Email services overview


As part of your insider risk detection strategy, allowing Code42 to access your email services enables you to capture information about the attachments that your users email to other recipients.

See the articles listed below to learn how to authorize Code42 to start capturing metadata from your email service.


  • Your product plan must include at least one email service. If your license expires, the email connection is deauthorized within 24 hours. If you need assistance with licensing, contact your Customer Success Manager (CSM). If you do not know your CSM, please contact our Technical Support Engineers.
  • To connect to the email service, you must have the appropriate permissions in the email service as well as in Code42.

    • Gmail: You must be a Google Workspace administrator with a Super Admin role to authorize the connection to Code42
    • Microsoft Office 365: You must be a global administrator in Office 365 to authorize the connection to Code42
  • Code42 only monitors email attachments. Email message content is not accessed, monitored, or changed.

  • To use this functionality, Incydr users must be assigned specific roles. For more information, see Permissions for Incydr

Monitoring and alerting tools may report download activity
When ongoing file activity is detected, Code42 temporarily streams files from your cloud storage or email service to the Code42 cloud to calculate the file hash. (Code42 does not calculate hash value during the initial inventory process.) 

This appears in your vendor logs as users downloading files. The requesting service's IP address may point to Microsoft Azure hosts. Consider adding these IP addresses to your allowlist to reduce false alerts in your vendor logs, keeping in mind that these addresses can change. 

Code42 never stores file contents or writes them to disk during this process.

Supported email service vendor plans and licenses

Code42 can only connect to your cloud storage environment when supported by that vendor's plan or license.

Gmail Microsoft Office 365

Requires one of these Google plans:

  • Business Starter
  • Business Standard
  • Business Plus
  • Enterprise Standard
  • Enterprise Plus

Requires a Microsoft license or subscription that includes Exchange Online.

Follow the instructions in the articles linked below to connect your email environment to Code42.

Once authorized, Code42 captures file and message information about all attachments that are emailed through your organization's environment from that point forward. Code42 can monitor all user email accounts, only specific user email accounts, or only the user email accounts that are in specific groups.

When new users are added to your organization's environment, information about the attachments they email also becomes available in Forensic Search automatically.