Microsoft — Phishing Simulation Allowlisting Guide

This guide outlines the four required configurations to ensure phishing simulation emails and training notifications are properly delivered in Microsoft 365. Each configuration must be completed to bypass Microsoft’s layered filtering mechanisms.

📘 4 configurations:

1. Allowlist Phishing Simulation Emails in Microsoft 365 (EAC + EOP)
2. Allowlist Phishing Domains in Microsoft Defender Safe Links
3. Basic Allowed List
4. Advanced Delivery Configuration (Phishing Simulation)

1. Allowlist Phishing Simulation Emails in Microsoft 365 (EAC + EOP)

This configuration creates a mail flow rule to ensure phishing simulation emails bypass Microsoft’s spam filtering by assigning an SCL of -1, while using sender IP, sender domain, and authentication results to maintain security.

1. Sign in to the Exchange Admin Center at
   https://admin.exchange.microsoft.com/
2. Select Mail flow → Rules → Add a rule.
3. Name the rule:

Allowlist Phishing Simulation – Bypass Spam

4. Under Apply this rule if…, configure:

   • The sender → IP address is in any of these ranges or exactly matches
     Add all phishing simulation sending IPs.
   • The sender → domain is
     Add all domains used by the phishing simulator.

5. Under Do the following…, select:
   Modify the message properties → Set the spam confidence level (SCL)
   Set the value to:

-1

6. Under Except if…, configure:
   • The message headers → includes any of these words
     Header name: Authentication-Results
     Value contains: dmarc=pass

7. Scroll to Settings and configure:
   • Priority: 0
   • Mode: Enforce
   • Severity: High
   • Stop processing more rules: Enabled
   • Match sender address in message: Header

8. Select Save to apply the configuration.

2. Allowlist Phishing Domains in Microsoft Defender Safe Links

This configuration prevents Microsoft Defender Safe Links from rewriting phishing simulation URLs, ensuring simulation links operate correctly during training campaigns. A fallback method using a mail flow rule is also included for environments where Safe Links cannot be edited.

1. Sign in to the Microsoft Defender portal at
   https://security.microsoft.com/
2. Select Email & collaboration → Policies & rules → Threat policies.
3. Under Policies, select Safe Links.
4. Select the policy that applies to your users.
5. Select Edit protection settings or Manage policy.
6. Locate the section titled:

Do not rewrite the following URLs in email

7. Add the phishing simulation domains to the list.
8. Select Save and allow time for propagation.

3. Basic Allowed List

This configuration adjusts the default Anti-Spam policy to ensure phishing simulation domains and SAT notification domains are permitted by Microsoft’s standard filtering layers.

1. Sign in to the Microsoft 365 Defender portal at
   https://security.microsoft.com/
2. Select Email & Collaboration.
3. Select Policies & rules.
4. Select Threat policies.
5. Under Policies, select Anti-spam.
6. Select Anti-spam inbound policy (Default).
7. Scroll down to Allowed and blocked senders and domains and select
   Edit allowed and blocked senders and domains.

8. Under Allowed, select Allowed domains.
9. Select + Add domains and add domains one at a time.
10. Select Add domains to confirm.

11. Select Done.
12. Select Save.

4. Advanced Delivery Configuration (Phishing Simulation)

This configuration defines the phishing simulation domains and IP addresses used by your simulation platform, enabling Microsoft’s Advanced Delivery system to bypass high-confidence spam, high-confidence phishing, and content filtering.

1. Sign in to the Microsoft 365 Defender portal at
   https://security.microsoft.com/
2. Select Email & Collaboration → Policies & rules → Threat policies.
3. Scroll down to the Rules section and select Advanced delivery.
4. Select the Phishing Simulation tab and then select Edit.
5. Under Sending Domain, add the phishing simulation domains one at a time
   (Microsoft allows up to 30 domains).
6. Under Sending IP, add the phishing simulation server IPs.

7. Select Save to apply your changes.