delivery mode a message can sit in an inbox briefly before removal; ask how quickly the product acts and whether inline is available
- Permissions: the product needs broad access to mailboxes; review what it requests and who in your organisation can change it
- On-premises mail: most ICES products are built for cloud mailboxes; a server of your own usually needs a gateway
- Outbound and encryption: few ICES products filter outbound mail or encrypt it; you may still want email DLP and a way to send secure email
Our ICES vs SEG comparison sets these against what a gateway offers and explains when to run both.
How we help
We can connect an ICES product to your tenant in monitoring mode where the product supports it, review what it would have caught alongside your existing protection, then agree which actions run automatically and which need approval before switching to enforcement. We can also review Microsoft's or Google's own settings, so the two layers work together, and help roll out the report button to staff.
Pricing depends on the product, package and number of users, so ask us for a quote. Contact us) to arrange an ICES trial.
How Forever Systems helps with email security
We are an independent UK IT and cyber security provider. We supply several email security platforms, so we can suggest what suits your mail system, your risks and your budget rather than pushing one product.
- Start with what you have: we can review the protection already built into Microsoft 365 or Google Workspace before suggesting anything extra
- Compare like for like: API-based protection, secure email gateways, encryption and DLP from the vendors we supply, explained in plain English
- Get authentication right: we help you plan SPF, DKIM, DMARC and MTA-STS so genuine mail is delivered and spoofed mail is not
- Deployment help: connecting a platform to Microsoft 365 or Google Workspace, mail routing changes and policy set-up, scoped at quote
- People and backup too: security awareness training, Check Point Harmony Email & Collaboration and Sophos from our specialist sites
Tell us about your mail system and we will suggest options, with pricing confirmed at quote.
Frequently asked questions
What is ICES in email security?
ICES stands for integrated cloud email security: email protection that connects to Microsoft 365 or Google Workspace by API rather than by changing MX records. It inspects mail after the platform's own filtering, including internal mail, and can hold suspicious messages or remove them from every inbox after delivery.
Is ICES better than a secure email gateway?
Neither is better in every case. ICES suits cloud mailboxes, internal mail, account takeover and collaboration apps, with no MX change. A gateway suits organisations that want continuity, outbound filtering, encryption or archiving from one product, or that run their own mail server. Some run both.
Does ICES replace Microsoft Defender for Office 365?
Usually not. ICES products are designed to work after Microsoft's filtering, so Exchange Online Protection or Defender for Office 365 keeps running underneath. Microsoft recommends keeping its preset security policies on alongside any third-party layer.
Does an ICES need MX record changes?
No. An ICES connects through the mail platform's APIs after an administrator grants consent, so mail routing and MX records stay as they are. That is why it can be trialled in monitoring mode without disrupting delivery.
Does ICES work with Google Workspace?
Many ICES products support Gmail. Of those we supply, Check Point Email Security, IRONSCALES, FortiMail Workspace Security and Trend Micro protect Google Workspace mailboxes without an MX change. Acronis Email Security also supports Google Workspace, and Vade makes a Google Workspace version; we confirm the deployment method and availability for those at quote.
Still have a question about ICES (integrated cloud email security)?
Ask us and a member of our team will reply by email.