Proofpoint Joins Microsoft Defender ICES: Email Detections, Remediation and Licensing

Proofpoint announced the move on October 26. The company said it is joining the Microsoft Defender for Office 365 Integrated Cloud Email Security (ICES) vendor ecosystem, and that the new integration enables Microsoft 365 customers to layer Proofpoint's Core Email Protection API into their existing Microsoft security environment and view Proofpoint detections directly within the Microsoft Defender portal.

Microsoft published a matching post on its Defender for Office 365 blog. The interesting part is less the press release and more how the integration works, who qualifies, and what it doesn't do.

What actually changed​

The product involved is Proofpoint Core Email Protection API. That is Proofpoint's API-based email security offering, not its traditional secure email gateway. This is not a blanket statement that every Proofpoint deployment now sits inside Defender.

Microsoft is clear about the audience. According to the company, the integration is designed specifically for customers who have already chosen to deploy Proofpoint's ICES solution alongside Microsoft Defender. Microsoft added that it supports environments where customers run both solutions and want to reduce friction for their SOC teams.

Microsoft's blog also gives some history: one year ago, Microsoft introduced the Microsoft Defender Integrated Cloud Email Security (ICES) vendor ecosystem, which is designed to simplify that complexity by integrating partner protections into Microsoft Defender.

Section summary: If you run Defender for Office 365 and Proofpoint's API product together, Proofpoint's verdicts now feed into Defender's own workflows. If you run only one of them, nothing changes for you.

Who else is in the club? (Check your sources)​

The partner list looks slightly different depending on which Microsoft page you read:

• Microsoft's announcement blog says Proofpoint joins existing members Darktrace, KnowBe4, Cisco, and VIPRE Security Group.
• Microsoft's ICES integration guide on Microsoft Learn, last updated July 17, 2026, lists four approved vendors: Darktrace/EMAIL, KnowBe4 Defend Platform, Proofpoint Core Email Protection API and VIPRE Integrated Email Security (IES). Cisco is not on it.

The same guide says integration is supported only with the vendors it lists, and that other ICES or CAPES vendors aren't supported. If you're weighing a Cisco-based setup, confirm with your Microsoft account team which list is current before you assume anything.

How the plumbing works​

The mechanics are more interesting than the "single pane of glass" line in the marketing. Microsoft's integration guide describes this sequence:

1. The partner submits a verdict. The vendor sends details about a specific message through a private Microsoft Graph API. That includes the verdict, a confidence level and any threat details it wants to share.
2. Defender acknowledges it. Defender records the partner's verdict.
3. Defender works out the most serious verdict. If both Microsoft and the partner have scored the message, the most severe verdict decides the outcome.
4. Defender updates the message and logs, then moves the message to the location your policy specifies.

Proofpoint describes its side the same way. When Core Email Protection finds a threat after delivery, it sends the verdict to Defender over Microsoft Graph. Defender then runs its standard post-delivery remediation automatically, the same action it takes on its own detections.

One detail is easy to miss: Proofpoint supplies verdicts, and Defender does the remediation. The decision on what happens to the message comes from your Defender policy, not from Proofpoint's console.

The verdict pecking order​

Microsoft documents a strict precedence order, from most to least serious:

If several ICES vendors score the same message, Microsoft says every verdict and explanation is logged, and the most serious verdict among those vendors decides the action. In practice, if Defender calls a message clean and Proofpoint calls it phishing, phishing wins.

That is good news for catch rates. The trade-off is that a false positive from either engine can pull a legitimate message. Your false-positive exposure is roughly the combined exposure of both engines, so plan your release workflows with that in mind.

Section summary: The integration uses Graph, relies on post-delivery verdicts, and always picks the most serious verdict. Defender stays in charge of what happens to the message.

Where analysts will see Proofpoint detections​

According to Microsoft's guide, partner detections appear in five Defender experiences:

• Quarantine: Messages quarantined by partner vendors appear in the same quarantine view. Analysts can search, preview, release, report and remediate them with the same workflows used for Defender's own detections.
• Threat Explorer: Partner-processed messages are included, so analysts can investigate campaigns, trace delivery paths and connect signals across detection sources.
• Email entity page: This page gathers headers, delivery events, detection verdicts and user actions. For partner messages it also shows the vendor-specific detection technology.
• Advanced Hunting: Vendor-submitted messages appear in the EmailEvents and EmailPostDeliveryEvents tables, with extended schema support for partner-specific attributes.
• Reports: Dashboards compare Defender and non-Microsoft detections.

For KQL users, Microsoft's documentation includes a starter query that lists third-party detections from the last seven days:

EmailEvents
| where Timestamp > ago(7d)
| where DetectionMethods contains "Thirdparty"
| project NetworkMessageId, RecipientEmailAddress, ThreatTypes, DetectionMethods, AdditionalFields, LatestDeliveryLocation

The 99.999% question​

Proofpoint's press release says that, powered by advanced AI from Proofpoint Nexus, Proofpoint's Core Email Protection API enhances Microsoft's native controls with 99.999% detection efficacy. That is a vendor claim. Neither Microsoft's integration guide nor Microsoft's blog backs up the number.

Proofpoint's sales material goes further. A Core Email Protection API solution brief claims that Microsoft's native filtering misses an average of 27% of advanced email threats. Treat that as marketing too. Vendors comparing themselves to the platform they plug into have an obvious incentive.

The integration does give you a way to test these claims on your own mail. Microsoft's reporting splits detections into these categories:

• Defender mail-flow detections the partner missed
• Defender post-delivery detections via zero-hour auto purge (ZAP) the partner missed
• Non-Microsoft post-delivery detections
• Duplicate detections, where both engines flagged the same message

There is also an Efficacy report. It divides unique partner post-delivery detections by total Defender detections, which shows what the partner layer adds beyond what Defender already caught. That figure comes from your own mail flow, so it is far more useful than a headline percentage. At renewal time, the most useful document is your own tenant's Efficacy report, not the vendor's datasheet.

One caveat: Microsoft says these partner reports only appear if an authorised vendor has had activity in your tenant within the past 90 days. Blank dashboards right after onboarding are not necessarily a fault.

Eligibility, cost and setup​

Licensing: Microsoft's guide lists Defender for Office 365 Plan 2 or Microsoft 365 E5 as the eligibility check. Proofpoint's customer FAQ lists the same Microsoft requirement, plus Core Email Protection deployed via API. Proofpoint says that product is included in its Collaboration Security Tier 2, Tier 3 and Prime bundles.

Cost: Microsoft says there is no charge for the integration, and that the integration and Graph API support are included with Defender for Office 365 Plan 2. Proofpoint says the same and adds that no mail rerouting, MX changes or new infrastructure are required.

Turning it on: Proofpoint says customers enable the integration in the Proofpoint console and then complete Microsoft's permissions consent flow. Microsoft's guide says that once you onboard with an approved vendor, its solution is incorporated into your environment automatically.

What users see: According to Proofpoint, nothing in the inbox changes apart from flagged messages being removed. The benefit is for the SOC, not end users.

A practical pre-flight checklist​

Based on Microsoft's own deployment guidance:

1. Confirm licensing. You need MDO Plan 2 or Microsoft 365 E5 across the users in scope.
2. Apply baseline policies. Microsoft recommends the Standard and/or Strict preset security policies for all users. If you use custom threat policies instead, run the Configuration analyzer regularly to catch drift from the recommended baselines.
3. Align policies across both vendors. Microsoft calls this alignment critical for predictable message handling. If Defender quarantines phishing and Proofpoint's settings assume junk-folder delivery, your analysts will spend their time sorting out the difference.
4. Plan for false-positive releases. Because the most serious verdict wins, agree who owns release decisions for messages flagged by Proofpoint.
5. Validate in Advanced Hunting. Use the Thirdparty query above to confirm verdicts are arriving.

Microsoft also notes that some ICES functionality might not yet be available to all users, makes no promises about timing, and says specific API details aren't public yet. Don't assume every capability described here is already live in your tenant.

The bigger picture​

This deal works for both companies. Microsoft keeps the analyst inside Defender, even when the detection came from a competitor's engine. Oz Wilder, Microsoft's Partner Director for email and collaboration security, described the goal as "building a cohesive defense fabric that drives real efficiency for security operations centers, anchored in Microsoft Defender". Note the word "anchored."

Proofpoint gets its verdicts in front of SOC analysts in the console they already use, instead of competing for their attention. Tom Corn, who runs Proofpoint's Threat Protection Group, said that "by extending Proofpoint's interoperability across ICES, we're delivering a more unified security experience that strengthens defense-in-depth and simplifies operations for our shared customers."

There is a strategic tension, though. Proofpoint also sells its own investigation console. Earlier this year, Core Email Protection API became available in Threat Protection Workbench, bringing full attack chain visibility and connected controls to organizations running Microsoft 365. Shops already standardised on Proofpoint's tooling may find that ICES gives them a second place to look, not one fewer. The consolidation benefit is biggest for teams that live in Defender XDR.

Do fewer consoles guarantee faster investigations? Not automatically. Merged verdicts still need tuned policies, clear ownership and people who understand why two engines disagreed about a message. ICES removes the tab-switching. It doesn't remove the need for judgement.

Bottom line: For joint Microsoft–Proofpoint customers on MDO Plan 2 or E5, there's no extra licence cost and the integration gives analysts real workflow benefits. Proofpoint's verdicts trigger Defender's own remediation and show up in quarantine, Explorer, the Email entity page, Advanced Hunting and reporting. Use the Efficacy dashboard to check the vendor's numbers against your own mail, align policies before you rely on it, and keep in mind that the most serious verdict from either engine decides what happens to a message.