Free tools Windows power users keep installed
One-click scans. No signup required.
Cloudflare can add a separate email-security and Zero Trust layer to Microsoft 365, but it does not replace Microsoft’s native protections. Its Email Security service can inspect mail after delivery through Microsoft Graph or journaling, or before delivery through MX/Inline routing. The right design depends on whether you prioritize minimal mail-flow change, pre-delivery blocking, tighter remediation, or a smaller permissions footprint.
What Cloudflare adds to Microsoft 365
Microsoft 365 already includes Microsoft-managed identity, mail-flow and threat-protection controls. Cloudflare’s documented role is an additional cloud email-security layer, with related access and data-loss-prevention integrations. Cloudflare describes these capabilities in its product documentation; the material does not provide an independent attack-reduction rate, detection benchmark or return-on-investment figure.
As an Amazon Associate I earn from qualifying purchases.
Email Security can analyze Microsoft 365 messages through three broad deployment patterns:
Recommended Free Tools
- Graph API: scans messages after they arrive in users’ inboxes.
- Journaling: forwards copies of incoming and outgoing messages for post-delivery analysis.
- MX/Inline: routes mail through Cloudflare before Microsoft 365 delivery for pre-delivery enforcement.
These are different mail architectures, not interchangeable setup labels.
#1 Best Overall
- 【Up to 1100 Mbps VPN Speed 】 Hardware-accelerated WireGuard and OpenVPN-DCO deliver up to 1100 Mbps VPN throughput, over 3× faster than Brume 2 for smooth remote access and file transfers.
- 【Three 2.5G Ports & Multi-WAN】Tri-port 2.5GbE design with flexible WAN LAN configuration supports multi-gigabit wired setups, dual-ISP Multi-WAN and failover to keep home and SOHO networks online.
- 【Stealth VPN Obfuscation】VPN obfuscation disguises VPN traffic as regular HTTPS, helping you evade blocking, bypass restrictive networks and maintain stable, private connections.
- 【DPI protection】Deep Packet Inspection with visual dashboards blocks adult/gambling/malicious sites, while SQM and QoS prioritize gaming, calls, and video when bandwidth is tight
- 【OpenWrt & USB 3.0 Expansion】OpenWrt with 1GB DDR4 and 8GB eMMC lets you install plugins and build VPN, ad-blocking or NAS, while USB 3.0 Type‑C connects high-speed storage or 4G/5G dongles
API, journaling and MX/Inline: the practical differences
| Deployment | When scanning occurs | Mail-flow and DNS impact | Permissions or dependencies | Documented enforcement characteristics | Main operational concern |
|---|---|---|---|---|---|
| Microsoft Graph API | After a message reaches the mailbox | Can avoid mail-flow changes | Microsoft Graph and read/write mailbox access are required | Post-delivery actions such as deletion or moving a message; it is not an inline quarantine or modification path | Graph outages can increase message dwell time; API throttling is possible |
| Journaling | After delivery, using copies of mail | Requires a Microsoft Purview journal rule | Microsoft 365 journaling configuration | Post-delivery analysis and actions on the delivered message or copy | Protection occurs after the original delivery |
| MX/Inline | Before Microsoft 365 delivery | Changes routing and MX records | Cloudflare routing plus Microsoft 365 connector and TLS controls | Inline blocking, quarantine or modification as documented by Cloudflare | Incorrect sequencing or bypass controls can disrupt production mail |
Cloudflare’s deployment overview identifies API as an easy starting point, but “easiest” is not the same as “best.” Choose according to your required inspection point, acceptable permissions, change window and remediation goals. See Cloudflare’s deployment overview, API deployment documentation and Microsoft 365 MX guidance.
How to set up the Microsoft Graph API integration
Cloudflare lists a Cloudflare account, a Zero Trust organization and a protected domain as prerequisites. Its setup flow is:
- Open Cloudflare Zero Trust and go to Email Security’s post-delivery deployment options.
- Select Microsoft Graph API and start the Microsoft sign-in authorization.
- Review the requested Microsoft Graph permissions, including read/write access to the mailboxes that Cloudflare will protect.
- Approve the authorization in the appropriate Microsoft 365 tenant.
- Connect and verify the protected domain, then confirm that messages are being analyzed.
The current Cloudflare procedure is documented at Set up with Microsoft 365. Because this method depends on Graph availability and permission scope, involve the Microsoft 365 identity administrator before granting access.
Rank #2
- Compact and Efficient Design: The FortiGate 40F is designed for small to mid-sized businesses and enterprise branch offices, featuring a compact, fanless desktop form factor that ensures quiet operation and minimizes space usage.
- Robust Connectivity Options: Equipped with 5 GE RJ45 ports, including 1 WAN port and 4 internal ports, this model provides essential connectivity and flexibility for various network configurations in a small-scale environment.
- High-Performance Security: Offers up to 1 Gbps IPS throughput and 600 Mbps threat protection throughput, using Fortinet’s purpose-built security processor technology to deliver industry-leading performance and protection for SSL encrypted traffic.
- Advanced Threat Protection: Integrated with Fortinet’s AI-powered FortiGuard Labs, the FortiGate 40F offers comprehensive cybersecurity, identifying and mitigating both known and unknown threats to maintain robust security across your network.
- Simplified Management and Deployment: Features a user-friendly management console that provides comprehensive network automation and visibility, coupled with Zero Touch Integration with Fortinet’s Security Fabric for easy deployment.
API limitations administrators should plan for
- A Microsoft Graph outage can lengthen the time a message remains available before analysis.
- Microsoft Graph throttling can affect processing at higher volumes.
- Read/write mailbox permission is necessary, so access governance and tenant consent must be considered.
- API mode does not provide inline blocking, quarantine or arbitrary message modification. Cloudflare’s post-delivery actions are limited to operations such as deleting or moving a delivered message.
When journaling is the better fit
Journaling sends a copy of every incoming and outgoing email to Cloudflare for analysis. In Microsoft Purview, an administrator creates a journal rule that forwards those copies. This preserves the organization’s existing delivery path, but inspection still happens after the original message has reached Microsoft 365. Follow Cloudflare’s Microsoft 365 journaling setup for the current rule and routing requirements.
Journaling is therefore useful when an organization wants broad message visibility without changing public MX records, yet accepts the delay and post-delivery nature of analysis.
When MX/Inline deployment is justified
MX/Inline sends inbound mail through Cloudflare before Microsoft 365 accepts it. That positioning enables the pre-delivery controls Cloudflare documents, including blocking, quarantine and message modification. The trade-off is a DNS and mail-routing change that must be tested with existing connectors, third-party senders and outbound paths.
Rank #3
- SonicWall TZ270W Appliance Only - No Service Subscription (02-SSC-2823) - Combines enterprise-grade firewalling with integrated 802.11ac Wave 2 Wi-Fi to deliver secure wired and wireless connectivity in one compact device for small offices and clinics.
- Blocks zero-day threats and ransomware with Capture ATP sandboxing enhanced by RTDMI, plus IPS and anti-malware scanning for layered protection.
- Eliminates the need for separate access points in smaller spaces thanks to built-in high-speed wireless that is simple to deploy and manage.
- Supports VPN, SD-WAN, and TLS 1.3 decryption to secure hybrid cloud access and remote workers while maintaining usability and performance.
- Delivers gigabit performance with up to 750,000 concurrent connections to handle growth in users, devices, and SaaS applications.
Preventing a direct-to-Microsoft 365 bypass
If Microsoft 365 continues accepting mail directly from the internet, an attacker could bypass the Cloudflare inspection point. Cloudflare recommends restricting inbound acceptance to messages arriving from Email Security over TLS. Its deployment instruction includes a critical sequencing safeguard: wait 72 hours after every organization domain is onboarded and its MX records point to Email Security before enforcing the restriction. Applying the connector earlier can interrupt legitimate mail. The exact recommendation is in Cloudflare’s Microsoft 365 as MX Record documentation.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Administrator checklist before choosing a mode
- Inspection point: Decide whether post-delivery analysis is acceptable or whether suspicious mail must be stopped before Microsoft 365 delivery.
- Change tolerance: API avoids mail-flow changes; MX/Inline requires DNS, connector and TLS planning.
- Permission review: For API mode, document the required Microsoft Graph read/write mailbox access and tenant-consent process.
- Resilience: Include a response for Graph outages, API throttling, delayed analysis and message backlogs.
- Bypass testing: For MX/Inline, inventory legitimate senders and connectors, validate TLS, and do not enforce the inbound restriction until the documented 72-hour condition is met.
- Remediation needs: Use MX/Inline when inline blocking or quarantine is a requirement; do not assume API mode can perform those actions.
- Evidence standard: Treat Cloudflare’s capability descriptions as vendor documentation, not as independent proof that Microsoft 365 controls are insufficient or that a specific reduction in compromise will occur.
Outbound DLP for Microsoft 365
Cloudflare’s current Outbound Data Loss Prevention documentation says the feature monitors outbound email for sensitive information and supports Microsoft 365 only. It requires a Microsoft 365 E3 or E5 license and uses a DLP Assist add-in for Outlook on the web and desktop. Cloudflare’s configuration guidance says policy propagation may take up to 24 hours. Confirm the tenant license, supported clients and current prerequisites in the Outbound DLP documentation before committing to a rollout.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Other Microsoft integrations Cloudflare describes
Cloudflare’s solution brief for Microsoft 365 also describes integrations involving:
Rank #4
- APPLIANCE ONLY: Hardware unit sold without a service subscription — security services, firmware updates and support are NOT included and must be purchased separately to activate protection.
- PERFORMANCE: Up to 2.5 Gbps firewall inspection, 1 Gbps threat prevention and 1.2 Gbps IPSec VPN throughput driven by SonicWall's patented Reassembly-Free Deep Packet Inspection (RFDPI) engine.
- CONNECTIVITY: 8x1GbE + 2x1G SFP in a desktop form factor; zero-touch deploy and manage on-box or via cloud Network Security Manager (NSM).
- THREAT PROTECTION: SonicOS 8 delivers intrusion prevention, gateway anti-malware, application control, TLS/SSL decryption, Capture ATP multi-engine sandboxing (RTDMI) and reputation-based content & DNS filtering with an active service subscription.
- BUILT FOR SMALL BUSINESS & BRANCH: Secure SD-WAN, IPSec and SSL VPN plus Zero-Trust Network Access through Cloud Secure Edge keep distributed sites and remote workers protected.
- Azure AD authentication controls, including multifactor authentication and conditional access.
- Microsoft Cloud App Security scanning.
- Secure access to applications hosted on-premises or in Azure.
- Intune device-posture signals.
- Microsoft 365 connectivity optimization through a networking partnership.
These items come from a vendor solution brief rather than a detailed, current implementation guide. Treat them as capabilities Cloudflare has described and verify present availability, licensing and product scope against live documentation before using them in an architecture decision. The brief is available as a Cloudflare PDF.
A decision framework for Microsoft 365 teams
Choose Graph API when
- You want the least disruptive starting point and can approve Graph read/write mailbox access.
- Post-delivery detection and actions are acceptable.
- You have operational controls for Graph outages, throttling and delayed processing.
Choose journaling when
- You need copies of inbound and outbound mail analyzed without changing public MX routing.
- Your compliance and messaging teams can manage a Microsoft Purview journal rule.
- You accept that the original message is delivered before analysis.
Choose MX/Inline when
- Pre-delivery blocking, quarantine or modification is central to the design.
- Your team can manage DNS, connectors, TLS and sender allow-list testing.
- You can stage the bypass-prevention change and observe the required 72-hour waiting period.
Cloudflare can extend Microsoft 365 security with another inspection and policy layer, especially when an organization needs external analysis or pre-delivery routing. The documented material does not establish a universal winner, quantified ROI or independently validated superiority over Microsoft’s native controls. Make the decision from your mail-flow architecture, permission policy, recovery plan and required enforcement point.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
