Check Point Harmony Email and Collaboration, presented in the current documentation as Email Security, connects deeply to Microsoft 365 or Google Workspace. Microsoft automatic onboarding can create mail-flow rules, connectors, connection filters, journal rules, groups, distribution lists, trusted ARC configuration, reported-phishing handling, a delegated token, and PowerShell-driven maintenance. Google onboarding creates a service user and requests broad Gmail, Drive, directory, reporting, licensing, and Pub/Sub scopes for scanning and remediation. Those are production tenant changes, not a lightweight browser plug-in.
A useful rollout record therefore begins with the exact tenant, platform, license, data-residency decision, approving identity, protected population, upstream mail transfer agents, hybrid routing, shared mailboxes, groups, relays, journaling, encryption, user-reporting destination, and existing transport rules. Record which team owns each dependency and which benign message proves it still works. The project should never infer healthy coverage from a successful authorization screen alone.
Use a small pilot that can exercise ordinary and unusual mail paths without risking the whole tenant. Start in the product’s default Monitor Only state, observe Learning Mode and live scanning, review the generated policy, then advance one controlled cohort only after stakeholders approve the expected actions. Keep the deactivation procedure beside the implementation plan so an incident commander can remove the integration deliberately instead of improvising during a mail-flow disruption.
Key decisions at a glance
- Choose Microsoft 365 automatic or manual onboarding from a documented change plan because the two modes create and maintain different administrative responsibilities.
- Use the currently required cloud roles without modifying their defaults during onboarding, then review Check Point’s current least-privilege reduction guidance after the service is stable.
- For Google Workspace, validate the service-user organizational unit, authentication settings, required scopes, licensing, and directory-sync exclusions before activation.
- Let Anti-Phishing Learning Mode complete before judging detection, and do not introduce a Prevent Inline rule without understanding that it ends learning.
- Promote a pilot only after incoming, internal, outgoing, group, shared-mailbox, reporting, quarantine, restore, and rollback paths have named evidence owners.
Document the tenant boundary, operating mode, and rollback owner
Create a restricted pre-change worksheet for the production tenant and any test tenant. Capture platform edition, supported license, accepted data region, mail domains, accepted domains, routing topology, hybrid Exchange dependencies, gateways or MTAs ahead of the cloud platform, auto-forwarding use, shared mailboxes, service accounts, high-volume senders, distribution groups, third-party relays, journaling, and user-reporting configuration. Do not publish tenant IDs, authorization accounts, connector secrets, service-user addresses, or complete rule expressions in the blog or a broad ticket.
For Microsoft 365, choose Automatic or Manual mode explicitly. Automatic mode lets Email Security configure and maintain the required Microsoft footprint, Manual mode transfers recurring configuration work to administrators whenever relevant policy changes occur. Current Check Point guidance recommends Automatic mode and advises contacting support before falling back to Manual mode. Treat that recommendation as input to a change decision, not permission to skip review of the objects that automatic onboarding creates.
Name the rollback authority before activation. The deactivation workflow can remove the enterprise application automatically, but unsuccessful uninstall requires manual cleanup of Check Point mail-flow rules, connectors, connection-filter entries, journaling settings, reported-message destinations, and the Entra enterprise application. Preserve pre-change exports and a current object inventory, record service impact at each rollback step, and require a second administrator to verify that ordinary mail delivery and user reporting still work afterward.
- Inventory mail domains, routing, gateways, hybrid dependencies, relays, groups, shared mailboxes, journaling, and reporting before authorization.
- Record the chosen Microsoft operating mode and who maintains its footprint after every policy or tenant change.
- Preserve pre-change configuration evidence and an approved deactivation sequence that matches the current vendor guide.
- Keep privileged identities, tenant identifiers, service-user addresses, and complete transport-rule details out of broadly visible documentation.
Authorize Microsoft 365 with current roles and inspect the created footprint
Current Microsoft 365 activation requires an approving user with Privileged Role Administrator or higher access. During onboarding, Email Security assumes the Exchange Administrator role and Check Point warns that changing the role’s default Exchange RBAC or Entra permissions can make onboarding unsupported or cause it to fail. The Privileged Authentication Administrator role supports response actions for compromised accounts, including blocking a user or resetting a password. Arrange time-bounded privileged access through the organization’s identity process and retain the approval without exposing credentials or tokens.
After authorization, compare the Microsoft tenant to the automatic-footprint list. Check Point documents changes involving mail-flow rules, connectors, connection filters, journal rules, groups, distribution lists, spoofed-sender allow entries, trusted ARC sealers, reported-phishing handling, a delegated token, and PowerShell scripts. Validate object names, scope, state, ownership, intended data region, and coexistence with pre-existing gateways. A connector that exists but is disabled, scoped incorrectly, or bypassed by another route is not deployment evidence.
If licensing or phased protection requires a group filter, verify that the selected group type and email address meet the documented requirements and that joiner and leaver changes propagate. Check Point notes that a newly added Microsoft 365 user may become available to policy scope within minutes or take up to a day, while adding a user to a scoped Prevent Inline rule may take up to an hour. Build those intervals into acceptance tests and escalation thresholds instead of declaring a user unprotected immediately or overlooking a persistent gap.
- Use the currently documented approving and application roles through a controlled privileged-access process.
- Inspect every created Microsoft object and reconcile it with the approved automatic-mode footprint.
- Test group-filter membership, license counting, shared mailboxes, and joiner propagation with known pilot identities.
- Delay least-privilege reductions until onboarding, learning, remediation, quarantine, and maintenance paths have been proven.
Prepare Google Workspace service-user, authentication, and scope prerequisites
Google Workspace activation needs administrator access, a supported Workspace tier, the required Check Point license, and special care when Google Cloud Directory Sync is present. Check Point instructs GCDS users to exclude the integration’s policy groups from on-premises synchronization. Document those exclusions, their owners, and the expected groups before the onboarding wizard runs so a later directory sync cannot remove or rewrite integration objects silently.
The workflow creates a service user in the root organizational unit. Current guidance requires compatible authentication settings, including allowing users to turn on two-step verification and avoiding a security-key configuration that prevents security-code generation. If the root organizational unit cannot use the required settings, move the service user to a dedicated organizational unit with supported controls and repeat onboarding. Confirm the browser is authorizing the intended administrator account, signed-in Chrome identity can otherwise be selected unexpectedly.
Review the requested OAuth scopes by function rather than approving an opaque list. The documented permissions cover Gmail reading, modification, insertion, labels, settings, and sending, Drive reading, metadata, and remediation, directory users, groups, devices, domains, and security settings, reporting, licensing, group settings, and Pub/Sub. Record why each scope is required, which service feature uses it, what alerts would expose a broken authorization, and how the organization will review future permission changes.
- Confirm supported Google Workspace and Check Point licenses before scheduling the production change.
- Exclude Check Point policy groups from GCDS and test that synchronization does not remove integration objects.
- Place the service user in an organizational unit whose authentication settings satisfy the current onboarding requirements.
- Map every requested OAuth scope to scanning, policy, remediation, directory, reporting, or integration behavior and retain the approval.
Complete learning, exercise a representative pilot, and prove rollback
After Office 365 Mail or Gmail activation, the Anti-Phishing engine enters Learning Mode while it analyzes historical communication metadata and detects upstream MTAs. Check Point states that calibration can take from minutes to seventy-two hours, that Anti-Phishing returns clean results during this period, and that other engines continue operating. A Prevent Inline rule stops Learning Mode. Capture the banner, progress, identified MTAs, live-scan state, and completion time before tuning thresholds or evaluating phishing accuracy.
Run a benign test matrix for incoming, internal, and outgoing mail, ordinary and high-volume senders, groups and shared mailboxes, permitted attachments, a harmless test file recognized by the approved security test procedure, URLs, user-reported mail, quarantine, restore requests, notifications, and message search. Confirm the expected product mode and workflow for each result because Monitor Only, Detect and Remediate, and Prevent Inline do not act at the same delivery stage or support identical features.
Promote one cohort at a time and observe mail delay, false positives, missed routing, user reports, restore volume, and support contacts. If a rollback drill is authorized, stop protection in a maintenance window, confirm which objects were removed automatically, complete any documented manual cleanup, verify ordinary delivery, and restore the intended configuration from an approved plan. The final acceptance package should state who approved the footprint, who owns policy, and which evidence proves both protection and recoverability of normal mail flow.
- Allow Anti-Phishing calibration to finish and record Learning Mode evidence before moving to prevention.
- Test all three mail directions plus groups, shared mailboxes, reports, quarantine, restore, search, and notifications.
- Observe documented synchronization windows when deciding whether a policy-scope change has succeeded or failed.
- Close the pilot with signed protection evidence, user-support readiness, and a rollback result that restores ordinary mail delivery.
Vendor documentation and ALLMSP resources
- Check Point activating Office 365 Mail
- Check Point required Microsoft application roles
- Check Point automatic Microsoft 365 footprint
- Check Point reducing assigned Microsoft permissions
- Check Point deactivating Office 365 Mail
- Check Point activating Google Workspace
- Check Point onboarding Learning Mode
- Check Point threat detection policy
- ALLMSP Check Point Harmony Email archive
- ALLMSP business software support
- ALLMSP managed IT services
- ALLMSP data backup and recovery
- Contact ALLMSP
Frequently Asked Questions
Should Check Point Harmony Email use Microsoft 365 Automatic or Manual mode?
Check Point recommends Automatic mode because it configures and maintains the Microsoft footprint. Manual mode requires administrators to reproduce the required Exchange changes and revisit them when relevant policy changes occur. Choose from an approved change plan, and contact Check Point Support before using Manual mode to work around an Automatic-mode problem.
Which Microsoft role approves Check Point Harmony Email activation?
The current activation guide requires an approving user with Privileged Role Administrator or higher permissions. Email Security also assumes the Exchange Administrator role during onboarding, and the documented default permissions must not be modified for that process. Use time-bound privilege and retain the business approval without recording credentials.
What does automatic Microsoft 365 onboarding change?
The documented footprint includes mail-flow rules, connectors, connection filters, journal rules, groups, distribution lists, spoofed-sender allowances, trusted ARC sealers, reported-phishing configuration, a delegated token, and PowerShell scripts. Inspect the actual tenant because coexistence, region, scope, and existing routing can change the operational effect.
Can Microsoft 365 permissions be reduced after onboarding?
Check Point publishes current guidance for reducing certain assigned application permissions after onboarding and learning. Do not improvise reductions during activation. First prove mail flow, maintenance, quarantine, restoration, and compromised-account workflows, then follow the current vendor procedure and retest every dependent capability.
What Google Workspace account does Harmony Email create?
The onboarding process creates a service user in the root organizational unit. If that unit’s authentication settings are incompatible, Check Point instructs administrators to move the service user to an organizational unit with supported settings and run onboarding again. Protect that account through the same lifecycle controls as other privileged integrations.
Why are GCDS exclusions needed before Google Workspace onboarding?
Check Point creates policy-related groups used by the integration. When Google Cloud Directory Sync manages groups from on-premises sources, documented exclusion rules prevent GCDS from altering those objects. Verify each exclusion and monitor later synchronization so a directory change does not silently damage mail protection.
How long does Check Point Harmony Email Learning Mode take?
Check Point says Anti-Phishing calibration may take from a few minutes to seventy-two hours depending on mailbox count and mail volume. Anti-Phishing results remain clean during learning, while other engines continue to operate. Record progress and completion before evaluating phishing detection or tuning its threshold.
What happens if a Prevent Inline rule is added during Learning Mode?
The current guide says adding a Prevent Inline policy rule automatically stops Learning Mode. That makes prevention a formal promotion gate: finish or deliberately terminate calibration, understand the consequence, approve the pilot scope, and verify the resulting behavior with benign incoming, internal, and outgoing test messages.
How quickly does a policy-scope change protect a Microsoft 365 user?
Check Point documents several synchronization windows. Adding a user to a scoped Prevent Inline rule can take up to an hour, and a newly created Microsoft 365 user can become available for policy scope quickly or take up to twenty-four hours. Use those windows in testing, while escalating gaps that outlast them.
What proves a Check Point Harmony Email rollout is complete?
Retain authorization and footprint evidence, protected-user reconciliation, learning completion, tested mail directions, reporting, quarantine and restore results, support readiness, synchronization observations, and a verified deactivation plan. A connected SaaS application or a green dashboard alone does not prove that every intended mail path is protected and recoverable.
