Vaikora › Blog › Product Updates

Email security without an MX change: how Vaikora connects to Microsoft 365 through Graph API

Product Updates · Nov 7, 2026 · 4 min read

Switching your MX record to route mail through a third-party filter is the standard approach to email security, and it creates a real operational problem: every inbound message passes through infrastructure you do not control, your mail flow depends on vendor uptime, and any misconfiguration can delay or drop delivery. Vaikora email security for Microsoft 365 takes a different path.

How the connection actually works

Vaikora connects to your Microsoft 365 tenant through Microsoft Graph. No MX change. Mail does not leave your tenant to reach the inspection layer. Instead, Vaikora runs its analysis inside a virtual machine deployed in your own Azure subscription.

That matters for two reasons. First, your mail routing stays exactly as it is. Second, the analysis happens within infrastructure you own, so the results, signals, and logs report into your own Microsoft Sentinel workspace rather than a vendor-managed dashboard you have to query separately.

The practical result: you get email threat analysis without touching DNS, without a cutover window, and without introducing a new external dependency into your mail path.

What gets inspected

Vaikora runs six content inspection modules against each message. The scope covers the content and structure of the message itself, not just header metadata. Attachments and embedded links are evaluated before the message reaches a user's inbox.

This is relevant because a significant share of modern phishing attempts do not carry a malicious payload in the initial message. They carry a link that resolves to a credential harvesting page, or an attachment that loads a second stage. Inspecting only headers or basic attachment types misses these patterns.

Vaikora's email analysis sits inside the same control plane that governs AI agent actions elsewhere in your environment. That means a signal from an email, say a link to a known-malicious domain, can inform policy decisions in other parts of your security posture, not just sit in an email filter log.

Reporting into Sentinel

Because the virtual machine runs in your Azure subscription and reports into your own Sentinel workspace, the email security telemetry joins your existing detection rules, hunting queries, and incident timelines. You are not consolidating data from a separate vendor portal; the signals are native to your Sentinel environment.

For teams already using Sentinel as their primary investigation surface, this removes a step. When an analyst is investigating a suspected phishing campaign, the email-level telemetry is in the same workspace as endpoint signals, identity events, and anything else Sentinel is ingesting. Correlation happens in one place.

For teams running the Vaikora-AzureSecurityCenter solution, high-severity findings from email analysis can surface as native incidents in Microsoft Defender for Cloud without custom engineering.

A concrete scenario

A user receives a message that passes basic spam filtering. The body looks legitimate, the sender domain is newly registered but not yet on a blocklist, and the attachment is a PDF. Vaikora's inspection modules analyze the PDF and find an embedded URL that resolves to staging infrastructure associated with a credential harvesting kit. The finding is written to your Sentinel workspace. An analytic rule fires, an incident is created, and the message can be acted on before the user clicks.

None of this required the message to leave your tenant, and the analyst investigating the incident sees the same workspace they use for every other alert.

The self-hosted architecture trade-off

Running the analysis VM in your own Azure subscription means you control the compute costs, the data residency, and the access model. It also means you are responsible for the VM's availability and patching. For organizations with strict data residency requirements or existing Azure infrastructure, that trade-off is straightforward. For smaller teams without Azure footprint, it adds operational overhead worth accounting for before deployment.

Vaikora is available on AWS Marketplace as a SaaS subscription and in the Azure Sentinel content hub as the Vaikora-AzureSecurityCenter solution. For Microsoft 365 email security specifically, the Graph API integration is the deployment path.

What to check next

If you are evaluating this for your environment, start with two questions. First, does your current email security tool report into Sentinel natively, or do you rely on a connector that batches and delays signal? Second, is your MX routing currently a dependency that affects your incident response timelines? If either answer creates friction today, the Graph-based approach is worth testing. The deployment involves your Azure subscription, Microsoft Graph permissions, and your Sentinel workspace configuration, all of which you can audit and control directly.

More from the Vaikora blog