IP/Domain Whitelist in Microsoft 365

Note: Please contact Sophos Professional Services if you require direct assistance with your specific environment.

To ensure successful delivery of Phish Threat emails and completion of Phish Threat campaigns, follow these steps to make necessary changes in Microsoft's Advanced delivery settings.

In Microsoft 365 admin center, go to ‘Security’


Then, under ‘Policies and Rules’, go to ‘Threat Policies’


Click on ‘Advanced delivery’ and then ‘Phishing simulation’

Under Phishing simulation, make the following additions:

Added notes (31-Aug-2022):
Based on the latest tests, we have seen that in some cases with Mailflow configurations, Microsoft still blocks some of the phish simulations emails. To mitigate this, the Sophos IP ranges for the respective regions must be added under Advanced Delivery in M365 admin centre (screenshot above).
The link below has the list of Sophos IP ranges for different regions. You should add only the range specific to your respective regions.

Removed KB
[edited by: emmosophos at 12:22 AM (GMT -8) on 28 Jan 2023]
Parents Reply
  • Sorry for not replying to you sooner - yes, we eventually got this working. In the Microsoft Security Centre > Email & Collaboration > Policies & Rules > Threat Policies > Advanced Delivery > Phishing Simulation - we had to enter the "Simulation URL's to allow" in the following format:


    It does not work without the /* at the end, which was the suggestion from our Microsoft Support case. It does mean that we need to go in and check/add the URL each time, depending on the campaign, as we can only add up to 20 simulation URL's.

No Data