Email Protection activation failures are almost always caused by one of a small set of known issues. Use this decision tree before contacting support.
Step 0: Check Point option is not appearing
If the Check Point option doesn't appear under Security Controls, or activation won't start:
If your MSP trial has expired, Check Point activation is blocked until a plan is assigned. Assign a plan to the MSP account, then return to Security Controls → Email Protection and activate.
If a plan is active and the option still doesn't show, it may be an Early Access item — request access from that screen.
Step 0.5: Verify admin permissions and prerequisites
Before starting activation, confirm the following based on your tenant type. Missing any of these is the most common reason activation continues to fail after the browser steps.
For Microsoft 365:
The account being used to authorize must have the Exchange Administrator role (or higher, such as Global Administrator), and must not have had any custom permissions removed. Check Point Email Protection requires the standard Organization Management permissions to complete setup.
Check Exchange Admin Center → Mail Flow for any existing rules or connectors added by a previous email security provider. Conflicting rules or connectors can block the new configuration from taking effect.
If you encounter a permissions error after attempting activation: go to SaaS Applications, click Configure on Office 365 Mail, select Go Authorize Avanan (Office 365 Email Sec), and sign back in with the correct admin account to re-authenticate.
For Google Workspace:
In Google Admin, navigate to the root organizational unit → Authentication Settings and confirm that 'Allow users to turn on 2-Step Verification' is enabled. This setting must be active before onboarding can complete.
The account used to authorize must have full Super Admin rights — a delegated or limited admin role will not work.
This integration is not supported on free G Suite license tiers. Confirm your plan supports it before attempting activation.
Step 1: Check your browser
Run activation in Google Chrome or Microsoft Edge. Other browsers may block the session cookies required for activation. If using Chrome, try an Incognito window to prevent interference from other Google accounts signed in on the same browser.
If the 'Start Gmail' button spins and does nothing even in Incognito, check whether Google Workspace is enforcing 2FA on the cloud-sec-av service account without backup codes enabled. To fix: in Google Admin, navigate to the cloud-sec-av user and enable backup codes, then retry the activation. If activation still doesn't proceed after this, it is a known stuck state — contact Guardz Support for a backend reset rather than continuing to retry.
Step 2: Understand the error messages
The Guardz console may show an 'Activation Failed' message during the process. This is often a generic UI message that does not mean the activation has permanently failed. Here is what each status actually means:
Status shown | What it means | What to do |
Initiating | The tenant has been created and is awaiting incoming emails to begin learning | Send a few real or test emails to a protected mailbox. The status will advance automatically. |
Activation Failed (during Initiating) | This is a generic UI message shown while the tenant is in the starting phase. It does NOT mean activation has permanently failed. | Wait for the tenant to complete the starting phase and enter Learning Mode. The error message will clear automatically. Do not re-trigger activation. |
Start Gmail / Start Microsoft 365 spinning forever | A session cookie conflict or browser issue is preventing the OAuth step from completing. For Gmail specifically, this can also be caused by Google Workspace enforcing 2FA on the cloud-sec-av service account without backup codes enabled. | Open a new Incognito/Guest window in Chrome or Edge and restart the activation. For Gmail: if still spinning after that, enable backup codes for the cloud-sec-av user in Google Admin, then retry. If the button is still spinning after both of these steps, this is a known stuck state — stop retrying and contact Guardz Support for a backend reset. Do not attempt to deactivate and reactivate without speaking to Support first. |
Account Activation Failed — activation timed out | Activation reached a timeout, often because test emails were not received or an old tenant is blocking | See Step 3 and Step 4 below |
Failed to create a Service User for the organizational unit '[domain]'. Make sure you have at least one available G-Suite license. | No unallocated Google Workspace user license was available when activation tried to create the cloud-sec-av service account. | Provision one available user license (through Google or your license provider) and retry activation. If your plan does not allow extra users, contact Guardz Support about Manual Mode activation. See Step 0.5 above. |
User Cloud-sec-av@yourdomain does not have sufficient permissions" | if you're onboarding Google Workspace to Check Point Harmony Email & Collaboration (Avanan), the onboarding process creates a dedicated service user named: This account is commonly referred to as the Avanan Service User. During automatic onboarding, it is created as a Super Admin because Avanan needs domain-wide access to configure Gmail integration and manage the required Google Workspace objects. | To verify or assign permissions |
Warning banner still showing after activation?
If the Guardz dashboard shows a warning banner for Email Protection even after you believe activation is complete, this usually means the activation did not fully finish.
A common cause for Google Workspace tenants is a missing user license. The Check Point Email Protection integration requires at least one available, unallocated Google Workspace user license to create the service account during activation. If no free license is available, the activation fails silently and the warning banner remains. Check whether you are on fixed billing or purchasing through a reseller, and confirm you have at least one unallocated user license available.
See the 'Failed to create a Service User' row in the table above for the fix. Once a license is available, contact Guardz Support — a support agent can push the activation or reset the tenant for you. The process typically takes around 15 minutes once the license issue is resolved.
Step 3: Activation stuck in Validating or Initiating — send test emails
The activation needs to detect real email traffic to progress. Send a few emails to a mailbox that is in the protected domain. Any email will work — it does not need to come from a specific address. After sending, wait a few minutes and check the status.
Step 4: Old Avanan tenant is blocking activation
If your organization previously had a standalone Avanan account (outside of Guardz), it may still be registered against your domain and will block a new activation. You can identify this if activation fails repeatedly even after the browser and email steps above.
A common trigger is the activation error 'email address already in use' or 'domain already registered'. Clean up the old tenant first:
Domain-level conflict: The error refers to your domain already being registered — typically from a previous standalone Avanan account that existed outside of Guardz. Follow the platform-specific cleanup steps below to remove it.
Email-level conflict: The error refers specifically to your MSP admin email address already being in use — not the domain. This happens when that email is already tied to an existing Check Point account. Do not follow the tenant cleanup steps below. Instead, either use a different admin email address for the MSP account, or contact Guardz Support and request cleanup of that specific Check Point record.
If your conflict is domain-level, follow the platform-specific steps below to remove the old tenant registration:
For Microsoft 365:
In Microsoft Entra → Enterprise Applications, find and delete the Avanan application.
In Exchange/Purview, remove any Avanan transport rules, mail connectors, distribution groups, and journal rules.
For Google Workspace:
Stop the Avanan SaaS app in Google Workspace tenant settings.
Delete the tenant from the Avanan MSP dashboard.
Even after completing these steps, the old domain registration may still persist. If activation remains blocked, contact Guardz Support for a backend reset — do not contact Avanan directly. Support will issue a new activation email. If the Avanan portal prompts for MFA setup after the reset, configure it using the new activation email.
Step 5: Activation in Learning Mode
After the tenant is created and begins receiving email traffic, it enters Learning Mode. This phase typically lasts 3–5 days, after which the status changes to Active. High mailbox traffic speeds up the process — sending test emails to protected mailboxes can help it progress faster.
If Learning Mode persists beyond a week despite high email volume, the tenant may be stuck and require backend intervention. Contact Guardz Support — Guardz will open a ticket with Check Point Support on your behalf. After Check Point resolves the issue, the tenant re-enters Learning Mode, which can take a few hours up to 72 hours to complete.
Step 6: After successful activation — emails not appearing
If the tenant shows as activated but no emails are appearing in the Avanan portal:
Confirm the Avanan mail flow rules and connectors are active in Microsoft 365 or Google Workspace.
If you also use another email security product (e.g., Barracuda Essentials), ensure Avanan rules have higher priority in the mail routing chain. See the co-existence guide for details.
Add your account to the Avanan security groups in Microsoft 365 and send a test email.
Wait 5–10 minutes and check the Avanan portal for message visibility.