API & Integrations - Microsoft Defender Threat Share Integration - Aug 2025

Service Update

Availability	August 13th, 2025
Product(s)	API & Integrations
Who's affected	API & Integrations, Administrators

Overview

Mimecast is pleased to introduce the availability of the Microsoft Defender Threat Share Integration. This integration enables the sharing of malicious file hashes, URLs, and domains between your Mimecast and the Microsoft Defender Threat Intelligence platform. When Mimecast’s Targeted Threat Protection inspects an email, threats identified as malicious attachments, phishing sending domains, and malicious URLs will result in action being taken on the email (depending on the transmission direction).

What's changing

• Administrators will see a new Integration Tile for Microsoft Defender Threat Share in the Integrations | Integrations Hub section of the Mimecast Administration Console.
• This integration also enables Mimecast to send telemetry to Microsoft’s Defender Threat Intelligence platform.
• In addition to sending telemetry to Microsoft’s Defender Threat Intelligence platform, Mimecast can receive telemetry from Microsoft alerts and the Indicators list. This telemetry can be used to block threats and remediate associated emails.

Recommended actions

Administrators should review the new integration tile in the Mimecast Administration Console and consider enabling the integration to enhance their threat protection capabilities. For more information, including links to setup documentation, visit Microsoft Defender Threat Share Integration and API & Integrations - Microsoft Defender Threat Share Integration.

See Also...

• API & Integrations - Microsoft Defender Threat Share Integration
• Microsoft Defender Threat Share