Avanan

The Corma and Avanan integration keeps your email security console and its admins under control. Check Point announced its acquisition of Avanan on August 30, 2021, and avanan.com now redirects to Check Point's email security site. On March 25, 2026, Check Point renamed Harmony Email & Collaboration to Check Point Email Security. Check Point describes it as an API-based inline protection service for SaaS applications, covering Microsoft Exchange Online and Gmail. A tool that can read every mailbox deserves its own access review.

Key takeaways

• Check Point Email Security consumes one license per active user account with a valid Microsoft or Google license and at least one mailbox.
• Check Point Email Security syncs users every 24 hours, so deleting a user can take up to 24 hours to change the license count.
• Check Point Portal Global Roles are Read Only, User Admin, Admin and Primary Administrator, and Email Security adds Admin, Help Desk and Read-Only roles.
• The Microsoft 365 connection relies on an enterprise application whose permissions include Mail.ReadWrite and Mail.Send.

What access does Avanan hold in your mail tenant?

Protecting Office 365 Mail adds the Check Point Cloud Security Platform - Emails V2 enterprise application to your Microsoft tenant. Check Point's required permissions page lists Mail.ReadWrite to read and write mail in all mailboxes and Mail.Send to send mail as any user, and an app connected before December 9, 2024 might hold the Global Administrator role. On Google Workspace, Email Security creates a service user, cloud-sec-av@[domain], and requests full Gmail scope.

Removing the tool is not automatic either. Check Point's deactivation guide says stopping Office 365 Mail ends protection, but the Emails V2 application must be deleted in Microsoft Entra ID separately, and tenant data is deleted only after a certain period of time. In the Check Point Portal, a user imported from an IdP group can only be removed in the IdP.

How Corma governs Avanan

• Admins under review: Primary Administrators, Admins and User Admins in the Check Point Portal go into automated access reviews.
• Leavers removed in the right place: a leaver workflow in the IT Workflow Builder asks an admin to remove the person from the IdP group they were imported from, or to delete them in the Check Point Portal.
• Connectors with an owner: the Emails V2 application, the Google service user and portal API keys are non-human identities, so each one needs a named owner.
• Licenses in the budget: the Email Security subscription and its renewal date sit in SaaS subscription management.

Frequently asked questions

Does Avanan support SSO and SCIM?

The Check Point Portal supports SAML single sign-on with Microsoft Entra ID, Okta, OneLogin, Ping Identity, Google Workspace and other providers. Its identity provider table marks SCIM as "Only for Check Point services" for Entra ID and Okta. A Primary Administrator can enforce SSO for all users, though Primary Administrators themselves are exempt. See also how Corma covers Office 365.

How does Corma connect to Avanan?

The Email Security REST API covers security events, secured entities and exceptions rather than admin users, so Corma's browser-based agents handle admin steps in the Check Point Portal, in an isolated browser session with credentials taken from your password vault. See also how Corma covers Proofpoint.

Where is Corma data hosted?

Corma runs on AWS, with web servers and databases in data centers inside the European Union. Data is encrypted in transit and at rest, and Corma is ISO/IEC 27001:2022 certified.

Want to know who still administers the tool that reads your mailboxes? Book a Corma demo.