Skip to main content
We've launched our new Knowledge Base! Read the announcement →

Advanced delivery for third-party phishing simulations (Microsoft 365)

Updated

To ensure that all simulated phishing emails actually reach their intended recipients, advanced delivery must be set up in Microsoft 365 Defender. Doing so only takes a few minutes and we have prepared a step-by-step guide to make things easy for you.

  1. Log in to your Microsoft Defender with an administrator account.

  2. Expand the Email & collaboration menu, select Policies & rules, and then choose Threat policies.

  3. Under Rules, select Advanced delivery.

  4. Here, first select the tab called Phishing simulation and then select Edit. A new window titled Edit third party phishing simulations will open.

  5. In the corresponding fields, enter the whitelisting information provided in the SoSafe Manager (Settings / Whitelisting) as follows:

    1. The domains provided under Envelope sender addresses (technical senders) belong in Sending Domain on the Microsoft page. Note that only the domain, the part after the @ (name@domain.com), should be added here, not the entire address.

    2. The IPv4 addresses provided under SoSafe mail servers belongs in Sending IP on the Microsoft page.

Simulation URLs don’t need to be configured here, as this setting only applies to non-email simulations.

  1. Select Save to finish the process. It may take some time for the changes to take effect.

SoSafe Manager whitelisting page with its fold-out menu collapsed, showing the same SoSafe mail servers and Envelope sender addresses sections used to fill in the Sending IP and Sending Domain fields in the Microsoft Defender dialog shown next.
Microsoft Defender Edit third party phishing simulations dialog, showing empty Sending Domain, Sending IP, and Simulation URLs to allow sections, with Save and Cancel buttons at the bottom.