Partnership Overview
Proofpoint is part of the Microsoft Defender for Office 365 Integrated Cloud Email Security (ICES) Vendor Ecosystem. Through the integration, Proofpoint Core Email Protection passes post-delivery verdicts to Defender, which applies its standard remediation and shows Proofpoint’s detections in the quarantine, investigation, and reporting experiences security teams already use. Customers keep Defender as their console and add a dedicated detection layer for business email compromise, lateral phishing, and supply chain threats.
Deeper detection, Defender remediation
Proofpoint adds a behavioral AI layer for business email compromise, lateral phishing, and supply chain threats, and its verdicts trigger Defender’s own post-delivery remediation.
One investigation view
Proofpoint detections appear in Threat Explorer, the Email entity page, and Advanced Hunting next to native signals, so analysts can investigate without pivoting between tools.
No added cost, no new infrastructure
The integration runs on Microsoft Graph API with your eligible licensing at no additional charge, with no mail rerouting, MX changes, or new infrastructure to deploy.
Layered Email Defense
Microsoft Defender protects Microsoft 365 broadly, but business email compromise, lateral phishing, and supply chain threats are engineered to blend in with everyday business communication. Many organizations add a dedicated detection layer for these threats, but historically that meant a separate quarantine, investigation view, and set of reports. An accurate verdict still cost the SOC a second screen.
Post-Delivery Remediation
|
When Proofpoint identifies a threat after delivery, Core Email Protection passes a verdict, confidence level, and threat details on that message to Defender through Microsoft Graph API. Defender determines the highest-severity verdict and applies its standard post-delivery remediation automatically, the same action it takes for native detections. Proofpoint-sourced detections then appear in the quarantine, Threat Explorer, Email entity page, Advanced Hunting, and reporting experiences analysts already use. |
Verdict via Graph API
Proofpoint passes a verdict, confidence level, and threat details on a specific message to Defender through Microsoft Graph API.
Defender Remediation
Defender determines the highest-severity verdict and applies its standard post-delivery remediation automatically, the same action it takes for native detections.
Unified Investigation
Search quarantine, investigate in Threat Explorer and the Email entity page, and query with KQL in Advanced Hunting, with an Efficacy metric that quantifies the unique detections Proofpoint adds.
Request a Demo
Thank you!
A Proofpoint cybersecurity specialist will reach out to you shortly.
Recommended for You
|
When Proofpoint Core Email Protection identifies a threat after delivery, it passes a verdict, confidence level, and threat details on that message to Defender for Office 365 through Microsoft Graph API. Defender determines the highest-severity verdict and applies its standard post-delivery remediation automatically, the same action it takes for its own detections. Proofpoint-sourced detections then appear in Defender’s quarantine, Threat Explorer, Email entity page, Advanced Hunting, and reporting. The integration doesn’t change what employees see in their inbox beyond the removal of a flagged message. |
Defender for Office 365 provides broad native detection and remediation across Microsoft 365. Proofpoint adds a dedicated, human-centric layer built for business email compromise, lateral phishing, and supply chain threats. Neither replaces the other: Microsoft supplies the console and native detection, and Proofpoint’s verdicts show up in that same console and trigger the same remediation.
A layered defense for Microsoft 365 email without a second console. Proofpoint’s human-centric detection surfaces inside Defender, so security teams get deeper coverage against business email compromise, lateral phishing, and supply chain threats while working in the console they already run.
Microsoft built the Integrated Cloud Email Security (ICES) Vendor Ecosystem as an approved framework that lets specialized email security vendors extend Defender for Office 365’s native protection while keeping investigation inside Defender. Proofpoint Core Email Protection is one of several vendors now integrated with the ecosystem.
This integration is designed for customers who run Proofpoint alongside Defender. You need Microsoft Defender for Office 365 Plan 2 or Microsoft 365 E5, and Proofpoint Core Email Protection deployed via API, which is included in Collaboration Security Tier 2, Tier 3, and Prime. Turn on the integration in your Proofpoint console and complete Microsoft’s permissions consent flow. It’s included with your eligible licensing at no additional charge, with no mail rerouting and no new infrastructure to deploy.
