Skip to content

[Email Security] Differences between deployments #22060

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
wants to merge 2 commits into
base: production
Choose a base branch
from
Draft

[Email Security] Differences between deployments #22060

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
b2e1ae1
[Email Security] Differences between deployments
Maddy-Cloudflare Apr 29, 2025
62054ba
Updating setup with: better language and structure
Maddy-Cloudflare May 2, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
53 changes: 30 additions & 23 deletions src/content/docs/cloudflare-one/email-security/setup/index.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,44 +5,51 @@ sidebar:
order: 1
---

import { DirectoryListing } from "~/components"
You can deploy Email Security via:

You can set up Email Security via:
- [Microsoft Graph API](/cloudflare-one/email-security/setup/post-delivery-deployment/api/)
- [BCC](/cloudflare-one/email-security/setup/post-delivery-deployment/bcc-journaling/bcc-setup/gmail-bcc-setup/gmail-bcc-setup/)/[Journaling](/cloudflare-one/email-security/setup/post-delivery-deployment/bcc-journaling/journaling-setup/office365-journaling/)
- [MX/Inline](/cloudflare-one/email-security/setup/pre-delivery-deployment/mx-inline-deployment-setup/)

<DirectoryListing />
When you set up an integration, you will be able to:

## Post-delivery deployment
- Configure [auto-move events](/cloudflare-one/email-security/auto-moves/).
- [Synchronize a directory](/cloudflare-one/email-security/directories/).
- Auto pull EMLs for [reclassification](/cloudflare-one/email-security/email-monitoring/search-email/#reclassify-messages) whose disposition is "None".
- Manually move messages to different inboxes.

With post-delivery deployment, Email Security scans emails **after** they reach users' inbox.
With Microsoft Graph API and BCC/Journaling, Cloudflare scans emails after they reach a users' inbox. MX/Inline instead scans emails before they reach users' inbox.

Post-delivery deployment includes [Microsoft Graph API](/cloudflare-one/email-security/setup/post-delivery-deployment/api/) and [BCC](/cloudflare-one/email-security/setup/post-delivery-deployment/bcc-journaling/bcc-setup/gmail-bcc-setup/gmail-bcc-setup/)/[Journaling](/cloudflare-one/email-security/setup/post-delivery-deployment/bcc-journaling/journaling-setup/office365-journaling/).
## Microsoft Graph API

With Microsoft Graph API, you authorize Email Security to scan domains via your email provider credentials. With BCC/Journaling, you send messages to Email Security via BCC or Journaling configurations within your email provider.
When you deploy Email Security via Microsoft Graph API, you authorize Email Security to scan domains via your email provider credentials.

When you set up Microsoft Graph API, you get access to the following features:
When you deploy Email Security via Microsoft Graph API:

- Auto-moves.
- Directory synchronization.
- Post-delivery response / Phish submission response.
- Auto pull EMLs for [reclassification](/cloudflare-one/email-security/email-monitoring/search-email/#reclassify-messages) whose disposition is "None".
- Manually move messages to different inboxes.
- You authorize Email Security to scan domains via your email provider credentials.
- Microsoft Graph API requires minimal configuration effort.
- Your email inbox is moderately protected.
- Email Security gets API access into your tenant.

If you set up Email Security via BCC/Journaling and you want to access the features listed above, you will need to [associate an integration](/cloudflare-one/email-security/setup/post-delivery-deployment/bcc-journaling/bcc-setup/gmail-bcc-setup/enable-auto-moves/).
## BCC/Journaling

## Pre-delivery deployment
When you deploy Email Security via BCC/Journaling:

With pre-delivery deployment, Email Security scans emails **before** they reach users' inbox.
- You send messages to Email Security via BCC or Journaling configurations within your email provider.
- BCC/Journaling requires moderate configuration effort.
- Your email inbox has the lowest level of protection.
- Email Security receives copies of your email.

MX/Inline allows you to send messages to Email Security to scan before they reach your users' inbox. You may need to update your MX records.
## MX/Inline

With MX/Inline, you will not be able to auto-move emails.
When you deploy Email Security via MX/Inline:

However, you will need to associate an integration to access the following features:
- You send messages to Email Security to scan before they reach your users' inbox. You may need to update your MX records.
- MX/Inline requires significant configuration effort.
- Your email inbox has the highest level of protection.
- Email Security has partial access to your mail stream.

- Directory synchronization.
- Post-delivery response / Phish submission response.
- Auto pull EMLs for reclassification for disposition "None".
- Manually move messages.
With MX/Inline, you will not be able to auto-move emails.

### Associate an integration

Expand Down