In short: Avanan vs Microsoft Defender for Office 365 is usually not either-or. Defender for Office 365 is Microsoft's own protection, included in some Microsoft 365 suites. Avanan, now Check Point Email Security, is a separate layer that connects by API and inspects mail after Microsoft's filter. The two can run together, or Avanan can sit on Microsoft's built-in protection instead of Defender.
The short answer
Microsoft protects every cloud mailbox with built-in security features (long known as Exchange Online Protection, or EOP) aimed at broad, volume-based, known attacks. Microsoft Defender for Office 365 adds more: Plan 1 adds protection against zero-day malware, phishing and business email compromise, and Plan 2 adds phishing simulations, post-breach investigation, hunting, response and automation.
Harmony Email and Collaboration, originally Avanan and now officially Check Point Email Security, is a separate product from a different vendor. It connects to Microsoft 365 by API and inspects mail after Microsoft's filtering and before the inbox, so anything Microsoft misses gets a second look from a different set of detection engines.
So the real question is not which one is better, but whether a second vendor's layer is worth adding to what your Microsoft licence already gives you.
How they compare
| Microsoft Defender for Office 365 | Harmony Email and Collaboration (Avanan) | |
|---|---|---|
| Vendor | Microsoft | Check Point |
| Where it runs | Built into Microsoft 365 | Separate service connected to the tenant by API, after Microsoft's filter |
| How you get it | Plan 1 included in some suites (Microsoft lists Microsoft 365 Business Premium and E3/G3); Plan 2 in enterprise suites such as A5, E5 and G5; or as an add-on | Separate subscription per protected user |
| Threat detection (beyond the built-in features) | Microsoft's engines: user and domain impersonation protection, Safe Attachments, Safe Links | Check Point's engines and ThreatCloud AI: anti-phishing, sandboxing, click-time URL protection, attachment sanitisation |
| Internal mail | Microsoft's protections apply, depending on policy | Inspected by Check Point as well as inbound mail |
| Collaboration apps | Safe Attachments for files in SharePoint, OneDrive and Teams; Safe Links in email, Office apps and Teams | Teams, SharePoint and OneDrive plus Google Drive, Slack, Box, Dropbox and ShareFile (Email & Collaboration coverage) |
| Google Workspace | No | Yes, Gmail and Google Drive |
| DLP and encryption | Through Microsoft Purview, depending on licence | In the Complete Protect tier |
| Investigation and response | Plan 1: Real-time detections; Plan 2: Threat Explorer, Threat Trackers, automated investigation and response (AIR), Defender XDR hunting and incidents | Check Point Portal console with Unified Quarantine, plus optional IRaaS and Check Point MDR services |
| Phishing simulation | Attack simulation training in Plan 2 | Security Awareness Training add-on |
| Console | Microsoft Defender portal | Check Point Portal |
Microsoft's feature lists are taken from its current Defender for Office 365 documentation; Check Point's from its Email Security plans page. Both vendors update their products often, so we check the details for your licence when we advise.
Defender Plan 1, Plan 2 and where Harmony Email sits
If you have only the built-in protection (for example, Microsoft 365 Business Basic or Business Standard without add-ons), you do not have Defender's Safe Attachments, Safe Links or user and domain impersonation protection. Here Harmony Email and Collaboration is often an alternative to buying Defender for Office 365, and adds Check Point's own engines on top of Microsoft's built-in filtering.
If you have Defender for Office 365 Plan 1 (included in Microsoft 365 Business Premium and, according to Microsoft, in Microsoft 365 E3), you already have Safe Attachments, Safe Links and impersonation protection. Adding Harmony Email gives a second, independent opinion on every message, inspection of internal mail by a second vendor, and coverage of non-Microsoft collaboration apps.
If you have Defender for Office 365 Plan 2 (for example Microsoft 365 E5), you also have Threat Explorer, Threat Trackers, automated investigation and response, priority account protection and attack simulation training. Organisations at this level usually add Harmony Email for defence in depth rather than to fill a feature gap, and often because they want a different vendor's detection behind Microsoft's.
Do you need both?
Running both is a normal design: Harmony Email sits after Microsoft in the delivery path, so the two do not compete for mail flow, and Check Point's Unified Quarantine shows mail held by either product in one view. It makes most sense when:
- phishing or invoice fraud is still getting through Microsoft's filtering
- you want a second vendor's detection rather than relying on one
- you use Slack, Box, Dropbox, ShareFile or Google Workspace as well as Microsoft 365
- you want CDR (attachment sanitisation) so users get clean documents immediately
Defender for Office 365 on its own may be enough when you have Plan 2, an in-house team actively using Threat Explorer and automated response, and few threats getting through. Harmony Email on its own, with Microsoft's built-in protection underneath, can be a good fit for organisations on licences that do not include Defender for Office 365.
Licensing and management considerations
- Cost model. Defender for Office 365 is often already in your Microsoft 365 suite, so its marginal cost may be nil. Harmony Email is a separate per-user subscription; ask us for a quote.
- Consoles. Running both means two consoles: the Microsoft Defender portal and the Check Point Portal. Check Point events can be forwarded to a SIEM, including Microsoft Sentinel, to bring alerts together.
- User reporting. Decide which tool handles user-reported phishing, and whether to add Check Point's Incident Response as a Service so analysts triage reports for you.
- Awareness training. Plan 2 includes attack simulation training; Harmony Email offers Security Awareness Training as an add-on. You rarely need both.
- Endpoints. The same question arises for devices; see Harmony Endpoint vs Microsoft Defender for Endpoint.
Our view and how we help
Neither product is the right answer for everyone. For many UK small and mid-sized businesses on Microsoft 365 Business Premium, adding Harmony Email and Collaboration on top of Defender for Office 365 Plan 1 is a sensible way to catch more phishing and impersonation. For organisations already deep in Microsoft's E5 tooling, the case rests on wanting a second vendor's detection.
Forever Systems can run Harmony Email in monitor mode alongside your existing Microsoft protection so you can see, from your own mail, what it would catch, before you commit. For a wider look at your tenant, see our Microsoft 365 security page or book a Microsoft 365 security assessment. Contact us to arrange a trial.
How Forever Systems supplies and supports Check Point Harmony
We supply and support the whole Check Point Harmony suite, now marketed as Check Point Workspace Security, for UK organisations: from a single product to endpoint, email, SaaS, mobile, browser and SASE together, with Check Point MDR if you want round-the-clock cover.
- Scoping and licensing: the right products, editions and plans for your users, devices and risk, and a clear view of what the old Harmony names now mean
- Proof of value: trial deployments that show what Harmony finds in your own mailboxes, devices and traffic
- Deployment: endpoint agents and policies, the Microsoft 365 or Google Workspace connection, mobile roll-out through your MDM, browser extensions and SASE access policies
- Migration: moving from another endpoint, email or VPN product, or from Harmony Connect to Harmony SASE
- Ongoing support: policy tuning, alert triage, upgrades and renewals, managed in the Check Point Portal
Forever Systems Ltd is an independent IT and cyber security provider. We will always recommend what fits, including other options if Harmony is not right for you.
Want a Check Point Harmony quote, trial or renewal review?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Is Avanan better than Microsoft Defender for Office 365?
They do different jobs. Defender for Office 365 is Microsoft's own protection inside Microsoft 365. Avanan, now Check Point Email Security, is a second vendor's layer that inspects mail after Microsoft's filter. They can be used together, so the better question is whether a second layer is worth it for you.
Can I run Avanan and Defender for Office 365 together?
Yes. Harmony Email connects by API and inspects mail after Microsoft's filtering, so it does not compete with Defender for Office 365 for mail flow. You will manage alerts in two consoles unless you forward them to a SIEM.
Does Microsoft 365 Business Premium include Defender for Office 365?
Yes. Microsoft's documentation lists Business Premium, and Microsoft 365 E3, as including Defender for Office 365 Plan 1. Plan 2 is included in enterprise suites such as Microsoft 365 E5, and Defender for Office 365 can also be bought as an add-on.
Do I need Avanan if I have Microsoft 365 E5?
Not necessarily. E5 includes Defender for Office 365 Plan 2. Organisations at that level usually add Avanan for defence in depth, a second vendor's detection, or coverage of non-Microsoft apps such as Slack and Box.