Set up Mail Guard

About ten minutes, once. Nothing to install and no card for the trial. You need your work email address and, for one step, whoever administers your company’s Google Workspace or Microsoft 365.

1. Start the trial

1. Open mailguard.lanescout.io and sign in with your work email. We email you a sign-in code; there is no password. Personal addresses such as Gmail or Yahoo can’t start a company.
2. Enter your company’s name and choose where its email is: Google Workspace or Microsoft 365. Your company is the domain of your address, for example everyone at yourcompany.com.
3. Press Start the free trial. Your dashboard opens with a Connect card: the next step.

Someone at your company already started? Ask them to add you as an admin under Settings → Admins.

2. Connect Google Workspace a Workspace super administrator

One setting in the Google Admin console. You can remove it any time on the same page.

1. In the Mail Guard dashboard, keep the Connect your Google Workspace card open. It shows your Client ID and OAuth scopes, each with a Copy button.
2. Open Admin console → Security → API controls → Domain-wide delegation and choose Add new.
3. Paste the Client ID, then paste the scopes exactly as copied (one line, commas included).
4. Choose Authorize.
5. Back in Mail Guard, press Check connection. It must be pressed by a Workspace administrator signed in to Mail Guard as themselves. That is how Mail Guard knows your company really authorized it. Protection and the 14-day trial start at that moment.

What the scopes allow: during the read-only trial, reading email only (gmail.readonly), plus read-only directory and admin-activity access, to confirm who your administrators are, list your people and warn you if someone removes this access. A new authorization can take a few minutes to start working.

2. Connect Microsoft 365 a Global or Cloud Application administratorEarly access

One consent screen from Microsoft. You can remove it any time in Microsoft Entra → Enterprise applications.

1. In the Mail Guard dashboard, on the Connect your Microsoft 365 card, press Grant access in Microsoft 365.
2. Sign in to Microsoft as an administrator of your organization and choose Accept. Microsoft asks for: Mail.ReadWrite (read new email, add Mail Guard’s categories and notes; Mail Guard never sends, deletes, moves or edits email), MailboxSettings.Read (inbox rules that forward or hide email), User.Read.All (list your people) and Organization.Read.All (confirm your domains belong to your organization).
3. You return to Mail Guard. Press Check connection. Protection and the 14-day trial start at that moment.

Mail Guard accepts the consent only from the Microsoft 365 organization that has verified your company’s domain. Want Mail Guard limited to the mailboxes you protect? Ask us for the Exchange application access policy (two PowerShell lines).

3. Choose the mailboxes to protect

1. Open Mailboxes and pick people from your directory, or paste addresses, one per line.
2. Each mailbox starts within a minute or two. The last two days are checked right away, and Mail Guard learns who your company usually emails from the past year over the next hour or so.

A group address such as dispatch@ has no mailbox of its own: its mail reaches its members, so protect the members. Mail a group relays is judged as its real sender.

4. Turn on the warnings in the inbox

The trial starts read-only: findings show in the Mail Guard dashboard and nothing is written to your email. When you’re ready for your team to see the warning on the email itself:

• Google Workspace: on the Your trial is read-only card, follow the steps to edit the same Admin console entry (it adds gmail.modify; Google has no label-only permission), then press Check and turn on labels. To try one inbox first, use Labels on next to that mailbox.
• Microsoft 365: the consent already covers it. Press Check and turn on labels on the same card to turn on Outlook categories.

Labels appear as LaneScout/Verify first and LaneScout/Worth verifying, with a note in the conversation saying what to check.

5. Trial and billing

• 14 days free for up to 10 mailboxes, no card. The trial starts when protection does (step 2), not at sign-up.
• To subscribe: open Settings → Plan, choose monthly or yearly and how many mailboxes, and press Subscribe. Payment is on a secure payment page; Mail Guard never sees your card. Subscribing before the trial ends keeps the days you have left free.
• Invoices, cards, mailbox count and cancelling are under Settings → Plan → Manage billing, invoices and mailboxes.
• If the trial ends without a subscription, protection pauses. Nothing is deleted; subscribe any time and it picks up again.

Prices are on the Mail Guard page.

Removing access

Google: delete the entry in Domain-wide delegation. Microsoft: remove LaneScout Mail Guard under Microsoft Entra → Enterprise applications. Mail Guard can no longer read your mail. What happens to your data is in the privacy policy.

Stuck?

Email support@lanescout.io with your company’s domain and what the dashboard says.