To ensure that our phishing simulation emails are delivered successfully and not marked as spam, admins need to add our domain and IP address to the allowlist in the Microsoft 365 Admin Center.
Using Check Point Email Protection (Avanan)? If your tenant already has Check Point Email Protection active through Guardz, the phishing simulation domains and IPs listed in this article are automatically added to your Check Point tenant as part of the Guardz integration. No additional configuration steps are needed inside the Check Point portal. Complete only the Microsoft 365 steps in this article.
Prerequisites: administrator access to the Microsoft 365 Defender portal (specifically a role with security administration privileges is required).
Part 1: Ensuring Emails are Successfully Received
Step 1: Log in to the Microsoft 365 Defender Portal
Go to the Microsoft 365 Defender portal
Sign in with your administrator credentials
Step 2: Access Email & Collaboration Policies
In the left-hand navigation pane, go to Email & Collaboration > Policies & Rules
Step 3: Open Threat Policies
Click Threat policies under Policies & Rules
Step 4: Access Advanced Delivery
Select Advanced delivery from the list of options
This section is used to configure overrides and exceptions for special cases such as phishing simulations.
Note: If you don’t see Advanced delivery, check two things:
Confirm that your account has a security administration role. The option is hidden without one.
Open it directly at https://security.microsoft.com/advanceddelivery.
Step 5: Navigate to the Phishing Simulations Tab
In Advanced delivery, open the Phishing simulations tab in the horizontal menu bar
Step 6: Add or Edit a Simulation Policy
You can either:
Click Add to create a new policy, or
Click the pencil icon (Edit) next to an existing policy to modify it
Step 7: Configure Guardz Simulation Details
In the policy form, add the following values.
Domain:
mailpercents.comamazonmsg.commail-support.netmicrosoft-office-365.netuszoom.onlineoraclemsg.netslack-msg.comcisco-msg.comhrsupport-msg.comgɒɒgle.comxn--ggle-v5ba.com(the punycode version of the domain above; Microsoft may reject the special characters, so add both)
Sending IP:
149.72.40.178
URLs:
authwebmail.com/**.authwebmail.com/*cmail31.com/**.cmail31.com/*securesupportcloud.com/**.securesupportcloud.com/*webnotifications.net/**.webnotifications.net/*alerting-services.com/**.alerting-services.com/*hrsupport-msg.comcisco-msg.comslack-msg.comoraclemsg.netuszoom.onlinemicrosoft-office-365.netmail-support.net
Step 8: Save Your Settings
Click Save to apply the changes
Please note:
Changes may take up to 24 hours to take effect across the system
In case emails are still blocked by Microsoft defender, you might be required to add the following domains in addition to the domain you entered in step 7 above:
mail-support.net
microsoft-office-365.net
amazonmsg.com
uszoom.online
gɒɒgle.com
oraclemsg.net
slack-msg.comcisco-msg.com
hrsupport-msg.com
Part 2: Avoiding False Positive Results
Phishing simulations may be flagged by Microsoft Defender for Office 365 due to the Safe Links feature. This can result in false positives, such as automatic email opens or link clicks. To ensure accurate results, follow the steps below to properly allowlist URLs and IP addresses in both Microsoft Defender and Exchange Online.
A. Configure Safe Links in Microsoft Defender
Step 1: Open the Microsoft Security Portal
In the left-hand menu, go to Email & collaboration > Policies & rules > Threat policies
Step 2: Access or Create a Safe Links Policy
Click Safe Links to view existing policies
If no custom policy is listed:
Click Create to define a new Safe Links policy
Make sure all relevant domains are included in the policy’s scope
If a custom policy already exists:
Click the policy to open its details
Step 3: Edit the Protection Settings
Scroll down and click Edit protection settings
Step 4: Add URLs to the Exception List
Find the section Do not rewrite the following URLs
Add all of the following:
https://mailpercents.com/*https://authwebmail.com/*https://*.authwebmail.com/*https://cmail31.com/*https://*.cmail31.com/*https://securesupportcloud.com/*https://*.securesupportcloud.com/*https://webnotifications.net/*https://*.webnotifications.net/*https://alerting-services.com/*https://*.alerting-services.com/*
Configuration in the Microsoft Defender portal is now complete.
Troubleshooting: links are still being clicked or rewritten
If simulation links are still rewritten or show false clicks, check whether the Built-in protection (Microsoft) Safe Links policy is applying to your users. This preset policy covers every recipient who isn’t in the scope of a custom Safe Links policy, and you can’t add exceptions to it.
To fix this, do one of the following:
Create a custom Safe Links policy that covers all affected users and includes the URLs from Step 4. A custom policy takes priority over Built-in protection.
Make sure the Exchange Online rule in Part 2B is in place. Its header tells Microsoft to skip Safe Links processing for Guardz simulation emails.
B. Configure an Allowlist Rule in Exchange Online
Step 1: Open the Exchange Admin Center
Step 2: Create a Mail Flow Rule
In the left-hand menu, click Mail flow > Rules
Click Add a rule, then choose to create a new rule
Step 3: Define Rule Conditions
Enter a name for the rule (e.g., “Allowlist Phishing Simulation IP”)
Under Apply this rule if, select The sender > IP address is in any of these ranges or exactly matches
Enter the IP address:
149.72.40.178
Step 4: Set a Header to Skip Safe Links
Under Do the following, choose Modify the message properties > Set a message header
Set the following values:
Header name:
X-MS-Exchange-Organization-SkipSafeLinksProcessingValue:
1
Step 5: Save and Enable the Rule
Click Save to create the rule
Find the new rule in the list, click it, and make sure the toggle is turned on
Final notes:
For full coverage, it is recommended to add the domain and IP address in both the Microsoft Defender portal and the Exchange Online rule.
After completing the setup, run a test phishing campaign using the newly allowlisted domain to confirm that the configuration works correctly.
These instructions are intended for educational use only. Phishing simulations must be conducted to raise security awareness and educate users. They must never be used to mislead, exploit, or collect sensitive information.