Last Updated: 19/08/2026
Overview
The Mimecast Data Connector in Microsoft Sentinel allows streaming of Mimecast logs into Microsoft Sentinel. As email is still the main vector for cyber attacks, this integration provides that data required to conduct detection and investigations at the perimeter and email layer.
Having Mimecast logs within Microsoft Sentinel moves us from the isolated email defense to cross-domain detection. A few examples of what these logs can be used for are listed below:
- Malicious Files – If Mimecast detects a potential malicious file, this can be cross references against Defender for Endpoint to see if the file was executed.
- Credential Harvesting/Token Theft – Mimecast can rewrite URLs and can track if users have clicked the URL. This can be correlated with Entra ID against the sign-in logs.
- Threat Intel IOCs – Using the entities from Mimecast (IPs, URLs, Domains, Attachment Hashes) these can be cross referenced against threat intelligence sources ingested into Microsoft Sentinel.
These are only a few examples. The main thing to take away is this allows us to treat email as a piece of the broader attack chain. Using Microsoft Sentinel to bolster the detection capabilities, and providing us a platform to investigate cross-domain attacks on.
Configuration
Step 1 – Configure Mimecast Integration (Mimecast Admin Portal)
For the first step of this configuration, we will need to configure the integration in Mimecast and obtain credentials to the Mimecast API for connectivity.
(These intructions may differ slightly based on updates to the portal)
- Navigate to the Mimecast Administration Center
- Locate Intergrations, and Integrations Hub
- Select Microsoft Sentinel, and Configure New Integration
- Provide the configuration a name and permissions (Basic Administrator is sufficient)
- Once the configuration is saved, note down the Client ID and Client Secret (These will be needed for the Azure Function to Authenticate)
Step 2 – Create the Entra App Registration & Assign Permissions
For this step, we need to create an App Registration with permissions to Microsoft Sentinel and Log Analytics. This is used by the Azure Function to authenticate and take actions on Microsoft Sentinel and Log Analytics for things like writing logs to the tables.
To do this, navigate to the Entra ID portal.
- Navigate to App Registrations, and create a new registration.
- Provide the App Registration a meaningful name.
- Register the Application and note down the Application ID.
- Navigate to Certificates & Secrets, and create a new Client Secret.
- Note down the Client Secret (You cannot view this again, so do note this down).
- Whilst you are in the Entra portal, navigate to the Overview page and note down the Directory/Tenant ID.
Once you have completed the above, we now need to assign Microsoft Sentinel permissions to this application registration.
To do this, navigate to the Azure portal and locate the resource group that contains the Log Analytics Workspace that underpins the Microsoft Sentinel instance.
- Open Access Control (IAM)
- Add Role Assignment
- Assign the Microsoft Sentinel Contributor Role to the App Registration connected above.
Step 3 – Configure the Mimecast Data Connector
Before we start on this step, ensure you have the following from the previous steps:
- Mimecast Client ID & Client Secret (Found in Mimecast, Step 1)
- App Registration Client ID and Client Secret (Found in Entra, Step 2)
- Tenant ID/Directory ID (Found in Entra, Step 2)
Head over to the Microsoft Sentinel instance (If integrated to Defender XDR, then head to the Defender console).
- Locate and open the Content Hub within Microsoft Sentinel.
- Search for the Mimecast Solution and Install. The solution will contain multiple data connectors, analytical rules, workbooks and parser.
- After this is installed. Locate the Mimecast Data Connector (The configuration for each are fairly similar, the differences with the data connectors is based on what you want to ingest, so multiple configurations maybe required).
- Take note of the Workspace ID and Primary Key.
- Within the Data Connector, client the ‘Deploy to Azure’ button to load up the template configuration for the Azure Function required to ingest data.
- When the configuration wizard loads up, we will need to provide some values. I have listed them in the next section and where to find the details.
Step 4 – Configure the Azure Function
- Subscription – Select from the Drop Down which subscription you would like to deploy the Azure Function to.
- Resource Group – Select the Resource Group you would like to deploy the Azure Function to.
- Region – Select the region you would like to deploy the Azure function to.
- Function Name – This is the name of the Azure Function.
- Workspace Name – This is the name of the Log Analytics Workspace that underpins Microsoft Sentinel.
- Azure Client ID – App Registration Client ID value captured in Step 2.
- Azure Client Secret – App Registration Client Secret value captured in Step 2.
- Azure Tenant ID – Directory/Tenant ID value captured in Step 2, found in the Entra Overview blade.
- Azure Entra Object ID – Object ID of the App Registration configured in Step 2.
- Mimecast Base URL – Prepopulated with: https://api.services.mimecast.com
- Mimecast Client ID – Client ID Captured in step 1 within the Mimecast Intergration config.
- Mimecast Client Secret – Client Secret Captured in step 1 within the Mimecast Intergration config.
- Mimecast Audit Table Name – This is the name of the table in Microsoft Sentinel that will store the logs. (Note: this will create the table as a custom log table and append the table name with ‘_CL’)
- Schedule – Set the schedule in Quartz cron-expression format. The default is 0 0 */1 * * * meaning this will run at the start of every hour.
- App Insights Workspace Resource ID – Populate the full Resource ID of Log Analytics Workspace. Found by navigating to the Log Analytics Workspace, and viewing the resource in JSON format. Resource IDs will look like this: /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}
Summary
Mimecast is a great, industry known Email Security platform. Its capable of being ran side by side with Defender for Office365 and provides a wealth of preventive controls in the email security layer. By ingesting the logs from Mimecast into Microsoft Sentinel, you can bolster the detective and investigative capabilities within this domain.
Thank you for reading. If you haven’t already, please check out my post on Microsoft Sentinel Data Connector On-boarding Considerations for a list of items to check and consider when on-boarding a data source such as Mimecast.