Thread Info
  • Replies 14 replies
  • Subscribers 10 subscribers
  • Views 32901 views
  • Users 0 members are here
Options
Suggested

IP/Domain Whitelist in Microsoft 365

Santosh Barnwal

Note: Please contact Sophos Professional Services if you require direct assistance with your specific environment.

To ensure successful delivery of Phish Threat emails and completion of Phish Threat campaigns, follow these steps to make necessary changes in Microsoft's Advanced delivery settings.

In Microsoft 365 admin center, go to ‘Security’

 

Then, under ‘Policies and Rules’, go to ‘Threat Policies’

 

Click on ‘Advanced delivery’ and then ‘Phishing simulation’

Under Phishing simulation, make the following additions:

Added notes (31-Aug-2022):
Based on the latest tests, we have seen that in some cases with Mailflow configurations, Microsoft still blocks some of the phish simulations emails. To mitigate this, the Sophos IP ranges for the respective regions must be added under Advanced Delivery in M365 admin centre (screenshot above).
The link below has the list of Sophos IP ranges for different regions. You should add only the range specific to your respective regions.


Removed KB
[edited by: emmosophos at 12:22 AM (GMT -8) on 28 Jan 2023]
Parents

  • Just to be fair. We had a meeting today with Sophos and follows all the steps.

    They told us, that this settings described above does not work and are not needed.

    We used the Script from "Aaron Jacobs" who they said is a Sophos Employee to configure our tentant.

    OWA still blocks the Safe Links and we and they had now idea.

    For now we are still on hold and wait until monday if there is some exchange online magic that will happen :)

Reply

  • Just to be fair. We had a meeting today with Sophos and follows all the steps.

    They told us, that this settings described above does not work and are not needed.

    We used the Script from "Aaron Jacobs" who they said is a Sophos Employee to configure our tentant.

    OWA still blocks the Safe Links and we and they had now idea.

    For now we are still on hold and wait until monday if there is some exchange online magic that will happen :)

Children
  • in reply to Michael Schneider

    Hi Michael,

    Yep, am a Sophos employee but should clarify this is not a Sophos script. I was an MSP/partner before joining Sophos, and we made this script up after a lot of issues getting Phish Threat going around Safe Links, and what I will call "well configured" M365/Defender/Exchange Online Protection policies. As far as I am aware, the script is still be using today successfully by my old MSP.

    I assume you looked over the script and modified it to suit, but you will note it's making some transport rules, it has an array of domains to be excluded for Safe Links, and it creates a Safe Links Policy. 

    It also adds some AntiPhish domain exclusions, and some AntiPhish email address policies.

    Finally, it adds the domains in the Hosted Content Filter Policy.

    I troubleshooted this for a long time, and it was not until we did all of these things that Microsoft would actually leave the emails alone, based on how we had configured M365. In case it helps, they were largely based around the recommendations from https://www.itpromentor.com/

    I'd suggest looking over the script, making sure the IP addresses in there and domains match whatever PhishThreat is telling you to exclude today, look for errors when you ran the script, and double check that what the script is setting, actually did get applied (and doesn't conflict with anything else you already have configured).

    Let me know how you get on and I can check in to see if this script is still working as planned for my old MSP.

    All the best,

  • in reply to Michael Schneider

    Hi Michael,

    I think I have the same issues like you, Did you find a fix together with Sophos till now?

    I tried everything in Office365 from normal transport rules with SPAM filtering set to -1 to a whole new phishing campaign policy but even the test e-mails are still marked as spam.  I entered every IP address for my region which they marked on their website as well (besides the two 54er ones which are marked in the Phish Threat campaign in Sophos Central) but till now I was unable to fix that. 

  • in reply to Victoria Köckeritz

    No sorry, i still do not have a solution for OWA. OWA runs into safe links whatever i do.

  • in reply to Michael Schneider

    Hi again, 

    after a few discussions with Sophos.... only Microsoft could help and I can gladly say that together with Mr. David Kreid from Microsoft Exchange Support I solved the problem today. 

    We expanded the IP range of the phishing simulation to 94.140.18.200-94.140.18.254 for the German region and added all domains which Sophos mentions in their sending domains and IP's list in Sophos Central as URLs!!

    For example we added the mail-sender.online as an URL using ~mail-sender.online~ after this I finally received my test phishing mail. 

    Maybe this works for you too!

  • in reply to Victoria Köckeritz

    Hello Victoria,

    thank you for your hint.

    On our site we have setup a new customer tenant and everything works fine with the settings sophos hast posted here:
    Sophos Phish Threat: Add IP addresses and domains in the allow list

    Tbh i think in this case the sophos knowledgebase article was correct all the time and it was a bug on the microsoft site.

    At least for now i cannot reproduce. I will came back if i can.

Unfiltered HTML