What is included in ESET Cloud Office Security?

Antispam engine – Filters spam in Exchange Online and Gmail mailboxes.
Anti-phishing scanning – Checks message links, homoglyph URLs and QR codes.
Antimalware scanning – Scans attachments and new or changed cloud files.
ESET LiveGuard Advanced – Cloud sandbox analyses suspicious attachments in an isolated environment.
Quarantine manager – Inspect, download, release or delete quarantined mail and files.
Important – No endpoint agent, no mailbox backup, no outbound filtering.

What are the main benefits of ESET Cloud Office Security?

ESET Cloud Office Security is an API-connected security layer for Microsoft 365 and Google Workspace, operated as a service in Microsoft Azure and managed from ESET's own web console. Its sandbox component, ESET LiveGuard Advanced, was previously sold under the name ESET Dynamic Threat Defense.

No mail rerouting – Connects through the platform API, MX records stay unchanged.
Automatic user protection – New tenant users are protected without console changes.
Multi-tenant console – Several Microsoft 365 and Google tenants in one view.
Policy-based settings – Different rules per tenant, user, team or site.
Syslog export – Detections and audit logs forwarded to your SIEM.
Scheduled reports – PDF or CSV statistics sent to chosen recipients.

Best antivirus? Why Windows Defender alone is not enough
Explains where built-in protection stops and why a second, independent scanning layer catches what the platform lets through.

Which company size is ESET Cloud Office Security suitable for?

The product is aimed at organisations that run their mail and file storage in Microsoft 365 or Google Workspace and want a scanning layer that is not operated by the same provider. Because it needs no agent and no mail rerouting, small teams can run it without a dedicated administrator, while multi-tenant management and syslog export make it usable for service providers and larger IT departments.

Does ESET Cloud Office Security meet the requirements of Swiss cybersecurity legislation?

The Swiss reporting obligation under the revised Information Security Act applies to operators of critical infrastructure, such as energy and water utilities, transport operators, larger hospitals and cantonal or municipal administrations, and not to every company that uses Microsoft 365. Organisations that are covered must report a qualifying cyberattack to the Federal Office for Cybersecurity (BACS) within 24 hours of discovering it, which means the detection has to become visible fast enough to start that clock. ESET Cloud Office Security supports this in one specific way: every detection in Exchange Online, Gmail, OneDrive, Google Drive, Teams groups and SharePoint sites is logged with a timestamp, the affected user and the detection name, kept for 90 days, and can be forwarded to a syslog or SIEM system, so a mail-borne incident can be reconstructed after the fact. What it does not cover is equally clear: it sees only cloud mail and cloud storage, gives no visibility of endpoints, servers, network traffic or misuse of stolen credentials, and it neither assesses whether an incident is reportable nor produces or submits the report. This text is general product information and not legal advice; whether your organisation falls under the reporting obligation should be clarified with your own legal advisors.

Does ESET Cloud Office Security meet the requirements of European cybersecurity legislation?

No software product creates NIS 2 compliance, because the directive addresses the organisation and its processes rather than any individual tool. NIS 2 requires member states to oblige covered entities to implement measures in categories such as risk analysis and security policies, incident handling, business continuity and backup management, supply chain security, secure acquisition and development, cyber hygiene and training, cryptography, access control and multi-factor authentication. ESET Cloud Office Security contributes to two of these categories: incident handling, through continuous detection and 90-day detection records for cloud mail and cloud storage that can be exported to a SIEM, and cyber hygiene, by removing spam, phishing and malicious attachments before users interact with them. It contributes nothing to backup management, cryptography, access control for your own systems, multi-factor authentication, vulnerability handling or supplier assessment, and it does not train your staff. Those categories have to be covered by other products and by documented internal processes.

Does ESET Cloud Office Security help with security questionnaires from large customers?

Partly, and it is worth knowing in advance which questions it answers and which it leaves open. It gives a concrete answer to items on email filtering beyond the platform's built-in protection, sandbox analysis of suspicious attachments, quarantine handling with a documented release and delete workflow, retention of detection records for 90 days, log forwarding to a syslog or SIEM system, role-based administrative access, and an audit log that records which administrator changed which object and when. It gives no answer to endpoint protection and EDR, patching and vulnerability management, disk or file encryption, multi-factor authentication, backup and restore, data loss prevention, email archiving, security awareness training, or filtering of outbound mail from a compromised account. If several of those items are on the questionnaire, moving to a higher tier of the same family is normally the cheaper route than adding a second vendor, because ESET PROTECT Complete adds endpoint and server protection, encryption and patch management under one console and one supplier answer, and ESET PROTECT Elite adds multi-factor authentication and XDR. Backup and archiving remain outside the ESET security tiers in every case and must be sourced separately.

Test: Best antivirus programs for Windows
Compares current Windows antivirus products and helps you close the endpoint gap that cloud mail protection does not cover.

What is the difference between ESET Cloud Office Security and ESET PROTECT Complete?

The decisive difference is scope of coverage: ESET Cloud Office Security protects cloud mail and cloud storage only, while ESET PROTECT Complete is an endpoint-centred package that includes cloud application protection as one component among several. Both use the same detection engines and both include ESET LiveGuard Advanced cloud sandboxing, so the difference is not detection quality but what gets scanned. If Microsoft 365 is your only unprotected surface and your devices already run another endpoint product, the standalone product is the precise fit. If devices, servers and patching are open questions as well, the bundle answers more of them from one console.

Which limitations should you know before buying?

On the Google Workspace side the coverage is narrower than many buyers expect: shared drives are not supported, and native Google Workspace documents such as Docs, Sheets and Slides are not scanned at all, because only stored binary and text files are inspected. Files larger than 200 MB, password-protected archives, archives nested ten levels or deeper, and scans that exceed the two-minute timeout are recorded as not scanned rather than as clean, so those entries in the scan log deserve attention. Because the antispam engine works on messages already stored in mailboxes, it cannot stop outbound spam sent from a mailbox whose credentials have been stolen, which is exactly the scenario that damages your sending reputation with customers. Retention is fixed and short by evidence standards: quarantined objects are deleted after 30 days and detections, scan logs and audit logs after 90 days, so anything you need to keep longer must be exported to a syslog or SIEM system while it still exists. The service runs in Microsoft Azure and the data centre location follows the region chosen for the account, which is the setting to confirm before onboarding if data location matters to your customers.

Data loss is expensive: How backups help you avoid outages
Shows why a quarantine with 30-day retention is not a backup and what a working restore path for business data looks like.

Frequently asked questions about ESET Cloud Office Security

Does it replace the protection built into Microsoft 365?

No, it runs in addition to it and inspects mail and files inside the tenant after the platform's own filtering. Quarantined items are handled in the ESET console, which means your administrators work with a quarantine that is separate from the Microsoft or Google one.

Does anything have to be installed on the devices?

No agent is installed anywhere. Protection is activated by granting consent through Microsoft Entra ID or the Google Workspace Marketplace, which requires administrator access to the tenant, and mail flow keeps running as before because no MX record is changed.

How long are quarantined emails kept?

Quarantined objects are removed permanently after 30 days, and the retention period can be set to 7, 14 or 30 days per tenant. Quarantined mail can optionally be stored in a hidden folder inside the user's mailbox, which means released messages land directly in the inbox instead of arriving as an attachment.