Retroactive inbox inspection for Office 365 mailboxes
Cloudflare has introduced a new capability that lets customers scan historical messages in their Office 365 inboxes for threats that may have slipped past their current email security setup. The feature, called Retro Scan, examines the previous fourteen days of mail and reports what a customer’s existing filters have missed.
According to Cloudflare, many organizations are unaware of the actual state of their mailboxes. Standard protections — whether Microsoft’s built-in tools or a third-party email security product — often allow malicious messages through, raising the risk of compromise. Retro Scan aims to close that visibility gap by applying Cloudflare’s machine learning models to older messages at no cost.
How the scan is set up
From the Cloudflare dashboard, users find Retro Scan under the Area 1 tab. Before any scanning can happen, the service requires two levels of authorization:
- Permission for Cloudflare to access and scan mailbox messages.
- Permission for the Cloudflare application to read Active Directory, which helps the service map users to groups and refine its threat assessments.
Once those permissions are granted, the final configuration step is straightforward: select the domains to scan and provide details about any other email security vendors protecting those inboxes. After that, clicking “Generate Retro Scan” starts the process. Because the scan does not finish instantly, Cloudflare sends an email alert when it completes.
Reading the report
The results screen gives a summary of what was found across the organization’s mailboxes. A top-level breakdown categorizes detections by type — Malicious, Suspicious, Spoof, Spam, and Bulk — with the phish emails highlighted as a priority for review. A search button lets users drill into the messages behind any of those labels.
The report also identifies the employees who were most frequently targeted and the most common sources of threats. Cloudflare says these statistics are intended to give a clearer picture of the activity inside a company’s inboxes.
Availability and next steps
Retro Scan is currently in closed beta. Interested Office 365 customers can ask their Cloudflare contact to have it added to their account.
After the scan results come in, Cloudflare offers two paths forward for users who want to act on what they find. One option is purchasing Cloudflare Area 1 to prevent future threats from arriving in the first place. The other is a phishing risk assessment — a 30-day free trial of the Area 1 product — which provides broader visibility into the tools available for keeping mailboxes clean. A “Request Trial” button at the bottom of the Retro Scan Report opens the signup form, or users can reach out directly to their existing Cloudflare contact.
