Attackers who steal one password quietly hide your bank's emails, read your invoices, and send your customers new payment details. CJ Guard watches your Microsoft 365 around the clock and messages your team the moment it happens.
🔴 Critical: account takeover pattern on finance@yourcompany.com New-country sign-in → hidden inbox rule → mailbox access, in 3 minutes. Block the account and revoke its sessions now. Review in CJ Guard
Business email compromise rarely looks like hacking. It looks like a normal sign-in, then a few quiet changes. Each step leaves a trace in your Microsoft 365 audit log. CJ Guard reads that log every 5 minutes.
A fake Microsoft sign-in page or a reused password. CJ Guard alerts on sign-ins from new countries, impossible travel, new devices and networks, password spraying and MFA changes.
Inbox rules that bury replies, forwarding to an outside address, a new app with mail access. CJ Guard alerts on every inbox rule, forward, permission and app consent, with what it does in plain words.
Invoices, payment runs, who approves what. CJ Guard alerts when anyone opens a mailbox that isn't theirs, or downloads files in bulk.
“Our bank details have changed.” From the real mailbox, or from a look-alike domain. CJ Guard flags look-alike senders and bank-detail emails, and can show a warning banner inside Outlook.
When several of these happen to one account within a day, CJ Guard joins them into a single critical account takeover alert, so the one message that matters isn't lost among the others.
WhatsApp, SMS, a Telegram group or a Slack channel, as many as you like. Every alert says who, what, where and what to do next. A daily summary at 08:52 confirms CJ Guard is working; if it doesn't arrive, you know. Review everything, add travel exceptions and see where people sign in from on your own dashboard.
On day one, CJ Guard checks for forwarding rules, hidden inbox rules, Send As and Full Access permissions, risky apps, unexpected admins and foreign MFA phones that were set up before you joined.
Look-alike domains, first-time senders asking for payment changes, and replies that go somewhere else. Mail content is never stored.
Staff see a clear warning on a suspicious email before they act on it. The check runs inside Outlook.
Usual countries, networks, devices and hours. A sign-in from your own city on an unknown laptop at 3 a.m. still stands out.
Removing CJ Guard's access, turning off audit logging or muting alerts sends a critical message to everyone on the alert list.
Every audit record is kept for 2 years in write-once storage. Nobody, including an attacker with admin rights, can delete it.
No agent, no mail-flow changes, no passwords shared with us. Your Global Administrator approves read-only access in Microsoft's own consent screen, and can withdraw it at any time.
Connect your organisationEvery plan includes unlimited alerts, all alert channels, the daily summary and 2 years of write-once audit evidence. Start with a 14-day free trial; no card needed.
Small offices that need to know about a takeover, fast.
$2.00 per user / month
Billed yearly
Start free trialMost chosen
Companies that move money by email: finance teams, trading, real estate.
$4.00 per user / month
Billed yearly
Start free trialOrganisations that want CloudJune's security team alongside the alerts.
Custom
Annual agreement
Talk to usPrices in US dollars, excluding VAT. Minimum 10 users. You pay for licensed Microsoft 365 users; shared mailboxes and service accounts are watched at no extra cost.
Run the free compromise check: connect your organisation and CJ Guard lists forwarding rules, hidden inbox rules, risky apps and unexpected admins that exist today. No commitment.
Defender is strong at blocking malware and known phishing. CJ Guard focuses on what happens after a password is stolen: the quiet inbox rules, delegated access and payment-detail emails, and it gets that to a person's phone in minutes, in plain language. Microsoft's own alerts mostly go by email to admins (a mailbox an attacker may already be reading), and the more detailed ones need higher licences. CJ Guard works alongside Defender.
No. CJ Guard only reads the audit log Microsoft already keeps. Mail flow, sign-in and Outlook work exactly as before. The optional Outlook banner is the only thing staff ever see.
Any Microsoft 365 business plan with audit logging on (it is on by default), and a Global Administrator for the initial approval. Some options also ask you to give CJ Guard the read-only Global Reader role.
The first days are the noisiest while CJ Guard learns each person's usual places and devices. Travellers and expected access can be added as exceptions with an end date, so the same thing never pages you twice.
The message says what to do first, usually block the account and revoke its sessions. The dashboard shows every related event. On the Managed plan, CloudJune's team works through it with you.
Tell CloudJune, then delete the CJ Guard apps in Microsoft Entra. Monitoring stops immediately. If you remove access without telling us first, your alert list gets a tamper alert, by design.