How to Whitelist an IP Address in Office 365 for Living Security Phish

IP addresses can be whitelisted in 3 different ways in Office 365:

• Using the third-party phishing simulations feature (Recommended)
• Using the threat policies feature (License Required)
• Using the safe links feature (License Required)
• How to Bypass Advanced Threat Protection (ATP) "Attachment" by Using IP Address in Office 365
• How to Bypass Advanced Threat Protection (ATP) "Link" by Using IP Address
• Setting up a mail flow rule to bypass spam filtering
• Troubleshooting

How to Whitelist Using the Third-party Phishing Simulations Feature in Office 365

The below instructions will show you how to whitelist the emails such as notification, training, or phishing simulation emails that will be sent from the platform to users by whitelisting Sender IPs and Domains in the O365 environment in the Phishing Simulation feature.

1. Note the IP addresses to be allowed, found here.
2. Sign in to the Microsoft Security & Compliance Center.
3. Click the Policies & rules item on the left sidebar menu.
4. Go to Threat policies > Advanced delivery.
5. Click the Phishing simulations tab and click Edit.
6. Add the IP address to Sending IP section.
7. Add the Domain address (also known as the MAIL FROM address) used in the phishing campaign into the Domains section.
8. Add the phishing domains (found in the Phishing tool: Phishing Simulator > Settings > Domains) by using *.domain.com/* wildcard syntax to Simulation URLs to allow section.
9. Click Save to complete the process.

How to Whitelist Using the Threat Policies Feature in Office 365

1. Sign in to the Microsoft Security & Compliance Center.
2. Click the Policies and rules item on the left sidebar menu and select Threat Policies.
3. Click the Policies and rules > Anti-Spam under the Policies. To go directly to the Anti-spam policies page, use https://security.microsoft.com/antispam
4. Click the Connection filter policy and select the Edit connection filter.
5. Add the IP addresses to the section labeled Always allow messages from the following IP addresses or address range.
6. Enable the Turn on safe list option.
7. Click Save to complete the process.

How to Whitelist Using the Safe Links Feature in Office 365

1. Sign in to the Microsoft Security & Compliance Center.
2. Click Policies and rules from the left sidebar menu, click Threat Policies and select Safe Links.
3. Click Create.
4. Add a name and description for your safe links policy and click Next.
5. Select your company domain to be included in this policy and click Next.
6. Deselect the Track user clicks option.
7. Add the phishing domains (Found in the Phishing tool: Phishing Simulator > Settings > Domains) by using *.domain.com/* wildcard syntax to the Do not rewrite the following URLs section.
8. Click the Next button and select Submit to complete the process.

Setting up a mail flow rule to bypass spam filtering

1. Log in to your mail server Admin portal. Then, navigate to Admin centers > Exchange.
2. Go to Exchange > Mail flow > Rules and click + button
3. Select the Bypass Spam Filter option.
4. Enter a name for your whitelisting rule.
5. Scroll down to the "Apply this rule if..." section and select "The sender" and then select "IP address is in any of these ranges or exactly matches"
   1. To the right you'll see "Enter text...", click "Enter Words" to bring up a new window labeled specify IP address ranges, and enter the IPs listed here and then click the Save button.
6. Scroll down to the "Do the following" section.
   1. Select the "Modify the message properties" option and then select the "Set the spam confidence level(SCL)" option.
   2. And then click the Set the spam confidence level (SCL) to '-1' option and select "Bypass spam filtering" and click the Save button.
7. Next to the "Do the following" field, click + button to create a new rule.
   1. Select the "Modify the message properties" option and then select the "set a message header" option.
   2. Click "Enter Words" and type "X-MS-Exchange-Organization-BypassClutter" and then click the Save button.
   3. Next, click Enter Words under the "header value" and type "true".
8. We recommend leaving the rest of the rule settings the same. Once you have completed these steps, click Save to save your whitelisting rule.
9. Make sure the whitelisting rule's status is enabled. If it's disabled, click on it and Enable it and click the Edit Rule Settings button on the opened page to save it.

Once you have completed this setup please allow time for the new rule to propagate. Then, set up a test phishing campaign for yourself or a small group to test your new whitelisting rule.

Questions? Contact Us or Submit a Support Request