How do I whitelist in Microsoft Defender Advanced Delivery Policy ?

This article details the setup of third-party phishing simulations specific to Hook Security, Inc in the advanced delivery policy.

 For more information about advanced delivery policy, see Microsoft article: Configure the delivery of third-party phishing simulations to users and unfiltered messages to SecOps mailboxes.

1. Microsoft 365 Defender portal
2. Video Instructions
3. Powershell

• NOTE: The following documentation only applies to Office 365 accounts leveraging at least one of the following—Exchange Online Protection; Microsoft Defender for Office 365 plan 1 and plan 2; Microsoft 365 Defender. If your organization does not use any of the products listed, refer to articles— Safelisting by Email Header in Exchange 2013, 2016, or Office 365, Safelisting by IP Address in Exchange 2013, 2016, or Office 365

Microsoft 365 Defender portal

1. In the Microsoft 365 Defender portal (security.microsoft.com) navigate to Email & Collaboration > Policies & Rules > Threat policies > Advanced delivery.
2. On the Advanced delivery page, select the Phishing simulation tab, then do one of the following:
   • Click  Edit.
   • If there are no configured phishing simulations, click Add.
3. On the Edit third-party phishing simulation flyout that opens, configure the following setting:
   • Sending Domain: Expand this setting and enter any domains you plan to test with then press Enter or select the value that is displayed below the box. 
     • Note: You may add up to 20 entries. To change a domain on a template go to Manage Templates and use the multi-select boxes to choose the template(s) and then click "Change Domain". 
   • Sending IP: Expand this setting and enter 64.191.166.196 (US) or 64.238.34.10 (EU) then press Enter or select the value that is displayed below the box. We also recommend safelisting the IP addresses below for improved deliverability: 

     • 198.61.254.6
       54.80.160.189
       64.191.166.198
       54.88.246.212
       54.240.70.101
       54.240.70.102

1. • Simulation URLs to allow: If you are using the URL Redirect feature you will want to add the domains here. For example yourredirect.com 
     • The domains are those associated with the templates you utilize in phishing campaigns. These can be removed from safelisting and replaced with others when campaigns are finished. If you do not have a template selected yet, we do recommend safelisting hooksecuirty[dot]net for system email deliverability. 

2. When you're finished, do one of the following steps:

   • First time: Click Add, and then click Close.
   • Edit existing: Click Save and then click Close.

The third-party phishing simulation entries that you configured are displayed on the Phishing simulation tab. To make changes, click  Edit on the tab.

Troubleshooting

If, after configuring the safelisting rules in Microsoft Defender as shown in this article, the emails are still being delivered to junk or spam, you may need to safelist by email header, as shown in this article. If you use a third-party firewall, such as Proofpoint or Mimecast, the IP address from which the phishing emails come may be rewritten, causing the phishing emails to appear to originate from a different IP address than the one you safelisted.

Video Instructions

Below is a video guide to set up the advanced delivery policy as described above. 

Powershell

Use the scripts below to add or edit phishing simulation Advanced Delivery policies.

The ExchangeOnlineManagement module is required. Installing Powershell modules require administrator privileges. If you do not have administrator privileges, consider adding the -Scope CurrentUser parameter to the Install-Module cmdlet.

Add a Policy

Use the following script if you have not set up a phishing simulation policy.

if (-NOT (Get-Module -ListAvailable -Name ExchangeOnlineManagement)) {
    Install-Module -Name ExchangeOnlineManagement
}
Import-Module ExchangeOnlineManagement

$admin = Read-Host "Exchange admin email or UPN"
Connect-IPPSSession -UserPrincipalName $admin

#input phishing domains below, separated by commas and quoted (20 domain maximum). E.g. "$domains = 'example.com','example2.com','example3.com', ..."
$domains = ''

New-PhishSimOverridePolicy -Name PhishSimOverridePolicy
New-PhishSimOverrideRule -Name PhishSimOverrideRule -Policy PhishSimOverridePolicy -Domains $domains -SenderIpRanges 64.191.166.196

Edit a Rule

Use the following script if your tenant has existing phishing simulation rules.

if (-NOT (Get-Module -ListAvailable -Name ExchangeOnlineManagement)) {
    Install-Module -Name ExchangeOnlineManagement
}
Import-Module ExchangeOnlineManagement

$admin = Read-Host "Exchange admin email or UPN"
Connect-IPPSSession -UserPrincipalName $admin

#input phishing domains below, separated by commas and quoted (20 domain maximum). E.g. "$domains = 'example.com','example2.com','example3.com', ..."
$domains = ''

$rule = Get-PhishSimOverrideRule
Set-PhishSimOverrideRule -Identity $rule.Name -RemoveSenderIpRanges $rule.SenderIpRanges -RemoveDomains $rule.Domains -AddDomains $domains -AddSenderIpRanges 64.191.166.196
Get-PhishSimOverrideRule

Remove a Policy

If you wish to remove a phishing simulation policy, use the script below.

if (-NOT (Get-Module -ListAvailable -Name ExchangeOnlineManagement)) {
    Install-Module -Name ExchangeOnlineManagement
}
Import-Module ExchangeOnlineManagement

$admin = Read-Host "Exchange admin email or UPN"
Connect-IPPSSession -UserPrincipalName $admin

Remove-PhishSimOverridePolicy -Identity PhishSimOverridePolicy

For more helpful cmdlets and scripts, please see the Microsoft documentation.