|
| 1 | +--- |
| 2 | +title: Defender for Office 365 ICES Vendor Ecosystem Integration Guide |
| 3 | +description: Understand how the ICES Vendor Ecosystem enables Microsoft Defender for Office 365 to integrate with trusted non-Microsoft email security vendors. |
| 4 | +author: chrisda |
| 5 | +ms.author: chrisda |
| 6 | +manager: orspodek |
| 7 | +ms.reviewer: aylamckorkle |
| 8 | +f1.keywords: |
| 9 | + - NOCSH |
| 10 | +ms.service: defender-office-365 |
| 11 | +audience: ITPro |
| 12 | +ms.topic: article |
| 13 | +ms.date: 06/11/2025 |
| 14 | +ms.custom: |
| 15 | +ms.assetid: |
| 16 | +ms.collection: |
| 17 | + - m365-security |
| 18 | + - tier2 |
| 19 | +ms.localizationpriority: medium |
| 20 | +search.appverid: |
| 21 | + - MET150 |
| 22 | + - MOE150 |
| 23 | +appliesto: |
| 24 | + - ✅ <a href="https://learn.microsoft.com/defender-office-365/mdo-about#defender-for-office-365-plan-1-vs-plan-2-cheat-sheet" target="_blank">Microsoft Defender for Office 365 Plan 2</a> |
| 25 | + - ✅ <a href="https://learn.microsoft.com/defender-xdr/microsoft-365-defender" target="_blank">Microsoft Defender XDR</a> |
| 26 | +--- |
| 27 | + |
| 28 | +# Microsoft Defender for Office 365 ICES Vendor Ecosystem integration guide |
| 29 | + |
| 30 | +> [!NOTE] |
| 31 | +> Information in this article pertains to features that are part of the ICES Vendor Ecosystem. However, certain functionality might not yet be accessible to all users. Microsoft makes no warranties, expressed or implied, with respect to the timeline of availability. |
| 32 | +
|
| 33 | +The Integrated Cloud Email Security (ICES) Vendor Ecosystem enables Microsoft Defender for Office 365 to integrate with trusted non-Microsoft email security vendors. Integration supports a multi-layered defense strategy. It allows customers to benefit from niche capabilities from external partners and maintain a unified experience within the Microsoft Defender portal. |
| 34 | + |
| 35 | +The benefits of the ICES Vendor Ecosystem include: |
| 36 | + |
| 37 | +- **Unified quarantine**: View and manage quarantined email from both Defender for Office 365 and non-Microsoft vendors in a single interface. |
| 38 | +- **Consolidated dashboards**: Access effectiveness metrics across all integrated solutions to understand detection coverage and outcomes. |
| 39 | +- **Defense in depth**: Enhance protection by layering non-Microsoft capabilities alongside native defenses in Defender for Office 365. |
| 40 | +- **Streamlined operations**: Seamless integration with cloud-native, API-enabled email security vendors through consolidated workflows and insights within the Defender portal. |
| 41 | + |
| 42 | +The rest of this article describes the operation, goals, and deployment considerations for the ICES Vendor Ecosystem. |
| 43 | + |
| 44 | +> [!TIP] |
| 45 | +> Currently, specific API details aren't available. |
| 46 | +## Get Started |
| 47 | + |
| 48 | +1. **Check license eligibility**: Verify your organization has Defender for Office 365 Plan 2 or Microsoft 365 E5 licenses. For more information about Defender for Office 365 Plan 2, see [Defender for Office 365 Plan 2 capabilities](mdo-about.md#defender-for-office-365-plan-2-capabilities). |
| 49 | + |
| 50 | +2. **Select an approved third-party security vendor**: |
| 51 | + - Darktrace/EMAIL |
| 52 | + - KnowBe4 Defend Platform |
| 53 | + |
| 54 | +3. **Enable integration**: After you onboard to the third-party security vendor, their solution is seamlessly and automatically incorporated into your security architecture. |
| 55 | + |
| 56 | +4. **Monitor and manage**: Use the unified dashboards and quarantine in Defender for Office 365 to monitor threat activity and take action. |
| 57 | + |
| 58 | +## How integration works |
| 59 | + |
| 60 | +Integration enables the third-party vendor to pass details on a specific message via a private Microsoft Graph API. For example: |
| 61 | + |
| 62 | +- Verdict. |
| 63 | +- Confidence level. |
| 64 | +- Any threat details they would like to share. |
| 65 | + |
| 66 | +Defender for Office 365 uses this information in the following steps: |
| 67 | + |
| 68 | +- Acknowledges the verdict. |
| 69 | +- Determines the [highest (most serious) verdict](#q-which-verdict-takes-precedence) on the message. |
| 70 | +- Updates the message and/or logs with the verdict information. |
| 71 | +- Moves the detected message to the policy-specified location. |
| 72 | + |
| 73 | +You can see the results of this integration in multiple unified experiences as described later in this article. For example: |
| 74 | + |
| 75 | +- [Quarantine](#quarantine) |
| 76 | +- [Threat Explorer (Explorer)](#threat-explorer) |
| 77 | +- [The Email entity page](#the-email-entity-page) |
| 78 | +- [Advanced Hunting](#advanced-hunting) |
| 79 | +- [Reports](#reports) |
| 80 | + |
| 81 | +## Configure your policies |
| 82 | + |
| 83 | +To ensure optimal protection and consistent behavior across integrated solutions, it's essential to configure security policies appropriately in both Defender for Office 365 and any participating third-party vendor platforms. |
| 84 | + |
| 85 | +### Defender for Office 365 policy recommendations |
| 86 | + |
| 87 | +Microsoft recommends enabling the **Standard** and/or **Strict** [preset security policies](preset-security-policies.md) for all users in your organization. These presets are designed to provide a baseline of protection aligned with current threat intelligence and best practices. |
| 88 | + |
| 89 | +> [!TIP] |
| 90 | +> For more information about preset security policies vs. custom policies, see [Determine your protection policy strategy](mdo-deployment-guide.md#determine-your-protection-policy-strategy). |
| 91 | +> |
| 92 | +> If you plan on using custom protection policies instead of preset security policies, you need to periodically use the [Configuration analyzer](configuration-analyzer-for-security-policies.md) to identify and remediate deviations from recommended policy baselines. |
| 93 | +### Policy alignment with third-party vendors |
| 94 | + |
| 95 | +To maintain consistent message handling and threat response across the ecosystem, it's critical to align policy configurations between Defender for Office 365 and the integrated third-party vendor. This alignment ensures messages exhibit predictable behavior and are surfaced appropriately in unified dashboards and quarantine views. |
| 96 | + |
| 97 | +After you establish policy alignment, you can manage the remainder of the integration lifecycle directly within the Defender portal. For example: |
| 98 | + |
| 99 | +- Monitoring |
| 100 | +- Reporting |
| 101 | +- Response |
| 102 | + |
| 103 | +## Portal experiences |
| 104 | + |
| 105 | +The Defender portal provides a comprehensive and integrated experience for managing both native and non-Microsoft email security solutions. Capabilities are enhanced through participation in the ICES Vendor ecosystem as described in the following subsections. |
| 106 | + |
| 107 | +### Quarantine |
| 108 | + |
| 109 | +Messages quarantined by third-party vendors are surfaced within the [quarantine](/defender-office-365/quarantine-about) experience. Security teams can search, preview, release, report, and take remediation actions on these messages using the same workflows as Defender for Office 365 detections. This unified view reduces operational complexity and ensures consistent handling of threats across the email security stack. |
| 110 | + |
| 111 | +### Threat Explorer |
| 112 | + |
| 113 | +[Threat Explorer (Explorer)](/defender-office-365/threat-explorer-real-time-detections-about) provides real-time visibility into email threats across the organization. Messages processed by third-party vendors and surfaced through the ecosystem are included in Explorer views. This integration enables security analysts to investigate campaigns, trace message delivery paths, and correlate threat signals across detection sources. |
| 114 | + |
| 115 | +### The Email entity page |
| 116 | + |
| 117 | +The [Email entity page](/defender-office-365/mdo-email-entity-page) consolidates all available metadata and telemetry for a given message. For example: |
| 118 | + |
| 119 | +- Headers |
| 120 | +- Delivery events |
| 121 | +- Detection verdicts |
| 122 | +- User actions |
| 123 | + |
| 124 | +For messages processed by ecosystem partners, the page includes vendor-specific detection technology. This integration offers a complete forensic view in a single pane of glass. |
| 125 | + |
| 126 | +### Advanced Hunting |
| 127 | + |
| 128 | +Security teams can use [Advanced Hunting](/defender-xdr/advanced-hunting-overview) capabilities in Defender for Office 365 to query and correlate data across native and third-party vendor detections. Vendor-submitted messages are represented in the [EmailEvents](/defender-xdr/advanced-hunting-emailevents-table) and [EmailPostDeliveryEvents](/defender-xdr/advanced-hunting-emailpostdeliveryevents-table) tables. Extended schema support is available for partner-specific attributes, including vendor-specific threat details. |
| 129 | + |
| 130 | +Use this example query to see third-party vendor detections in Advanced Hunting: |
| 131 | + |
| 132 | +```kusto |
| 133 | +EmailEvents |
| 134 | +| where Timestamp > ago(7d) |
| 135 | +//List email detected by a third-party vendor |
| 136 | +| where DetectionMethods contains "Thirdparty" |
| 137 | +| project NetworkMessageId, RecipientEmailAddress, ThreatTypes, DetectionMethods, AdditionalFields, LatestDeliveryLocation |
| 138 | +``` |
| 139 | + |
| 140 | +## Reports |
| 141 | + |
| 142 | +The Microsoft 365 Defender portal provides a centralized reporting experience that consolidates information from both Defender for Office 365 and integrated third-party vendors. This unified view enables security teams to assess the effectiveness of their entire email security stack in one place. |
| 143 | + |
| 144 | +The following dashboards display this information: |
| 145 | + |
| 146 | +- **Email Detections**: |
| 147 | + - *Defender mailflow detections*: Messages Defender for Office 365 detected during mail flow. These unique messages were undetected by the third-party vendor. |
| 148 | + - *Defender post-delivery detections*: Messages Defender for Office 365 detected after delivery via [zero-hour auto purge (ZAP)](zero-hour-auto-purge.md). These unique messages were undetected by the third-party vendor. |
| 149 | + - *Non-Microsoft post-delivery detection*: Messages the third-party vendor detected. |
| 150 | + - *Duplicate detections*: Messages Defender for Office 365 detected during mail flow where the third-party vendor also delivered a verdict. |
| 151 | + - *Duplicate post-delivery detections*: Messages Defender for Office 365 detected after delivery via ZAP where the third-party vendor also delivered a verdict. |
| 152 | + |
| 153 | +- **Non-Microsoft detections**: |
| 154 | + - *Post-delivery detections*: Shows the verdict types on messages provided by the third-party vendor. This report is a breakdown of the *Non-Microsoft post-delivery detections* field in the **Email detections** report. |
| 155 | + - *Efficacy*: Calculates the unique Non-Microsoft post-delivery detections over the total Defender for Office detections. This shows the added value from your third-party solution. |
| 156 | + |
| 157 | +## Frequently asked questions |
| 158 | + |
| 159 | +### Q: I have multiple ICES/CAPES solutions. How does that work? |
| 160 | + |
| 161 | +A: Integration with multiple ICES/CAPES vendors is available as long as they're part of the ICES Vendor Ecosystem partnership. |
| 162 | + |
| 163 | +The integration works the same: each third-party vendor can provide verdicts on messages in your organization. You can see the third-party detections and identify the third-party vendor responsible for the detection within the Defender portal experiences. |
| 164 | + |
| 165 | +If multiple third-party vendors send verdicts on the same message, the verdicts and explanations are logged. The [highest (most serious) verdict](#q-which-verdict-takes-precedence) between the third-party vendors determines the action taken on the message. |
| 166 | + |
| 167 | +### Q: Which verdict takes precedence? |
| 168 | + |
| 169 | +A: The highest verdict takes precedence using the following order (from most serious to least serious): |
| 170 | + |
| 171 | +1. Malware |
| 172 | +2. High confidence phishing |
| 173 | +3. Phishing |
| 174 | +4. High confidence spam |
| 175 | +5. Spam |
| 176 | +6. Deleted |
| 177 | +7. Junk |
| 178 | +8. Clean or Not spam |
| 179 | + |
| 180 | +### Q: What if I use a different third-party vendor? |
| 181 | + |
| 182 | +A: Currently, ICES Vendor Ecosystem integration is available only for Darktrace and KnowBe4. If you use a different ICES/CAPES vendor, you can't take advantage of this integration. |
| 183 | + |
| 184 | +### Q: Is there a charge for the third-party verdict data and actions by Defender for Office 365 policies? |
| 185 | + |
| 186 | +A: No, there's no charge for the integration. The integration and Graph API support are included as part of your Defender for Office 365 Plan 2 licenses. |
| 187 | + |
| 188 | +### Q: Why don't I see the Detection Totals and Post-delivery activities by non-Microsoft solution reports?** |
| 189 | + |
| 190 | +A: The reports only show if you have activity from one of the authorized third-party vendors in the past 90 days. |
| 191 | + |
| 192 | +## Feedback and Support |
| 193 | + |
| 194 | +To provide feedback or request support, contact your Microsoft account team or use the feedback link in the Defender portal. |
0 commit comments