# Integrating SailPoint with Mimecast

Mimecast is a cloud-based email security, archiving, and continuity platform that protects organizations against phishing, malware, impersonation, data leakage, and other email-borne threats. It helps administrators manage email users, domains, distribution lists, and aliases while providing visibility and policy controls across the corporate email environment. This document provides instructions to configure a new direct connection to a Mimecast source. For a reference to the terminology specific to SailPoint products, refer to [Source and Connector Definitions](<https://documentation.sailpoint.com/saas/help/sources/index.html#source-and-connector-definitions>).

> [!NOTE]
>
> To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the [SaaS Release Notes](<https://community.sailpoint.com/release-notes/saas>) page.

## Supported Features

The Mimecast connector supports the following:

### Account Management

- Aggregate Users

> [!IMPORTANT]
>
> Quick Compliance connectors have the following manual aggregation limits within a 24-hour period:
>
> - **Organization Admins**: Limited to 3 manual account or entitlement aggregations per day per source. This limit is cumulative across all admins in the organization.
> - **Regular Users**: Limited to 1 manual account or entitlement aggregation per day per source.
>
> These limits ensure that individual compliance statuses are kept up to date while maintaining continuous compliance monitoring. If you need to run additional aggregations beyond these limits, contact SailPoint Support.

## Prerequisites

Ensure the following prerequisites are met before proceeding with the configuration:

- An active Mimecast tenant with administrative access to the Mimecast Administration Console.
- An administrator with permission to create and manage API 2.0 applications and to issue client credentials in Mimecast.
- A registered Mimecast API 2.0 application that produces a Client ID and Client Secret used by the connector for authentication.
- The connector authenticates to Mimecast using OAuth 2.0 Client Credentials grant. The following endpoints must be reachable from the SailPoint environment:

  - The Mimecast API base URL for the appropriate Mimecast region.
  - The Mimecast OAuth 2.0 token endpoint (`token_url`) used to obtain bearer tokens.
- For more information about authentication and credential generation, refer to the following resources:

  - [Mimecast API Credential Management](<https://developer.services.mimecast.com/api-overview#application-registration-credential-management>)
  - [Mimecast API Overview](<https://developer.services.mimecast.com/api-overview>)

## Required Permissions

- API credentials must be created by a Mimecast administrator with privileges to manage API 2.0 applications in the Mimecast Administration Console.
- Administrative role is required to register the API application and to assign it the directory read access required by the connector.
- The connector requires read access to Mimecast directory data (email addresses, aliases, domains, and address metadata) so that account aggregation can return the complete set of managed users.
- Non-administrative or read-restricted credentials that cannot enumerate directory email addresses will cause aggregation to return incomplete results or fail.

  > **Note**
  >
  > Mimecast does not expose role/group entitlement APIs that this connector consumes; therefore, only account aggregation scope is required.
- For more information about authentication and authorization, refer to the following resources:

  - [Mimecast API Authentication and Authorization](<https://integrations.mimecast.com/documentation/api-overview/authentication-and-authorization/>)
  - [Mimecast Developer Documentation Portal](<https://developer.services.mimecast.com/apis>)
  - [Mimecast API Overview](<https://developer.services.mimecast.com/api-overview>)

> [!NOTE]
>
> The linked document is not maintained by SailPoint and is subject to change without notice.