Setup of Phish Threat in Office365

Hello Bjarne,

i am trying to Setup Phish Threat on an Office365 Tenant aswell.

As far as i can tell, none of the Sophos described methods did actually unblock the Defender ATP Safe Links Feature.

If i setup the Rules in this link:

https://support.sophos.com/support/s/article/KB-000037983?language=en_US

i do receive the mails but the Safe Links Defender Features blocks every click from the user.

I tried setup this rules described from Sophos:

https://support.sophos.com/support/s/article/KB-000039921?language=en_US

But no luck.

@Sophos Why is there not a single document on how to actually setup this up with Office 365 and enabled Defender. This is a common problem in the forum, but Sophos... well

I am looking for the "minimal" needed configuration and do not want to blow IPs and URLs in every Safety Dialog i see.

Do you or anyone have working good solution?

Hello Bjarne,

i am trying to Setup Phish Threat on an Office365 Tenant aswell.

As far as i can tell, none of the Sophos described methods did actually unblock the Defender ATP Safe Links Feature.

If i setup the Rules in this link:

https://support.sophos.com/support/s/article/KB-000037983?language=en_US

i do receive the mails but the Safe Links Defender Features blocks every click from the user.

I tried setup this rules described from Sophos:

https://support.sophos.com/support/s/article/KB-000039921?language=en_US

But no luck.

@Sophos Why is there not a single document on how to actually setup this up with Office 365 and enabled Defender. This is a common problem in the forum, but Sophos... well

I am looking for the "minimal" needed configuration and do not want to blow IPs and URLs in every Safety Dialog i see.

Do you or anyone have working good solution?

Hey Michael,

We have the exact same problem where the phishing emails are still getting the safelinks 'malicious' warning. Sophos analyzed the headers of the phishing emails and they said that it was not attaching the X-MS-Exchange-Organization-SkipSafeLinksProcessing lines. They told me to call Microsoft. I am not very pleased with how they diverted the problem to Microsoft since it seems as though we are not the only organization having this issue. The only workaround was to disable safe links completely (wait 24-48hrs to propagate) and start the campaign. NOT ideal at all but many of our clients are on a deadline to get their cybersecurity insurance and they are required to have a campaign ran. 

Yeah i am still waiting.

As we can see - This thread is soon as 10k views and Sophos reacts as always on these problems  We are in contact with our channel partner who did not get any more information that this. 

In my opinion it is time that Sophos Phish Threat specialist tell us exactly what to do in one simple to follow knowledgebase article and not linking a lot of microsoft pages and other articles, which does not help at all.

Hey Michael,

we have another Spamfilter in front of Office365. Means the Sender IP-Adresses of the Attack E-Mails aren't the one from Sophos. I had to edit them in the rules and since then it seems to work perfectly. I edited the IP-Adresses for the Phishing Simulation as well as the two rules for the attachments and url links. 

I hope that helps you.

Hello Bjarne,

thank you for your insight. But in our case the mx records are directed directly to Exchange Online / Office 365 / Whatever they call it right now :)

Michael et al, we have been working to figure out exactly why it works in some environments and doesn't work in others. There is no technical reason that if you follow the documented procedure that it should not work. I can tell you I personally have two instances in M365, one over a year old, and one a month old and following the configuration it does work for me. Then again I've worked directly with customers where the exact same configuration does not work. We have had one partner who was successful with getting M365 to turn of Secure by Default after providing business justification and whether I believe it or not Microsoft says if the MX record doesn't point to outlook.protection.com that Secure by Default is not enabled. We continue to troubleshoot and work to come up with a solution. 

MFR (Mail Flow Rules) and the configuration isn't any different in terms of exclusions. The only difference I can see is that Microsoft itself in it's documentation says that it does NOT do Secure by Default (high confidence phish detection) IF the MX does not point at M365.

Because Microsoft wants to keep our customers secure by default, some tenants overrides are not applied for malware or high confidence phishing. These overrides include:

• Allowed sender lists or allowed domain lists (anti-spam policies)
• Outlook Safe Senders
• IP Allow List (connection filtering)
• Exchange mail flow rules (also known as transport rules)

https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/secure-by-default?view=o365-worldwide

Secure by default is not a setting that can be turned on or off,

Exceptions:

• Third-party filters: Secure by default only applies when the MX record for your domain is set to Exchange Online Protection (contoso.mail.protection.outlook.com). If it's set to another service or device, it is possible to override Secure by default with a Transport Rule to bypass all spam filtering. When Microsoft detects messages as High Confidence Phish with this rule in place, they still deliver to the Inbox.

Saved you the trouble of clicking on the link, paraphrasing, there are more exceptions.

Hello Tom, thanks for your detailed answer.

To be honest, i am just not sure what it does tell me in my scenario, which we already cleared.
For now we still have the situation that we have a tenant with mx records pointing to micrsofft.

We did all the exception from the script. Even the links does not get "rewritten" and seems "nomal" when hovering over them, but somehow OWA still redirects every click on those links to the Safe Link Engine and blocks the clicks. 

I will report next week what we found out with out little waiting time ;)

 Michael Schneider Thank you, please keep me posted. Tom Foucha I was reading the Secure by Default article in your other post and Microsoft talks about exceptions: 

• Phishing simulations: Simulated attacks can help you identify vulnerable users before a real attack impacts your organization. To prevent phishing simulation messages from being filtered, see Configure third-party phishing simulations in the advanced delivery policy.

However, we have already configured the Advanced delivery and added 

• 54.240.51.52
• 54.240.51.53
• amazonses.com
• ~eu-west-1.awstrack.me~
• ~sophos-phish-threat.go-vip.co~

We also created the transport rules, added the IPs and domains in the IP allow list and the Allowed senders and domains list and still not working. Just wanted to add more detail on what has been done already.

Hopefully we can find a solution soon. 

Thanks Simon, I've been working with a customer or two where we've done the same configuration and it had no effect and then some customers it has worked. The only other thing I've tried is to adjust the Sophos Pre-Filter to say from any outside organization to inbound organization set the SCL -1. I have been digging into this for the last few weeks more and more which makes me think something has changed at M365. I find no reason why following their documented procedures doesn't work. In the past I had a support case open with Microsoft because of their 20 entry limit and they came back and advised using DKIM domain which is the amazonses.com entry in the above list. The other thing I had some success with in one of my personal instances was disabling Enhanced Connector Security - which prevents Microsoft from looking back in the headers for sending IP. Under Threat Policies look at Enhanced Filtering and turn off any that are enabled and test