---
title: How do I bypass Office 365 Advanced Threat Protection Rules?
description: Bypassing safe links and attachment processing for simulated phishing emails from Hook Security's testing platform can be done by setting up additional mail flow rules.
---

[Skip to content](https://support.hooksecurity.co/-bypass-office-365-advanced-threat-protection-rules#main-content)

English

Show submenu for translations

[Submit a Ticket](https://support.hooksecurity.co/kb-tickets/new?hsLang=en) [Customer Portal](https://support.hooksecurity.co/tickets-view?hsLang=en)

[![Hook\_Logo (3)](https://support.hooksecurity.co/hs-fs/hubfs/Hook_Logo%20(3).png?width=150&height=113&name=Hook_Logo%20(3).png)](https://www.hooksecurity.co/welcome)

- [Tickets](https://6535385.hs-sites.com/tickets-view)
- [Sign out](https://6535385.hs-sites.com/_hcms/mem/logout)

Open main navigation

Close main navigation

- [Tickets](https://6535385.hs-sites.com/tickets-view)
- [Sign out](https://6535385.hs-sites.com/_hcms/mem/logout)
- English
  
  Show submenu for translations
- [Submit a Ticket](https://support.hooksecurity.co/kb-tickets/new)
- [Customer Portal](https://support.hooksecurity.co/tickets-view)
- [Account created in 2026 or later? Go to the Knowledge Base →](https://docs.hooksecurity.co/docs)

[Account created in 2026 or later? Go to the Knowledge Base →](https://docs.hooksecurity.co/docs)

 Hello. How can we help you?

- There are no suggestions because the search field is empty.

1. [Help Center](https://support.hooksecurity.co/?hsLang=en)
2. [Getting Started](https://support.hooksecurity.co/getting-started?hsLang=en)
3. [Microsoft Safelisting](https://support.hooksecurity.co/getting-started?hsLang=en#microsoft-safelisting)

# How do I bypass Office 365 Advanced Threat Protection Rules?

## Bypassing safe links and attachment processing for simulated phishing emails from Hook Security's testing platform can be done by setting up additional mail flow rules.

Advanced Threat Protection (ATP) has link processing and attachment processing rules, which will cause false clicks and false attachment opens to be reported in your mail environment. 

---

#### **How to Add ATP Link Bypassing Rules (Mail Flow Rule)**

Follow the below steps to set up a mail flow rule for bypassing APT link processing:

1. Login to your Exchange/Office Admin center and make a new mail flow rule.
2. Give the rule an intuitive name, like “ATP Link Bypass”
3. Click on **More options…**
4. Click the **Apply this rule if…** drop-down.
5. Select **The senders**.
6. Select **IP address is in any of these ranges or exactly matches**.
7. Enter the Hook Security IP addresses. (For a list of our IP addresses, see below) 
     1. ```
        64.191.166.19664.191.166.197198.61.254.654.80.160.18964.191.166.19854.88.246.21254.240.70.10154.240.70.102
        ```

1. Click on the **Do the following…** drop-down.
2. Select **Modify the message properties…**
3. Select **set a message header**.
4. Click on the link that says **\*Enter text…** Then, set the message header to: 'X-MS-Exchange-Organization-SkipSafeLinksProcessing'
5. Click the second link that says **\*Enter text…** Set the value to: '1'
6. Click on **Save**.

---

#### **How to add ATP Attachment Bypassing Rules**

Follow these steps to set up an ATP Attachment Bypassing Rule:

1. First, create a new mail flow rule in your Exchange/Office Admin center (see the above steps).
2. Give the rule an intuitive name, like “ATP Attachments Bypass”.
3. Click on **more options**.
4. Click on the **Apply this rule if…** drop-down.
5. Choose **The senders**.
6. Select **IP address is in any of these ranges or exactly matches**.
7. Enter portal’s IP address. (For a list of our IP addresses, see [this article](https://hooksecurity.zendesk.com/hc/en-us/articles/360043838591-Why-whitelist-What-should-I-whitelist-).)
8. Click on the **Do the following…** drop-down.
9. Select the **Modify the message properties…** option.
10. Select the **set a message header**.
11. Click on the first **\*Enter text…** link.
12. Set the message header to: 'X-MS-Exchange-Organization-SkipSafeAttachmentProcessing'
13. Click on the second **\*Enter text…** link and set the value to: 1
14. Click on **Save**.

Please allow an hour for the rules to take effect.

- [Getting Started](https://support.hooksecurity.co/getting-started?hsLang=en#main-content)

    - [General](https://support.hooksecurity.co/getting-started?hsLang=en#general)
    - [General Safelisting](https://support.hooksecurity.co/getting-started?hsLang=en#general-safelisting)
    - [Microsoft Safelisting](https://support.hooksecurity.co/getting-started?hsLang=en#microsoft-safelisting)
    - [GSuite Safelisting](https://support.hooksecurity.co/getting-started?hsLang=en#gsuite-safelisting)
    - [Firewall/Spam Filter Safelisting](https://support.hooksecurity.co/getting-started?hsLang=en#firewall-spam-filter-safelisting)
    - [Creating Groups/Adding Targets](https://support.hooksecurity.co/getting-started?hsLang=en#creating-groups-adding-targets)
    - [Reporting Plug-In](https://support.hooksecurity.co/getting-started?hsLang=en#reporting-plug-in)
    - [3rd Party Integrations](https://support.hooksecurity.co/getting-started?hsLang=en#3rd-party-integrations)
    - [Platform Settings](https://support.hooksecurity.co/getting-started?hsLang=en#platform-settings)
- [Hook Academy](https://support.hooksecurity.co/hook-academy?hsLang=en#main-content)

    - [Campaign Ideas](https://support.hooksecurity.co/hook-academy?hsLang=en#campaign-ideas)
    - [Industry Specific Campaigns](https://support.hooksecurity.co/hook-academy?hsLang=en#industry-specific-campaigns)
    - [Course Reviews](https://support.hooksecurity.co/hook-academy?hsLang=en#course-reviews)
    - [Mastering Reporting](https://support.hooksecurity.co/hook-academy?hsLang=en#mastering-reporting)
    - [Becoming Compliant](https://support.hooksecurity.co/hook-academy?hsLang=en#becoming-compliant)
    - [Suggest a Hook Academy Topic](https://support.hooksecurity.co/hook-academy?hsLang=en#suggest-a-hook-academy-topic)
- [Tests/Campaigns](https://support.hooksecurity.co/tests-campaigns?hsLang=en#main-content)

    - [Reseller Only](https://support.hooksecurity.co/tests-campaigns?hsLang=en#reseller-only)
- [School](https://support.hooksecurity.co/school?hsLang=en#main-content)

    - [3rd Party Integrations](https://support.hooksecurity.co/school?hsLang=en#3rd-party-integrations)
    - [Troubleshooting](https://support.hooksecurity.co/school?hsLang=en#troubleshooting)
    - [Branding](https://support.hooksecurity.co/school?hsLang=en#branding)
    - [Course](https://support.hooksecurity.co/school?hsLang=en#course)
    - [Students](https://support.hooksecurity.co/school?hsLang=en#students)
    - [Automations](https://support.hooksecurity.co/school?hsLang=en#automations)
- [Reports](https://support.hooksecurity.co/reports?hsLang=en#main-content)

    - [Generate Reports](https://support.hooksecurity.co/reports?hsLang=en#generate-reports)
- [FAQs](https://support.hooksecurity.co/faqs?hsLang=en#main-content)

    - [Troubleshooting](https://support.hooksecurity.co/faqs?hsLang=en#troubleshooting)
    - [Campaign of the Month](https://support.hooksecurity.co/faqs?hsLang=en#campaign-of-the-month)
- [Reseller Guide](https://support.hooksecurity.co/reseller-guide?hsLang=en)
- [Hook Security Updates](https://support.hooksecurity.co/hook-security-updates?hsLang=en)
- [Onboarding Guides](https://support.hooksecurity.co/onboarding-guides?hsLang=en)
- [Managed Services](https://support.hooksecurity.co/managed-services?hsLang=en)

- [Default HubSpot Blog](https://hooksecurity-6535385.hs-sites.com/blog)

[![Newsletter\_Logo-08](https://support.hooksecurity.co/hs-fs/hubfs/Newsletter_Logo-08.png?width=250&height=59&name=Newsletter_Logo-08.png "Newsletter_Logo-08")](http://hooksecurity.co)

Proudly Headquartered in Lakeland, Floirda

<https://www.linkedin.com/company/hooksecurity>

Copyright © 2026, Hook Security Inc.