ℹ️ Info
Part of the Getting Started guide, Step 2. Ensure deliverability.
Getting simulation emails into the inbox is only half of it. When a user clicks a simulation link, Microsoft Defender SmartScreen checks the URL again in the browser. If it flags a revel8 landing page as unsafe, the user sees "This site has been reported as unsafe" instead of the simulation. This guide adds the revel8 landing pages as Allow indicators in Microsoft Defender for Endpoint.
📝 Note
You only need this if you use Microsoft Defender for Endpoint (Plan 1 or Plan 2) with SmartScreen on. If you use Defender for Office 365 only, the inbound Whitelisting Guide (Microsoft Defender) covers your setup.
Before you begin
Have these ready:
A Security Administrator or Global Administrator account for security.microsoft.com.
The revel8 landing-page domains: in revel8, open Settings → Whitelisting (in Integrations) and copy every entry under Fake website domains. Copy All copies them in one go.
Depending on your setup, the page may also show a Link Domains section. You do not need it for this guide.
1. Add each domain as an Allow indicator
In security.microsoft.com, open Settings → Endpoints.
Under Rules, click Indicators.
Select the URLs/Domains tab and click Add item.
Fill in the fields:
Indicator: one revel8 fake website domain.
Action:
AllowTitle:
revel8 Simulation allowlistDescription (optional):
Allow list for revel8 phishing simulation URLs
Under Scope, select All devices in my scope.
Click Save.
Repeat steps 3 to 6 for every domain under Fake website domains.
Changes can take up to 30 minutes to reach all devices.
2. Switch the domains on in revel8
Back on the revel8 Whitelisting page, switch on each fake website domain you added. revel8 then uses only those domains for landing pages. If none are switched on, it uses all of them, including ones you have not allowed.
Check that it works
Send a test simulation to yourself and click its link on a managed device. The landing page should open without a SmartScreen warning.