Skip to main content

Whitelisting Guide (Microsoft Defender)

Let revel8 phishing simulations through Microsoft Defender with an Advanced Delivery policy and a Safe Links exception.

ℹ️ Info
Part of the Getting Started guide, Step 2. Ensure deliverability.

Microsoft Defender filters incoming mail and rewrites links, and both can stop revel8 simulations. This guide sets up two things: an Advanced Delivery policy so simulation emails reach the inbox, and a Safe Links exception so their links open without a warning page.

Before you begin

Have these ready:

  • A Global Administrator or Security Administrator account for security.microsoft.com.

  • The revel8 values from Settings → Whitelisting (in Integrations), or the list your revel8 contact sent you.

⚠️ Warning
revel8 only sends from the email domains and IP addresses that are switched on in Settings → Whitelisting. After you add entries in Defender, switch on exactly those entries in revel8, and no others.

1. Let simulation emails through with Advanced Delivery

  1. Sign in to security.microsoft.com, or open the Defender app from the Microsoft Entra admin center.

    The Microsoft Defender portal home page

  2. In the left navigation, open Email & collaboration → Policies & rules.

    The Policies and rules entry under Email and collaboration in Microsoft Defender

  3. Click Threat policies.

    The Threat policies option in Microsoft Defender

  4. Under Rules, click Advanced delivery.

    The Advanced delivery rule in Microsoft Defender threat policies

  5. Select the Phishing simulation tab, then click Edit.

    The Phishing simulation tab of Advanced delivery with the Edit button

  6. In Edit third-party phishing simulations, fill in the values from revel8 Settings → Whitelisting:

    The Edit third-party phishing simulations panel in Microsoft Defender

    • Sending domain: the entries under Email domains, one per line.

      The Sending domain field in Microsoft Defender with revel8 email domains

    • Sending IP: the entries under IP addresses.

      The Sending IP field in Microsoft Defender with revel8 IP addresses

    • Simulation URLs to allow: leave empty.

  7. Click Save.

Each field takes only a limited number of entries. If Defender will not accept all of them, add as many as it allows, save, and switch on only those entries in revel8. Changes can take up to 30 minutes to apply.

The revel8 Whitelisting page with the switches used to mark entries as whitelisted

2. Stop Safe Links from blocking simulation links

Safe Links rewrites and scans the links in each email. Without an exception, users who click a simulation link can see a warning page like this one instead of the landing page:

The Microsoft Defender Safe Links warning page shown for a blocked link

📝 Note
Safe Links is part of some Microsoft Defender for Office 365 plans only. If you do not see it, check your license.

  1. In security.microsoft.com, open Email & collaboration → Policies & rules → Threat policies.

    Threat policies under Email and collaboration in Microsoft Defender

  2. Under Policies, click Safe Links.

    The Safe Links policy in Microsoft Defender threat policies

  3. Click Create.

    The Create button on the Safe Links policies page

  4. Enter a Name, for example revel8 Simulation Exclusion, and click Next.

    The name step of a new Safe Links policy

  5. Under Users and domains, enter your organization's domain as the recipient domain and click Next.

    The Users and domains step of a new Safe Links policy

  6. In URL & click protection settings, click Manage (0) URLs under Do not rewrite the following URLs in email.

    The URL and click protection settings step with Manage URLs under Do not rewrite the following URLs

  7. Click Add URLs and add every entry under Fake website domains on the revel8 Whitelisting page. If your page also shows a Link Domains section, you do not need it here.

    The list of URLs excluded from rewriting in a Safe Links policy

    The Add URLs dialog in Microsoft Defender

  8. Click Save, finish the remaining steps, and click Submit.

Check that it works

Send a test simulation to yourself. It should arrive in the inbox, not in quarantine, and its link should open the landing page without a warning.

Did this answer your question?

Related Articles