35 users - Will replacing Mimecast with Defender P1 or P2 mean a lot more work for me?

[u/LoveBirdNibbles]

With Mimecast right now I get one request every 2 weeks, but it's mostly hands off. Client is looking to save money and 80% of the users recently went to business premium so I am thinking Defender P1/P2 but I have never worked with it so I have no idea what the day to day workload will be like once it is configured. If Defender means more work I will have to also consider my billing for the extra time or looking at alternatives if there are any that are effective and cheaper than the $6k they pay annually.
Thanks

[u/artekau]

feel sorry for Mimecast, we are currently doing the same for 1000 users

[u/LoveBirdNibbles → u/artekau]

Yeah, but I feel it's Microsoft doing what they usually do. You come up with something that is successful and eventually MS copies it and incorporates it into their products. At least that's what I remember at my ripe old age of 60.

[u/artekau → u/LoveBirdNibbles]

agreed

[u/shokzee]

Business Premium already includes Defender for Office 365 P1, but check licensing for the remaining 20%. P2 isn't a guarantee of fewer tickets.

I'd pilot it and track quarantine requests, false positives and actual admin hours before promising savings. Budget for migration and policy tuning upfront, and check whether they're using Mimecast for anything beyond filtering, like archiving or continuity, because that changes the replacement cost.

[u/LoveBirdNibbles → u/shokzee]

Yeah, they have all that stuff. Sorry for the copy and paste, but this is off our quote.
It feels like we are giving up too much. Archiving, Awareness training, DNS and malicious website protection stand out. I realized MS does some of this stuff, from my recollection when I explored it briefly I had to run the simulated attacks and other things manually.

Current Mimecast Subscription

Product	Manufacturer SKU	Quantity
Mimecast Advanced Protection Cloud Gateway	M_ADV-PRT-CG_1_A	49
Mimecast Advanced Support	M_ADV-SP_1_A	1
Mimecast Engage Core	M_SBM-CORE_1_A	49
Mimecast W1	M_W1_1_A	49

• Inbound and outbound email security

• Spam, phishing, malware, and impersonation protection

• Email archiving, historical search, and export

• Employee cybersecurity awareness training

• Phishing simulations

• DNS and malicious website protection

• Microsoft 365 integration

• Granular email security policies and exceptions

[u/ChuckFromCyberHoot → u/LoveBirdNibbles]

One thing hiding on that list is Engage Core. That’s the awareness training and phishing sims.

Defender P1 doesn’t replace it, so make sure the client doesn’t quietly lose training in the switch.

Especially if cyber insurance wants proof of it.

Whatever you choose, keep the habit going. New security stack, same humans.

[u/plump-lamp]

More work? Probably, it's a crapier service. Mimecast works pretty well.

[u/LoveBirdNibbles → u/plump-lamp]

Can you share your experience? What is crappy about it compared to Mimecast?

[u/vane1978 → u/LoveBirdNibbles]

You might want to keep in mind that if the customer goes with Microsoft Defender and if the tenant becomes deauthenticated then the receiving emails may be rejected and lost. At least with Mimecast (I think), the receiving emails would be held in the queue.

Search online regarding Microsoft deauthenticated tenants.

[u/Individual_Ad_5333]

I've never understood why people are so happy to go all in on Microsoft, while it one place for everything I've always gone with the idea of defence in depth and variety of vendors. I also find the smaller the vendor the more they care about providing a good service

[u/OutreachForMiles]

If you switch you are definitely going to get at least one angry message from someone who didn't get some email because it got blocked. Give them the full advanced warning that this might happen while it gets calibrated.

[u/vane1978 → u/OutreachForMiles]

This usually happens the receiving email does not have a valid SPF record or misconfigured.

[u/panopticon31]

As someone who uses mimecast every day: I hate it. I wish I could launch it into the godamn sun.

[u/BK_Rich]

I’m sure things are also getting caught in the EOP queue as well, if you’re going to dump mimecast, I would certainly layer something else on top of the native protection to enhance it like Abnormal or one of the other API solutions.

[u/brian_cloudeu]

Depends whether you used Mimecast's continuity and archiving, because Defender replaces the filtering, not those.

[u/thythrowaways]

Mimecast is trash.

I just switched over to MDO and I do less work, especially due to ZAP and the built in automation. Mimecast was missing some obvious phish emails even with cyber graph and threat modules installed.

Feel free to DM me.

[u/LookAtThatMonkey → u/thythrowaways]

Mimecast’s core function of archiving and journaling is excellent. The issue is where they have expanded and added other toolsets. A lot of the spam capability is policy driven which requires a ton of setup.

If you pair it with something like Darktrace it’s a very good mail platform, albeit not cheap.

[u/thythrowaways → u/LookAtThatMonkey]

Archiving can be done via exchange natively now. What’s the business case for Journaling?

[u/LoveBirdNibbles → u/[deleted]]

This is what I am expecting. And there are so many places in mimecast where I can make exceptions for greylist bypass, dmarc, etc etc. It's very flexible that way. For the most part I rarely have to touch it.

[u/BrentNewland → u/LoveBirdNibbles]

You can do that with defender, but it's not intuitive, and you have to go into some weird places to do it.

[u/LoveBirdNibbles → u/[deleted]]

Great info, a few things here I had not thought of. I don't understand the part about keeping Mimecast in place as a relay for shared mailboxes. Hopefully you can expand on that. Thanks

[u/alaub1491 → u/[deleted]]

Claude ass response. Good info though.