- Client
- UK specialist bank
- Sector
- Financial Services
- Services
- Email Security, Data Protection
- Year
- 2023
- Timeline
- 4 months
- Read time
- 4 min read
2
Third-party email platforms consolidated into one
p=reject
Enforced DMARC policy across both public mail domains
4
Data classifications unified into one label taxonomy
01 · The challenge
What we walked into
Email protection was shared between two third-party platforms, one for filtering, one for encryption and continuity. Both did their jobs, but every policy change touched two consoles and two supplier relationships, which slowed things down in exactly the place a bank needs to move quickly.
The bank's data classification policy was sound, and its enforcement had grown up around the platforms of the day. Encrypting a message meant adding a phrase to the subject line, and classification travelled with a document only while it stayed inside the business.
The strategy was already Microsoft-first. The work was to design the consolidation so every control the regulator cared about carried across intact, and the move strengthened the bank's email security rather than unsettling it.
02 · Our approach
How we got there
- 01
Audit the mail estate
Mapped every mail flow, filter, connector, and DNS record across both public domains, including the full SPF inventory and the authentication posture each domain presented to the world.
3 weeks
- 02
Design the Microsoft-native stack
Designed the consolidated platform around Defender for Office 365, with anti-phishing policy tuned to the impersonation tactics that specifically target banks.
4 weeks
- 03
Bring authentication to enforcement
Rebuilt SPF to cover only the sources that still send, signed outbound mail with DKIM, moved DMARC to an enforced policy, and published MTA-STS so receiving servers could trust TLS.
3 weeks
- 04
Design the labelling taxonomy
Mapped the bank's four existing data classifications to a sensitivity label taxonomy that applies encryption, marking, and access rules, with automatic labelling for content the business already knows is sensitive.
4 weeks
03 · The outcome
What changed
The bank now runs one Microsoft-native email security platform instead of two third-party ones. Both public domains enforce DMARC, and classification, encryption, and marking travel inside the document rather than depending on the sender remembering a subject-line phrase.
One platform, one policy surface
Filtering, encryption, and continuity decisions live in one place, aligned to the Microsoft-first strategy the bank had already chosen.
Authentication enforced
Both public mail domains publish enforced DMARC, so impersonation attempts against the bank's brands fail before they reach a customer's inbox.
Protection that travels with the document
Sensitivity labels carry classification and encryption inside the file, so a document protects itself wherever it goes.
Encryption built into the send
The code phrase in the subject line is retired. Labelled mail encrypts itself, and recipients get a consistent experience.
“Every decision came with its reasoning attached, in language our risk committee could read. Mail authenticates itself now, and documents carry their own protection. They made a multi-platform migration feel like a calm, planned thing.”
Technologies
- Microsoft Defender for Office 365
- Exchange Online
- DKIM
- DMARC
- MTA-STS
- Microsoft Purview Information Protection
A note on confidentiality
Much of our work takes place in regulated and security-sensitive sectors, where the details of a client's environment are confidential by default. In line with our commitments to those clients, identifying details in this case study have been anonymised or generalised, while the work, the decisions, and the outcomes are described as delivered.
If you would like to know more about this engagement, we are happy to discuss it further and can share additional information on request.