API & Integrations - Microsoft Attack Simulation Integration

This article contains information on integrating Microsoft Attack Simulation data into Mimecast's Human Risk Management platform, enhancing risk analysis and mitigation by leveraging simulation insights to address human-centric cybersecurity challenges.

Overview

The integration between Microsoft Attack Simulation and Mimecast’s Human Risk Platform represents a significant advancement in organizational cybersecurity. By ingesting user interaction data from Microsoft’s simulated phishing campaigns, Mimecast’s platform can update user risk scores in real-time, enabling security teams to:

• Monitor user behavior during phishing simulations.
• Identify high-risk users based on their actions (e.g., clicking links, submitting credentials).
• Deploy targeted training to address specific vulnerabilities.
• Enhance overall security posture by proactively addressing human risk factors.

This integration is available to all Mimecast Email Security Cloud Gateway customers with access to the Human Risk Command Center, ensuring broad applicability across organizations. It is designed for ease of deployment, with a streamlined setup

Considerations

Before implementing the integration, organizations should be aware of several important factors:

1. Data Scope: Only events generated after activation are ingested. Historical data is not imported, ensuring existing user risk scores remain unaffected.
2. Accessibility: Available to all Mimecast email security customers with the Human Risk Command Center, not limited to Mimecast Engage users.
3. Deployment Time: Configuration can be completed within minutes, but it may take up to 24 hours for new phishing-related scores to appear in the Human Risk Dashboard.
4. Regional Support: Separate Azure applications are created for different regions (e.g., US, UK, DE, AU) to comply with data residency requirements.

These considerations help ensure a smooth onboarding process and maintain data integrity.

Prerequisites

Successful deployment of the integration requires meeting specific licensing, technical, and administrative prerequisites:

1. Mimecast Licensing: Access to Mimecast Engage or the Human Risk Command Center.
2. Microsoft Licensing: Access to Microsoft Attack Simulation, included in Microsoft 365 E5 or Microsoft Defender for Office 365 Plan 2. See the Microsoft Defender for Office 365 service description for details.
   1. Technical Setup: Registration of an application in Microsoft Entra ID (Azure AD) with the AttackSimulation.Read. All permissions are granted via admin consent.
3. API Access: The organization’s Microsoft tenant must be configured to allow API access for the integration.

Ensuring these prerequisites are met is essential for a seamless integration experience.

Permission

The integration requires specific administrative roles within Mimecast and Microsoft environments to ensure secure and controlled access:

1. Mimecast

• • • Global Sys Admin
    • Sys Admin - SD Full
    • Super Administrator
    • Full Administrator
    • Basic Administrator
    • Partner Administrator
    • Custom roles with Integrations Marketplace Read/Write permissions

2. Microsoft

• • • Admin consent for the AttackSimulation.Read. All permissions in Azure AD (Microsoft Entra ID)

Only authorized personnel with these roles can configure, edit, or delete the integration, maintaining operational integrity and security.

Integration Configuration

The integration and configuration process is designed to be straightforward and secure. Below is a step-by-step summary:

1. Log in to our Mimecast Administrator Console.
2. Navigate to Integrations | Integrations Hub.

3. Click Configure New on the Microsoft Attack Simulation tile.

4. Fill in the Details: 

• • • Application Name
    • Description

5. After filling in the details, click Authorize.

   

When starting the authorization flow for Microsoft Attack Simulation, you will be redirected to an authorization pop-up. Please complete the authorization flow to allow Mimecast to access Microsoft Attack Simulation.

6. Log in or select the user account you wish to use. 

7. Click Accept on the Microsoft Permissions requested pop-up.

8. You will receive a pop-up message confirming the Success of the integration.

9. Once the integration is successful, refresh and the status will change to Connected.

10. While on the Mimecast Administrator Console, Navigate to Human Risk Command Center | Dashboard
11. The newly integrated will appear under Human Risk Behaviours as Simulated Phishing.

12. Click the drop-down to expand Simulated Phishing under Human Risk Behaviours.
13. Then, once expanded, click View Details.

14. You can view a list of Events over time, individual performance, score breakdown and the latest events for simulated phishing.

15. Clicking on the Latest Events tab allows the administrator to view the Individual Risk Profile by clicking on one user under the individual list.