Setup of Phish Threat in Office365

Hello Bjarne,

i am trying to Setup Phish Threat on an Office365 Tenant aswell.

As far as i can tell, none of the Sophos described methods did actually unblock the Defender ATP Safe Links Feature.

If i setup the Rules in this link:

https://support.sophos.com/support/s/article/KB-000037983?language=en_US

i do receive the mails but the Safe Links Defender Features blocks every click from the user.

I tried setup this rules described from Sophos:

https://support.sophos.com/support/s/article/KB-000039921?language=en_US

But no luck.

@Sophos Why is there not a single document on how to actually setup this up with Office 365 and enabled Defender. This is a common problem in the forum, but Sophos... well

I am looking for the "minimal" needed configuration and do not want to blow IPs and URLs in every Safety Dialog i see.

Do you or anyone have working good solution?

Hey Michael,

We have the exact same problem where the phishing emails are still getting the safelinks 'malicious' warning. Sophos analyzed the headers of the phishing emails and they said that it was not attaching the X-MS-Exchange-Organization-SkipSafeLinksProcessing lines. They told me to call Microsoft. I am not very pleased with how they diverted the problem to Microsoft since it seems as though we are not the only organization having this issue. The only workaround was to disable safe links completely (wait 24-48hrs to propagate) and start the campaign. NOT ideal at all but many of our clients are on a deadline to get their cybersecurity insurance and they are required to have a campaign ran. 

Hey Michael,

We have the exact same problem where the phishing emails are still getting the safelinks 'malicious' warning. Sophos analyzed the headers of the phishing emails and they said that it was not attaching the X-MS-Exchange-Organization-SkipSafeLinksProcessing lines. They told me to call Microsoft. I am not very pleased with how they diverted the problem to Microsoft since it seems as though we are not the only organization having this issue. The only workaround was to disable safe links completely (wait 24-48hrs to propagate) and start the campaign. NOT ideal at all but many of our clients are on a deadline to get their cybersecurity insurance and they are required to have a campaign ran. 

Yeah i am still waiting.

As we can see - This thread is soon as 10k views and Sophos reacts as always on these problems  We are in contact with our channel partner who did not get any more information that this. 

In my opinion it is time that Sophos Phish Threat specialist tell us exactly what to do in one simple to follow knowledgebase article and not linking a lot of microsoft pages and other articles, which does not help at all.

Michael et al, we have been working to figure out exactly why it works in some environments and doesn't work in others. There is no technical reason that if you follow the documented procedure that it should not work. I can tell you I personally have two instances in M365, one over a year old, and one a month old and following the configuration it does work for me. Then again I've worked directly with customers where the exact same configuration does not work. We have had one partner who was successful with getting M365 to turn of Secure by Default after providing business justification and whether I believe it or not Microsoft says if the MX record doesn't point to outlook.protection.com that Secure by Default is not enabled. We continue to troubleshoot and work to come up with a solution. 

I will report next week what we found out with out little waiting time ;)

 Michael Schneider Thank you, please keep me posted. Tom Foucha I was reading the Secure by Default article in your other post and Microsoft talks about exceptions: 

• Phishing simulations: Simulated attacks can help you identify vulnerable users before a real attack impacts your organization. To prevent phishing simulation messages from being filtered, see Configure third-party phishing simulations in the advanced delivery policy.

However, we have already configured the Advanced delivery and added 

• 54.240.51.52
• 54.240.51.53
• amazonses.com
• ~eu-west-1.awstrack.me~
• ~sophos-phish-threat.go-vip.co~

We also created the transport rules, added the IPs and domains in the IP allow list and the Allowed senders and domains list and still not working. Just wanted to add more detail on what has been done already.

Hopefully we can find a solution soon. 

Thanks Simon, I've been working with a customer or two where we've done the same configuration and it had no effect and then some customers it has worked. The only other thing I've tried is to adjust the Sophos Pre-Filter to say from any outside organization to inbound organization set the SCL -1. I have been digging into this for the last few weeks more and more which makes me think something has changed at M365. I find no reason why following their documented procedures doesn't work. In the past I had a support case open with Microsoft because of their 20 entry limit and they came back and advised using DKIM domain which is the amazonses.com entry in the above list. The other thing I had some success with in one of my personal instances was disabling Enhanced Connector Security - which prevents Microsoft from looking back in the headers for sending IP. Under Threat Policies look at Enhanced Filtering and turn off any that are enabled and test

Ok here i am, sorry for the late reponse. But my mate who wanted to test this needed off some days.

I will give you some more details. What i can says is that we did somehow get the mails working and safelinks not responding to the links. we did everything in the powershell script from linked here somewhere. 

However we did test with Exchange Online OWA and the OWA for whatever reason ignored the safe links policy.

So far it is working in outlook but not owa. i will keep u updated and as soon as we get it work i will post a updated powershell script version.