Proofpoint Essentials Setup

Proofpoint Essentials is Proofpoint's email security suite for SMBs and MSPs -- anti-spam, phishing and malware filtering, email continuity, and encryption. This integration gives Junto a single partner-level connection that spans all of your customer organizations, so the agent can inspect and administer email security across your book of business during ticket work.

How Junto Connects

You connect Proofpoint Essentials once for your organization, at the partner level. Junto enumerates your customer (child) organizations from that connection, and you map each Junto company to its Proofpoint customer so the agent works on the right tenant.

The connection uses two credential channels, configured together:

• REST service account -- for administration, configuration, reporting, users, domains, entitlements, and security settings.
• Threat API key -- for reading SIEM threat events across your customers.

You can connect just one channel to start; each is tested and used independently. Threat-event reads require the Threat API key; everything else uses the REST service account.

Prerequisites

• A Proofpoint Essentials partner / channel account (the connection is partner-wide and lists your child organizations)
• A REST administrator service account -- a registered partner administrator or a dedicated admin service account
• A SIEM Threat Events integration key with all-child access, for cross-customer threat reads
• Admin access in Junto to configure integrations and manage mappings

Step 1: Prepare Your Proofpoint Credentials

REST service account:

1. In Proofpoint Essentials, use a registered partner administrator or create a dedicated administrator service account.
2. Note the account username and password. See Proofpoint's REST API guide for details.

Threat API key:

1. Create a SIEM Threat Events integration key with all-child access so the agent can read threat events across your customers. See Proofpoint's Integration Keys guide.
2. Note the integration key, its secret, and your region (US or EU).

Step 2: Configure in Junto

1. In Junto, go to Settings → Integrations → Proofpoint Essentials.
2. Enter the REST service account username and password. The REST endpoint is fixed to the Proofpoint Essentials US1 platform.
3. Enter the Threat API region (US or EU), key, and secret.
4. Save. All credentials are encrypted before storage.
5. Test each channel independently -- the REST connection and the Threat connection each have their own Test action. A configuration can be fully connected, connected on one channel, or disconnected.

Step 3: Map Companies to Customers

1. On the configuration, open Company mapping. Junto lists your Proofpoint child organizations.
2. Link each Junto company to its Proofpoint customer. Junto matches on the customer's primary domain, and auto-map is available.
3. Save mappings.

Junto identifies customers by your trusted Junto company mapping -- not by Proofpoint identifiers or email domains, which can be shared or stale. If your partner account identity changes, existing mappings are invalidated to prevent cross-tenant mistakes; re-map after any such change.

How the agent targets a customer

In chat and Explore, the agent can work across all your mapped customers at once, or you can narrow it to a single company. When a session is already scoped to one company (for example, signal triage), it stays fixed to that company and can't be pointed at another.

What the Agent Can Do

Once connected and mapped, the agent can inspect and administer Proofpoint Essentials across your customers. Read capabilities never require approval; every write action requires technician approval before the agent proceeds.

Inspection & Reporting (read-only)

Area	What the agent can review	Risk Level
Customers	List your child organizations and view an organization's details	Low
Users & domains	List and view users and domains, and check domain health	Low
Licensing & entitlements	View features, licensing, package, and available products	Low
Sender lists & tagging	View organization, user, and group sender lists, and email-tagging settings and exemptions	Low
Security posture	View MFA, login, and Azure settings, identity providers, and DKIM keys	Low
Threat events (SIEM)	List threat events across your customers	Low
Partner reporting	View partner and per-customer statistics and partner identity	Low

Administration (approval required)

Area	What the agent can change	Risk Level
Users & domains	Create and update users; create, update, and verify domains	Medium
Sender tagging & lists	Add or remove sender-list entries (organization, user, group) and manage email-tagging settings and exemptions	Medium
Security settings	Update MFA and login settings	High

High-impact security changes require technician approval, as do all administrative writes.

Not Included

Some actions are intentionally excluded and must be done in the Proofpoint Essentials portal: purchasing products, changing features/licensing/packages, permanently deleting organizations, users, or domains, releasing quarantined mail, and changing identity-provider, Azure-sync, or DKIM settings.

Troubleshooting

• REST connection test fails -- Re-check the service-account username and password, and confirm the account is a partner administrator or dedicated admin service account.
• Threat connection test fails -- Re-check the integration key, secret, and region, and confirm the key was created as a SIEM Threat Events key with all-child access.
• One channel works but the other doesn't -- The two channels are independent. Threat-event reads need the Threat API key; administration and reporting need the REST service account. Connect and test whichever channel is missing.
• A customer isn't found -- Confirm the Junto company is mapped to the correct Proofpoint child organization (Step 3). The agent identifies customers by your Junto company mapping, not by domain.
• Mappings stopped working after reconnecting -- If the partner account identity changed, existing mappings are invalidated for safety. Re-map your companies.