Zurich: Microsoft 365 DMI whitelisting

Prerequisites / Who can use DMI?

You can use Microsoft DMI if your organization meets these conditions:

• Your mailboxes are hosted entirely on Microsoft 365 Exchange Online.

• All users receiving the simulation emails are in a single Microsoft 365 tenant.

• All email domains are owned and managed by your organization.

Limitations

DMI is not supported in the following cases:

• You use an on-premise or hybrid Exchange server.

• Users are spread across multiple Microsoft 365 tenants.

• You use non-company domains (e.g., @hotmail.com).

Benefits of using DMI

Here are the main advantages of using DMI over standard SMTP delivery:

• Improved email delivery: Traditional SMTP delivery can cause simulation emails to be caught by spam filters or quarantined. DMI bypasses these filters by delivering emails directly via a secure API connection, ensuring they reach user inboxes.

• Simplified whitelisting & less maintenance: You no longer need to whitelist or maintain our list of IP addresses. With DMI, you only need to grant access to our Azure Enterprise App, giving you more effective control over system access.

• Quicker setup: The setup process is faster as it reduces the dependency on your IT team for mail server changes. This allows you to launch your awareness program more quickly.

What permissions does SoSafe require in Microsoft Entra ID?

To create the SoSafe Email Connector, we require a Microsoft 365 account with Microsoft Entra ID administrator rights. However, after the creation, only two permissions are needed to deliver simulated phishing emails through DMI:

• user.readbasic.all: Allows SoSafe to read basic user profiles within Microsoft Entra ID.

• mail.readwrite: Enables SoSafe to identify inbox locations and inject phishing simulations correctly.

For further assistance, contact SoSafe Support or your Point of Contact.

Configure Microsoft DMI integration

1. Go to the client settings and open the Whitelisting menu item on the left side.

2. Under DMI Whitelisting, expand the Microsoft 365 option and select one of the following options:

If you have a Microsoft 365 account with Microsoft Entra ID administrator rights:

1. Click Connect to open the Microsoft Sign in page.

2. Log in with your Microsoft admin account.

3. Review the required permissions for the SoSafe Email Connector application.

4. Click Accept on the Permissions requested page to authorize the integration.

If you do not have administrator rights:

1. Click I’m not an admin.

2. Ask the Microsoft Entra admin for the organization’s Tenant ID.

3. Enter the Tenant ID in the corresponding field and select Generate consent link.

4. Select Copy Link and send this link to your Microsoft Entra admin to approve the authorization.

5. The Microsoft 365 DMI Whitelisting menu should now show the Waiting for confirmation status.

3. For the first scenario, or once the admin has approved the authorization, the Microsoft 365 DMI Whitelisting menu should now show the Connected status.

Removing Microsoft 365 DMI integration

To entirely remove the Microsoft 365 Direct Message Injection (DMI) whitelisting setup, follow these two steps:

1. Disconnect the SoSafe DMI connector by clicking on Disconnect. This step is initiated and completed from within the Zurich Cyber Security Awareness Platform. Once disconnected, no further emails will be injected via DMI.

2. Then, to entirely revoke the SoSafe Email Connector permissions from the client side, a Microsoft Entra Admin must manually remove the SoSafe app from the Entra ID Enterprise apps list.

   1. Open the Microsoft 365 Admin Center.

   2. Open the Microsoft Entra admin center and click on Enterprise apps.

c. Under All applications, select [SoSafe] Email Connector.

d. In the Overview page, click on Properties and then click on Delete.

e. In the confirmation page, click Yes.

What to read next and related articles

• Zurich Cyber Security Awareness: Whitelisting guide

• Zurich Cyber Security Awareness: Microsoft 365 IP-based whitelisting