Beyond Unified Detection: What Email Security Teams Need to Control

For email security teams, evaluating an integration means understanding both the detections it brings together and the quarantine management and administrative workflows it supports. Proofpoint’s integration with Microsoft’s Integrated Cloud Email Security (ICES) ecosystem brings its post-delivery detections into Microsoft Defender and consolidates investigation and remediation workflows. For customers, the next step is to understand how that integration supports their requirements for administrator-configured enforcement.

Within ICES, Microsoft applies enforcement based on submitted verdicts, verdict severity, and configured policies. Proofpoint contributes its assessments within that model; a third-party engine does not independently override a Microsoft malicious verdict through ICES. Customers can evaluate how this division of responsibilities fits their operational requirements.

Check Point Email Security brings Microsoft’s detection information and native quarantine into its platform alongside Check Point detections and quarantines, combining quarantine management with administrator-configured actions. Where Check Point’s classification differs from Microsoft’s, customers can configure workflows to restore eligible messages that Check Point classifies as safe, including eligible messages classified as high-confidence phishing, and manage supported Junk-folder placements. These actions use a separate workflow from the ICES verdict-precedence mechanism.

For customers, the practical distinction is how each approach combines visibility, quarantine management, and enforcement actions within the workflows their teams use.

Where Will Your Team Manage Quarantined Email?

For customers using both a Secure Email Gateway (SEG) and an API-based integration, the scope of each workflow matters. Proofpoint’s ICES integration applies to its Core Email Protection API and post-delivery detections; its SEG can block or quarantine messages before they reach Microsoft 365. In a deployment using both, the operational responsibilities span two environments:

• Proofpoint: Gateway policies, pre-delivery enforcement, and messages quarantined before reaching Microsoft 365.
• Microsoft Defender: Microsoft-native detections and Proofpoint’s API-based post-delivery detections shared through ICES.

The announcement describes consolidation of API-based detections in Defender. For a gateway-plus-API deployment, customers also need to confirm how messages stopped by Proofpoint’s SEG are represented and managed, including whether they appear in Defender’s unified quarantine and how enforcement workflows span the two environments.

Check Point’s Unified Quarantine was built to bring Microsoft-native and Check Point-enforced messages into the same administrative and end-user experience.

Managing Conflicting Email Security Verdicts

Combining security engines brings together independent assessments. The operational value also depends on how those assessments inform investigation, quarantine management, and remediation.

Layered security enables independent engines to contribute additional threat assessments. When Check Point identifies a malicious message in a mailbox, it remediates the message; with Proofpoint’s ICES integration, Microsoft performs remediation based on the shared detection. Both approaches support layered protection, with a different division of remediation responsibilities.

When Microsoft and Check Point assess a quarantined message differently, administrator-configured policies determine whether Check Point Email Security automatically restores an eligible message that it classifies as safe. Supported scenarios include eligible messages Microsoft classified as high-confidence phishing.

Example: A finance team is waiting on a quarterly invoice from a long-standing supplier. Microsoft’s filtering, appropriately cautious given the payment-related content, quarantines it as high-confidence phishing. Check Point’s independent analysis evaluates the sender history, authentication results, and message content and classifies it as safe. Based on the administrator’s configured policy, the message is automatically restored, subject to message eligibility, without a help-desk ticket or a delayed payment.

The distinction is the mechanism used when classifications differ. Microsoft’s ICES framework follows highest-severity verdict precedence, so a third-party clean classification does not take priority over a Microsoft malicious classification. Check Point’s restoration workflow operates separately from that verdict-selection mechanism, subject to message eligibility and administrator-configured policies.

Evaluate the Workflow, Not Just the Integration

Microsoft announced the ICES Vendor Ecosystem in June 2025, and Proofpoint’s participation adds its API-based detections to Microsoft’s investigation, quarantine, and remediation processes alongside other participating vendors. For buyers using both a pre-delivery SEG and a post-delivery API integration, the evaluation also needs to establish how quarantine management and enforcement work across those deployment components.

For customers seeking layered email security with coherent administration, evaluation includes both shared detections and the workflows that follow. Can administrators investigate messages, manage quarantines, and act on conflicting verdicts through a coherent workflow? The goal is to understand how visibility and operational controls work together in the chosen deployment.

Check Point has offered Unified Quarantine since 2023, bringing Microsoft and Check Point quarantines into a single administrative experience. Its independent, policy-based actions support automatic restoration of eligible messages when classifications differ. For buyers, the relevant evaluation spans unified visibility, investigation, quarantine management, and policy-based handling of conflicting security assessments.

Make Operational Control Part of the Decision

Check Point brings Microsoft and Check Point quarantine management together with independent, policy-based remediation for eligible messages. That is the operational distinction to evaluate alongside integrations such as Proofpoint’s participation in Microsoft’s existing ICES program, which brings API detections into Defender and enables Microsoft-led remediation. The decision is not simply where detections appear, but which actions security teams can take when assessments conflict.

When evaluating email security, ask to see how shared detections translate into action, including how administrator-configured policies govern automatic restoration of eligible messages when security assessments differ. Explore Check Point Email Security to assess unified quarantine management and the operational controls available to your team.