Skip to main content

Magenta: Microsoft 365 additional configurations

Updated

Enable images in emails (Outlook Trust Center)

Usually, the automated loading of images in emails is disabled in Outlook. To make the simulated phishing emails more convincing, add two SoSafe domains as exceptions in the Outlook Trust Center.

Microsoft 365 Defender configuration page for Tenant Allow/Block Lists. Left navigation shows Email & Collaboration, Policies & rules, Threat policies. Instructions: Open Defender, select Policies and rules under Threat policies, then Tenant Allow/Block Lists in Rules group.

  1. Select the Spoofed senders tab and then select Add (1)

    Microsoft 365 Defender Tenant Allow/Block Lists showing Spoofed senders tab. Add button marked (1) visible. Allows configuration of sender exceptions. Learn more link to Knowledge Base provided.

  1. Add the entries in the lists (First domain pair and Second domain pair) provided below.

Note that you can only add 20 entries at a time. You must therefore split up the list into two Add/Save procedures.

  1. Copy and paste the list under First domain pair, select Internal as Spoof type, and Allow as Action. Click Add to save the configuration.

Fist domain pair

*, 18.153.184.1
*, 18.153.184.2
*, 18.153.184.3
*, 18.153.184.4
*, 18.153.184.5
*, 18.153.184.6
*, 18.153.184.7
*, 18.153.184.8
*, 18.153.184.9
*, 18.153.184.10
*, 18.153.184.11
*, 18.153.184.12
*, 18.153.184.13
*, 18.153.184.14
*, 18.153.184.15
*, 18.153.184.16
*, 18.153.184.17
*, 18.153.184.18
*, 18.153.184.19
*, 18.153.184.20

Dialog to add domain pairs with a text field containing 20 IP addresses with wildcards. Spoof type set to Internal, Action set to Allow.

  1. Copy and paste the list under Second domain pair, select Internal as Spoof type, and Allow as Action. Click Add to save the configuration.

Second domain pair

*, 18.153.184.21
*, 18.153.184.22
*, 18.153.184.23
*, 18.153.184.24
*, 18.153.184.25
*, 18.153.184.26
*, 18.153.184.27
*, 18.153.184.28
*, 18.153.184.29
*, 18.153.184.30

  1. Confirm that a total of 30 entries have been added to the Tenant Allow/Block Lists

    Microsoft 365 Defender Tenant Allow/Block Lists page with green success banner confirming entries added. Table shows columns for Spoofed user, Sending infrastructure, Spoof type, and Action, displaying 30 items from various IP ranges.

Whitelisting domains with safe links (Microsoft Defender)

This articles only applies to customers with Microsoft Defender for Office 365 licensing.

By default, Microsoft Defender blocks certain elements, including SoSafe learning pages. To prevent that, certain domains used by SoSafe must be added to a policy in Microsoft Defender for Microsoft 365. Doing so only takes a few minutes, and we've prepared a step-by-step guide to make it easy for you.

Microsoft 365 Defender Safe Links page. Breadcrumb shows Policies & rules > Threat policies > Safe links. Create button marked with red box. Wizard steps on left show Name your policy and Users and domains completed, with URL & click protection settings selected.

  1. Give the policy a name and description so you can identify it if you need to make changes in future. Select Next to continue to the Users and domains step.

  2. Here, add your organization’s domain(s) in the input box titled Domains. Select Next to continue to the URL & click protection settings step.

  3. Make sure the checkbox On: Safe Links checks a list of known, malicious links when users click links in email. URLs are rewritten by default is active.

  4. On the same page, select Manage 0 URLs. A new dialog will open.

    Create safe links policy URL & click protection settings page. First checkbox On: Safe Links checks known malicious links is selected. Do not rewrite the following URLs section has red box around Manage 0 URLs link. Track user clicks and Let users click through checkboxes shown.

You will now have to add all URLs shown under List of domains used in the phishing links in the file “SoSafe Whitelisting Manual.pdf”.

Important: The format of the domain should always be like this: https://myDomain.com/*.

Example: the entry “~sosafe.de~” should be added as “https://elearning.sosafe.de/*“.

  1. Select Add URLs on the Microsoft page

    Manage URLs to not rewrite dialog. Add URLs button marked with red box. Search field and empty URLs list showing No data available. Field is ready for entries.

  1. Enter the first URL shown in the file “SoSafe Whitelisting Manual.pdf”

    Add URLs dialog with instruction text Enter a URL. When you're done, click Save to apply changes. URL field shows placeholder https://example.com/*.

  1. Select Save, and repeat steps 1 and 2 until you have added all the URLs.

What to read next and related articles

Related to