Creating a Phishing Simulation Rule in the Microsoft Defender

Creating a Phishing Simulation Rule in the Microsoft Defender



In order to whitelist Threatcop into your O365 environment you need to follow the below mentioned steps:

  1. Go to https://www.microsoft365.com/


  2. Locate the square with dots positioned at the upper-left corner. Proceed to access the Security section available in the sidebar menu.

     
  3. You would be successfully redirected to https://security.microsoft.com/




  4. Within the sidebar, navigate to the section labeled "Policies and Rules."


  5. Proceed to locate the section labeled "Threat Policies" and then proceed by clicking on it.




  1. While in the "Rules & Policies" tab, locate the subsection titled "Rules." Within this subsection, proceed to find and select "Advanced Delivery."





  1. Within the "Advanced Delivery" section, you will encounter two distinct sections, namely "SecOps Mailbox" and "Phishing Simulations." Please navigate to the "Phishing Simulations" section.
  2. Creating a Phishing Simulation Rule in the O365 Admin Center.

  3. Upon clicking the "Add" button, you will be presented with three distinct sections, which are Domain, Sender IP, and Simulation URLs, as outlined below.

  4. Kindly enter the below details into the three sections accordingly
  5. Domain:  Domain/URL/Sender ID (depending on the simulation template). (Contact your SPOC incase you are not able to find it)
  6. Sending IP: 202.22.164.131 ,  16.113.17.40
  7. Simulation URLs: Domain/URL (depending on the simulation template).
  8. Once you have filled in the aforementioned details, proceed to click the "Add" button, thereby finalizing the process of whitelisting within the Office 365 environment.