Connect Proofpoint Essentials to Conduit

This walkthrough connects Proofpoint Essentials (MSP-focused email security) to Conduit. Essentials authenticates with your organization administrator’s own console username and password — there’s no separate API key to generate.

Not the same as Proofpoint

Conduit’s catalog also has a Proofpoint entry (under Email Security). That’s Proofpoint TAP (Threat Insight), a different product with a different API, different authentication (service principal + secret), and a different capability surface (threat intel, quarantine, URL defense). Proofpoint Essentials is a separate MSP product — org, domain, user, licensing, and reporting management. If you’re not sure which one you have, check which console you log in to: *.proofpointessentials.com is Essentials; the Threat Insight Dashboard is TAP.

Before you start

You need:

• A Conduit role that can manage connections — owner or admin on your organization.
• A Proofpoint Essentials organization-administrator login for your Essentials console.

Step 1 — Connect Proofpoint Essentials in Conduit

1. In Conduit, go to Connections (/org/catalog). Expected: the vendor catalog.
2. Find Proofpoint Essentials in the catalog (under Email Security) and click Connect. Expected: a credential form with three fields.
3. Fill the fields:
   • Username (required) — your Essentials console admin login.
   • Password (required) — the password for that login.
   • Region (optional) — leave blank to use the default region (us1). If your tenant is hosted in a different Essentials region, enter its code instead.
4. Click Connect.

No live check at connect time

Unlike most vendors, Conduit does not validate this credential against the Proofpoint Essentials API when you click Connect — every Essentials endpoint is scoped to a specific customer domain, and there’s no domain-less way to test a login without risking a false rejection on a valid one. Conduit only checks that both fields are filled in. A green Connected status means the credential was stored, not that it was confirmed correct — a wrong username or password won’t surface until the first real tool call.

The credential is stored at the organization scope, so every technician in your org shares this Proofpoint Essentials connection. (For per-technician credentials, connect at the personal scope instead — see Vendor connections.)

Verify it worked

Connect an MCP client to Conduit — Claude Desktop, Claude Code, Cursor, or any MCP-compatible client (see Connecting an AI client) — and ask it to run a read-only Proofpoint Essentials tool, such as listing an organization’s domains. You should get real data back, and the call appears in your audit log with the correct user, vendor (proofpoint-essentials), and a successful status. This first real call is the actual credential check — see the note above.

Troubleshooting

Symptom	Likely cause
Connect fails with “Username is required” / “Password is required”	One of the required fields was left blank. Fill both and retry.
Connect succeeds, but the first tool call fails with an authentication error	The username/password pair is wrong — Conduit doesn’t catch this at connect time (see the note above). Re-verify the login in your Essentials console and update the credential at /org/catalog.
Tool calls return 403 “no credentials for vendor”	Proofpoint Essentials isn’t connected at a scope this user can resolve. Connect it at the organization scope, or confirm the user’s team has a credential.
Need to rotate the credential	Change the password in your Essentials console (or use a dedicated admin login), then update the credential at /org/catalog.

Related

• Vendor connections — credential scopes, rotation, and the full vendor catalog.
• Security — how Conduit encrypts and resolves the credential you just stored.