Thread Info
  • Replies 13 replies
  • Subscribers 9 subscribers
  • Views 24659 views
  • Users 0 members are here
Options
Suggested

IP/Domain Whitelist in Microsoft 365

Santosh Barnwal

Note: Please contact Sophos Professional Services if you require direct assistance with your specific environment.

To ensure successful delivery of Phish Threat emails and completion of Phish Threat campaigns, follow these steps to make necessary changes in Microsoft's Advanced delivery settings.

In Microsoft 365 admin center, go to ‘Security’

 

Then, under ‘Policies and Rules’, go to ‘Threat Policies’

 

Click on ‘Advanced delivery’ and then ‘Phishing simulation’

Under Phishing simulation, make the following additions:

Added notes (31-Aug-2022):
Based on the latest tests, we have seen that in some cases with Mailflow configurations, Microsoft still blocks some of the phish simulations emails. To mitigate this, the Sophos IP ranges for the respective regions must be added under Advanced Delivery in M365 admin centre (screenshot above).
The link below has the list of Sophos IP ranges for different regions. You should add only the range specific to your respective regions.


Removed KB
[edited by: emmosophos at 12:22 AM (GMT -8) on 28 Jan 2023]
Parents

  • Just to be fair. We had a meeting today with Sophos and follows all the steps.

    They told us, that this settings described above does not work and are not needed.

    We used the Script from "Aaron Jacobs" who they said is a Sophos Employee to configure our tentant.

    OWA still blocks the Safe Links and we and they had now idea.

    For now we are still on hold and wait until monday if there is some exchange online magic that will happen :)

  • in reply to Michael Schneider

    Hi Michael,

    I think I have the same issues like you, Did you find a fix together with Sophos till now?

    I tried everything in Office365 from normal transport rules with SPAM filtering set to -1 to a whole new phishing campaign policy but even the test e-mails are still marked as spam.  I entered every IP address for my region which they marked on their website as well (besides the two 54er ones which are marked in the Phish Threat campaign in Sophos Central) but till now I was unable to fix that. 

Reply
  • in reply to Michael Schneider

    Hi Michael,

    I think I have the same issues like you, Did you find a fix together with Sophos till now?

    I tried everything in Office365 from normal transport rules with SPAM filtering set to -1 to a whole new phishing campaign policy but even the test e-mails are still marked as spam.  I entered every IP address for my region which they marked on their website as well (besides the two 54er ones which are marked in the Phish Threat campaign in Sophos Central) but till now I was unable to fix that. 

Children
Unfiltered HTML