ManageEngine M365 Security Plus vs MotherDuck

M365 Security Plus is an on-premises Java application for auditing and alerting on Microsoft 365 activity, shipped as numbered builds a few times a year. The last two builds are typical of the pattern: 4821 upgrades the bundled JRE from Java 8 to 11 and refreshes 7-Zip and Jackson libraries, while 4820 carries the only real functional work in the window — mailbox backups to local, shared, or NAS repositories, PST splitting for large exports, bulk mailbox selection from CSV, and audit logs that show object names instead of GUIDs. Security fixes appear in nearly every build.

Two forces set the release agenda, and neither is a roadmap. The first is Microsoft: deprecated cmdlets forced an audit rewrite onto Get-MessageTraceV2, and a tenant configuration change broke onboarding until build 4817 patched around it. The second is the supply chain — Log4j, Tomcat, Bouncy Castle, Zulu JRE, and now the Java 8 to 11 jump, all tracked build by build because on-premises customers inherit whatever the vendor bundles. The product work that does land clusters around the Backup module, which is the one area growing rather than being maintained.

With the JRE finally past Java 8, Tomcat 9 is the next end-of-life dependency in the bundle, and the Backup module's steady additions suggest export and retention options continue there.