This description is based on the status of the Microsoft 365 Portal in June 2023. Changes to the user interface on the part of Microsoft are possible at any time and must be taken into account accordingly in the implementation.
All information without warranty.
Configuration of Whitelisting for Awareness PLUS in Microsoft 365 (former: Office365)
Last adaption: 06.2023 (2024.11)
New:
- Re-arrangement of the configuration steps
- New sections:
- Advanced delivery for Microsoft 365 Defender
- Secure links in Microsoft 365 Defender
- Configure spoof intelligence
- Whitelisting of technical senders
- Exchange Online Protection spam filter and clutter folder
This article refers to a Resellerpreview
-
Whitelisting
In order to ensure that the simulated phishing emails from the Awareness PLUS training are not blocked by the Microsoft mail server or Microsoft Defender, whitelisting must be configured at various points.
The individual steps should be performed in the given order.
The individual steps should be performed in the given order.
Basic configuration
Advanced delivery for phishing simulations for Microsoft 365 Defender

Fig.1
Log in to the MS365 portal at https://login.microsoftonline.com

Fig.7
Enter the domain of the technical sender here (the entire part following the "@" of the email address, e.g. admin@ttt-point.de → ttt-point.de).
Enter the IPv4 addresses (Listing of all used addresses).
Enter the IPv4 addresses (Listing of all used addresses).
Enter the Simulations-URLs used in the phishing links into the field. The format for entering the URLs is "anyideas.de".
The domains used in the phishing simulation can be stored in Microsoft 365 Defender (formerly Advanced Threat Protection - ATP) so that no warning message is displayed.
Set up secure links in Microsoft 365 Defender

Fig.1
- Login to Microsoft
- Select menu Security

Fig.7
- Selects that URLs can be rewritten
- User clicks should be trackable
- Users should be able to click through to the original URL
- Click on Manage 0 URLs

Fig.9
Enter URLs that are located under "Simulation" → "Whitelisting" → "List of used domains in phishing links". Keep to the format https://domain/*.
Configure spoof intelligence

Fig.1
Log in to the MS365 portal at https://login.microsoftonline.com

Fig.7
The first value must be the spoofed user (display name in the e-mail), which can be found under: Choose tenant
Start page
Simulation 
Email Templates , in the column "Sender".
Second value (separated by a comma) must be the IPv4 address as from Whitelisting. Since there are multiple IP addresses, a complete entry for a spoofed user looks like this:
The Spoof type must be "Internal" and the Action must be set to "Allow".
Second value (separated by a comma) must be the IPv4 address as from Whitelisting. Since there are multiple IP addresses, a complete entry for a spoofed user looks like this:
- user1@Anyideas.de, first IPv4 address
- user1@Anyideas.de, second IPv4 address
- user1@Anyideas.de, third IPv4 address
The Spoof type must be "Internal" and the Action must be set to "Allow".
Further steps
If the above instructions for whitelisting Microsoft products are not sufficient, the following additional steps may help:
Bypass spam and clutter filters in exchange

Fig.1
Log in to the MS365 portal at https://login.microsoftonline.com

Fig.6
- Assign a unique name for the rule (here: Avoid spam and clutter filters
- In the drop-down menu Apply this rule when..., select the entry
- In the drop-down menu, select the entry
- Click on Enter words

Fig.7
Enter the IP adress(es) from the section Whitelisting phishing simulation and confirm with . In the figure are example IPs that are not used!

Fig.9
Enter the following values
- Message-header (1): X-MS-Exchange-Organization-BypassClutter
- Value (2): true

Fig.10
- Click for Proceed as follows
- Select the entry in the drop-down menu
- Select the entry in the submenu
Setting up the IP permission list

Fig.1
Log in to the MS365 portal at https://login.microsoftonline.com

Fig.8
Enter the IP adress(es) from the section Whitelisting phishing simulation and confirm with Save. In the figure are example IPs that are not used!
Setting up technical senders

Fig.1
Log in to the MS365 portal at https://login.microsoftonline.com

Fig.11
Enter the e-mail address of the technical sender from the section Whitelisting phishing simulation.
Click on to save the entries.If the mails still end up in the quarantine, the displayed sender (e.g. sender@anyideas.de) must be entered in addition to the technical sender. </li
Click on to save the entries.
Bypass junk filter
Another rule is needed to bypass the junk filter

Fig.1
Log in to the MS365 portal at https://login.microsoftonline.com

Fig.6
- Assign a unique name for the rule (here i.g.: Bypass Junk Filter by IP Address )
- Select Apply this rule if for
- Select
- Click on Enter words. For that see next figure

Fig.7
Enter the IP adress(es) from the section Whitelisting phishing simulation and confirm with . In the figure are example IPs that are not used!

Fig.8
- Select Do the following in
- Select
- Enter the header message (3) and the value (4) by clicking on Enter text

Fig.9
Enter the following values:
- For message header (1): x-Forefront-Antispam-Report
- For Value (2): SFV:SKI;
- Then click on

Fig.10
- For Rule mode Enforce is selected
- At Severity is sufficient
- At will can be set between which times this rule should be active