Which Cisco Secure Email Threat Defense visibility and remediation mode is only available when using Cisco Secure Email Gateway as the message source?

Cisco Secure Email Threat Defense offers different integration modes depending on the message source. When using Microsoft 365 as the source, authentication to the Microsoft Graph API is mandatory for visibility and remediation. However, when Cisco Secure Email Gateway (SEG) is the message source, messages can be forwarded to Threat Defense for analysis without requiring Threat Defense to authenticate to the backend mail system. This specific configuration is known as the "No Authentication" mode. In this mode, Threat Defense gains visibility from the data provided by the SEG but cannot perform automated remediation within user mailboxes because it lacks the necessary permissions. This mode is unique to the SEG integration path.

A. Basic Authentication: This is a legacy authentication method and not a specifically named visibility and remediation mode for the Cisco Secure Email Threat Defense and SEG integration.

C. Microsoft 365 Authentication: This mode is explicitly required for integrating with Microsoft 365 as the message source, not for an integration that is exclusive to the Cisco Secure Email Gateway.

D. Cisco Security Cloud Sign On: This is a single sign-on (SSO) mechanism for administrators to access the management portal, not a service-level integration mode for message processing and remediation.

1. Cisco Secure Email Threat Defense User Guide: In the "Administration > Message Source" section

the guide details the configuration options. It explicitly lists "No Authentication" as a mode available when Cisco Secure Email Gateway is selected as the message source. It states

"When you select Cisco Secure Email Gateway as the message source

you can configure Threat Defense in one of the following modes: ... No Authentication." This confirms the mode is tied specifically to the SEG source.

2. Cisco Live Presentation BRKSEC-3560 - "Advanced Phishing Protection with Cisco Email Security": This presentation (and similar official training materials) outlines the architecture of what is now Secure Email Threat Defense. It differentiates the API-based integration with Microsoft 365 (which requires OAuth authentication) from the SEG-based integration where the gateway forwards messages

highlighting that direct mailbox authentication is not required in the latter's simplest visibility configuration. The "No Authentication" mode is a direct reflection of this architectural difference.