Skip to main content

Microsoft Office 365 Defender Basic/Advanced

Nick G
  • Updated

Team: Huntress SAT 
Product: Microsoft Office 365
Environment: SAT, Microsoft Office 365
Summary: Allowlist SAT email in Microsoft 365 Defender 

This article will cover how to Allowlist SAT's training email and phishing simulator email servers in Microsoft 365 Defender.

Step 1. Basic Allowed List

Sign in to Microsoft 365 Defender portal

  1. Scroll down and select Email & Collaboration
  2. Select Policies & rules
  3. Select Threat policies in the list

Step 123

  4.  Under Policies, Select Anti-spam

Step 4

  5.  Select Anti-spam inbound policy (Default)

  6.  Scroll down to Allowed And Blocked Senders and domains to Select Edit allowed and blocked senders and domains in the fly-out

Step 5 6

  7.  In the fly-out under Allowed, select Allowed domains

Step 7


  8.  Click the Add Domains + button to add the following domains one at a time and press Enter/Return to add them to the list.


  9.  When finished select the Add domains button

89


  10.  Select Done

  11.  Click Save


You have now completed the Basic Allowlisting of Security Awareness Training email and notifications. To Allow our Phishing Simulation Servers and Domains follow Step 2 below to bypass Microsofts Advanced Filtering that is not bypassed in Step 1. This includes :

  • Content Filtering
  • High confidence spam
  • High-confidence phishing email

 

Step 2. Advanced Phishing Simulator Allowlist

Sign in to Microsoft 365 Defender portal

  1. Scroll down and select Email & Collaboration
  2. Select Policies & Rules
  3. Select Threat policies in the list

Screen Shot 2022-03-05 at 12.08.04 PM

 

  4.  Scroll down to the Rules section and select Advanced delivery

Screen Shot 2022-03-05 at 12.18.21 PM

 

   5.   Select the Phishing Simulation tab and then select EditScreen Shot 2022-03-05 at 12.50.33 PM

    6. Under Sending Domain add the following SAT Domains and Phishing Domains (one at a time then press Enter/Return to confirm the domain). Currently, Microsoft only allows for 20 domains to be added. Make sure to include the Default Notification domains and adjust the rest of the list as necessary to better suit your target audience.
Default Notifications:

Defaults in phishing scenarios:
Below is a list of domains that you can pick and choose from when building out customized phishing campaigns. Please select up to 2 of the following domains that are best suited for your company, business needs, or target audience. 


 7.  Under Sending IP add the following SAT IPs

  • 18.205.140.116 (Phishing Server)
  • 168.245.36.66 (Training Server)

 8.   When finished select Save.

 

PowerShell

If you are familiar with using PowerShell in the Microsoft Office 365 environment the following PS command can be run in place of manually setting up Defender for the phishing simulated email :

 

Connect-ExchangeOnline -UserPrincipalName "admin@YOURDOMAIN.com";

New-PhishSimOverrideRule -Name PhishSimOverrideRule -Policy PhishSimOverridePolicy -Domains phish.mycurricula.com -SenderIpRanges 18.205.140.116,168.245.36.66;

New-TenantAllowBlockListItems -Allow -ListType Url -ListSubType AdvancedDelivery -Entries "mycurricula.com/*","emailtransaction.com/*" -NoExpiration

What does this shell accomplish?

  • Adds the sending IPs 18.205.140.116 and 168.245.36.66
  • Adds the sending smtp domain found in all message headers: phish[.]mycurricula[.]com
  • Adds the links I've identified for user tracking so they won't be detonated or scanned resulting in false clicks: mycurricula.com/* and emailtransaction.com/*

How do you connect to Microsoft 365 with PowerShell?

https://learn.microsoft.com/en-us/microsoft-365/enterprise/connect-to-microsoft-365-powershell?view=o365-worldwide

 

 

 

Now that you are finished with your allowed listing for your Microsoft 365 account, we recommend a Delivery test via Settings > Phishing > Deliverability test in SAT. Then send an assignment notification and/or phishing campaign to yourself or a small group of employees to verify the allowed listing was successful before launching SAT to your staff.

*If you have any messages that get placed in the user's junk email folders, add all SAT Phishing domains to the allowed list described in Step 1. 

If these steps don’t resolve the issue, let us know by submitting a ticket to our support team.

Comments

0 comments

Please sign in to leave a comment.

Related articles