Security & Backup

Proofpoint Essentials

Run Proofpoint Essentials email security from Dex - read orgs, domains, users, features, licensing, and reporting, with gated user and org writes.

Dex connects to Proofpoint Essentials so admins can manage email security conversationally - read an Organization and its domains, list and inspect users, check features and licensing, and pull email flow reporting. Policy-gated writes let Dex create, update (including user safe and block sender lists), and delete users, with org and feature writes available on explicit request. Proofpoint Essentials is an MSP global app: one shared Channel Partner Admin or Service Account covers every child Organization, and each Dex tenant is confined to its own org via its primary_domain. This is an admin-only integration - there is no end-user self-service, because the API cannot cryptographically bind a Dex Go requester to a Proofpoint identity.

Start free →

What Dex does with Proofpoint Essentials

Dex handles both admin workflows and employee self-service — all policy-guardrailed and audit-logged.

For admins (Dex Pro)

Read an Organization and list its domains, including one domain by name
List users in an Organization and inspect a single user by email
Check an Organization's features and licensing
Pull email flow reporting for an Organization over a reporting period
Create, update, or delete a user - with approval - including managing a user's safe and block sender lists
Update org features, update the Organization (including org sender lists), or suspend/activate the Organization - on explicit request, with approval
List child Organizations and resolve region endpoints from the MSP master connection
Deploy as an MSP global app - one shared Channel Partner Admin or Service Account, each tenant confined to its org primary_domain

Just ask Dex

Your team types a request in plain language. Dex investigates, plans, and executes — with the right guardrails.

Admin prompts

>Show me the Proofpoint Essentials organization for acme.com and list its domains
>Look up the user dlevi@contoso.com and show their safe and block sender lists
>Add newsletter@example.com to the safe sender list for jsmith@acme.com
>Pull the last 30 days of email flow reporting for contoso.com
>What features and licensing are active for the acme.com organization?
>Create a new user mstone@example.com in the acme.com organization

Policy actions

Every action Dex can take on Proofpoint Essentials is declared, scoped, and guardrailed. Admins control which apply, who approves them, and whether they're limited to self-service.

Action	What it does	Guardrails
`ppe_list_child_orgs`	List child Organizations under a partner (MSP master connection only)	—
`ppe_get_org`	Read this Organization (path-forced to its primary_domain)	—
`ppe_list_domains`	List domains for this Organization	—
`ppe_get_domain`	Read one domain under this Organization	—
`ppe_list_users`	List users for this Organization	—
`ppe_get_user`	Read one user under this Organization	—
`ppe_get_features`	Read features for this Organization	—
`ppe_get_licensing`	Read licensing for this Organization	—
`ppe_get_reporting`	Read email flow reporting for this Organization	—
`ppe_get_endpoints`	Resolve region endpoints for a domain (MSP master connection only)	—
`ppe_create_user`	Create a user in this Organization (uses a license seat)	approval
`ppe_update_user`	Update a user, including their safe and block sender lists	approval
`ppe_delete_user`	Delete a user and their quarantine from this Organization	approval
`ppe_update_org`	Update this Organization, including org safe and block sender lists	approval
`ppe_set_org_active`	Activate or suspend this Organization	approval
`ppe_create_child_org`	Create a child Organization under the partner (MSP master connection only)	approval
`ppe_update_org_features`	Change feature settings for this Organization	approval

How to configure Proofpoint Essentials

Onboarding takes minutes. Dex validates your credentials before saving them.

Setup steps

1
In Proofpoint Essentials, use a Channel Partner Admin or designated Service Account that can manage your child Organizations.
2
Note your region key (us1, us2, us3, us4, us5, eu1, eu2, ca1, or au1) - it maps to {region}.proofpointessentials.com.
3
In Dex, enable the Proofpoint Essentials integration and paste the account username, password, and region.
4
Leave primary_domain blank on the MSP master connection; set each tenant's org primary domain on its own connection once discovered from the partner orgs roster.
5
Dex validates the credentials with a live call before saving. Discovery maps each tenant to its single org primary_domain.

Vendor documentation ↗

Credentials required

username: Proofpoint Essentials Channel Partner Admin or Service Account username (sent as X-User; secret, never echoed)
password: Password for that account (sent as X-Password; secret, never echoed)
region: Region key (us1, us2, us3, us4, us5, eu1, eu2, ca1, or au1) mapping to {region}.proofpointessentials.com
primary_domain: This tenant's org primary domain (e.g. mycompany.com); leave blank on the MSP master connection

Requirements

•A Proofpoint Essentials Channel Partner Admin or designated Service Account with child-org scope and API access
•An account with admin (write) rights on the child orgs for user and org writes
•As an MSP global app, one shared credential covers every child Organization, with per-tenant scoping by primary_domain
•Dex Go is off - there is no end-user self-service, since the API cannot bind a Dex Go requester to a Proofpoint identity
•Domain writes, package/licensing writes, and quarantine release are out of scope - quarantine release lives in the Proofpoint console