A license isn't a setting
Paying for Business Premium doesn't mean its protections are configured. Policies, encryption rules and alerts have to be set up and reviewed, and many tenants never are.
What Microsoft 365 includes, plan by plan
What you get depends on your plan, and most of it has to be configured before it does anything.
| Protection | Business Basic & Standard | Business Premium | With Cloud Shield |
|---|---|---|---|
| Spam, malware and spoofing filters | Included | Included | Included, with advanced filtering |
| Impersonation and payment-fraud (business email compromise) protection | Paid add-on | Included | Included |
| Link and attachment scanning when clicked or opened | Paid add-on | Included | Included, with attachment sandboxing |
| Encryption for sensitive email | Paid add-on, per user | Included, once rules are set up | Automatic, based on message content |
| Independent backup of email, OneDrive, SharePoint and Teams | Not included | Not included | Real-time, with point-in-time restore |
| Domain authentication (SPF, DKIM, DMARC) | You configure it | You configure it | Set up and managed for you |
Based on Microsoft licensing as of October 2026. Licensing changes over time.
On Google Workspace? Same protection.
Gmail has excellent spam filtering, but the same gaps apply: retention tools like Vault are built for legal holds, not point-in-time recovery, and encryption beyond standard in-transit protection is limited to higher-tier editions. Cloud Shield layers on top of Google Workspace exactly the way it does Microsoft 365. Same features, same price, no migration required.
Comparing platforms? Try our Google Workspace vs. Microsoft 365 cost calculator →Where the gaps usually are
Encryption needs a rule or a reminder
Without rules that encrypt automatically, protecting sensitive data depends on staff remembering every time.
Recovery isn't backup
Microsoft and Google keep the service running. If a mailbox is deleted or files are encrypted by ransomware and the short recovery window passes, getting that data back is your responsibility.
Your domain can be borrowed
Until SPF, DKIM and DMARC are set up correctly, someone else can send email that looks like it came from you, to your clients, vendors or payers.
A complete email security framework
Strong email security isn't one tool. It's five layers, each with one job.
Filter
Stop malicious email before it reaches anyone.
On its ownBasic filtering on every plan; advanced on premium tiers.
With Cloud ShieldAdvanced threat, impersonation and payment-fraud protection, plus attachment sandboxing.
Warn
Help people judge what does get through.
On its ownLimited external-sender tagging.
With Cloud ShieldClear warning banners on risky and external email, and links checked when clicked.
Encrypt
Protect sensitive data on its way out.
On its ownAvailable, but only as good as the rules behind it.
With Cloud ShieldAutomatic encryption and data-loss filters based on what the message contains.
Authenticate
Prove email from your domain is really you.
On its ownPossible, but you set it up and maintain it.
With Cloud ShieldSPF, DKIM and DMARC set up and managed for you.
Recover
Get data back after a mistake or an attack.
On its ownShort recovery windows only.
With Cloud ShieldReal-time backups of email, OneDrive, SharePoint and Teams (or Google Drive), with point-in-time restore.
Built for organizations that handle sensitive data
Cloud Shield supports a number of HIPAA Security Rule safeguards and gives you the documentation to show it. It fills major gaps in email security; it doesn't make an organization fully compliant on its own.
| Feature | Safeguard |
|---|---|
| Automated email encryption | §164.312(e)(1) Transmission Security; §164.312(a)(2)(iv) Encryption |
| Spam filtering, sandboxing and link defense | §164.308(a)(5)(ii)(B) Protection from Malicious Software |
| Real-time backup and point-in-time restore | §164.308(a)(7)(ii)(A)–(B) Data Backup and Disaster Recovery Plans |
| Encrypted backup storage | §164.312(c)(1) Integrity |
| Retention and continuity | §164.308(a)(7)(ii)(C) Emergency Mode Operation; §164.316(b)(1) Documentation |
The sixth layer is people
Filters stop most threats. Training helps your team handle what's left. Our Security Awareness Training pairs naturally with Cloud Shield. Ask us about adding it.
Talk to us about training →Frequently Asked Questions
Does Cloud Shield replace Microsoft 365 or Google Workspace?
No. It layers on top of the email platform you already use. Your mailboxes, apps and logins stay the same.
We already have Microsoft 365 Business Premium. Do we still need it?
Premium includes good filtering and encryption tools, but not independent backup, and it doesn't configure itself. Cloud Shield adds real-time backup, automatic content-based encryption and managed domain authentication, and we set it all up for you.
Does it work with Google Workspace?
Yes. Same features and the same $14.70 per user per month.
Will our staff have to do anything differently?
Very little. They'll see clearer warning banners on risky email, and sensitive messages are encrypted automatically based on their content.
How does setup work?
It starts with a short onboarding call. We handle the DNS changes and coordinate timing so email isn't interrupted.
Is Cloud Shield HIPAA compliant?
No single product makes an organization compliant. Cloud Shield supports several HIPAA safeguards for email and backup, and we sign a Business Associate Agreement with healthcare clients.