> ## Documentation Index
> Fetch the complete documentation index at: https://docs.outkept.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Domain & IP whitelisting

> The primary method: mail flow rule, Advanced delivery, and the connector.

<Warning>
  Deze pagina is nog niet vertaald en staat in het Engels.
</Warning>

Start here. This is the primary and recommended whitelisting method for Microsoft
environments, and it does most of the work.

Microsoft has two separate places where our systems need to be whitelisted: **rules** and
**policies**. Configuring only one of them is the most common reason simulations still end
up filtered. Both are needed, along with a connector for stable mail flow.

## Create a whitelisting rule

<Steps>
  <Step title="Open the Exchange admin center">
    Go to [admin.exchange.microsoft.com](https://admin.exchange.microsoft.com/) and sign in
    with your organisation's Microsoft 365 account.
  </Step>

  <Step title="Create a new rule">
    In the left menu, go to **Mail flow** then **Rules**, and create a new rule.
  </Step>

  <Step title="Set the condition">
    Under **Apply this rule if**, choose *The sender IP address is in any of these ranges or
    exactly matches*, and enter our
    [sending IP addresses](/nl/whitelisting-values#sending-ip-addresses).
  </Step>

  <Step title="Set the action">
    Under **Do the following**, choose *Modify the message properties* then *set the spam
    confidence level (SCL)*, and select **Bypass spam filtering**.
  </Step>

  <Step title="Enforce and finish">
    Make sure the rule mode is set to enforced, then review and click **Finish**.
  </Step>
</Steps>

## Configure the phishing simulation policy

Microsoft's **Advanced delivery** feature exists specifically for phishing simulations and
is the correct mechanism to use. It tells Exchange Online Protection and Defender to leave
simulation mail alone without weakening protection against real threats.

<Steps>
  <Step title="Open the security portal">
    Go to [security.microsoft.com](https://security.microsoft.com/) and sign in.
  </Step>

  <Step title="Find Advanced delivery">
    Go to **Email & collaboration** then **Policies & rules**, click **Threat policies**,
    and open **Advanced delivery**.
  </Step>

  <Step title="Edit the phishing simulation tab">
    Click **Edit** on the **Phishing simulation** tab.
  </Step>

  <Step title="Fill in the three fields">
    | Field | What to enter |
    | - | - |
    | Domain | The [full domain list](/nl/whitelisting-values#domains) |
    | Sending IP | The [three sending IPs](/nl/whitelisting-values#sending-ip-addresses) |
    | Simulation URL | The same [full domain list](/nl/whitelisting-values#domains) |
  </Step>

  <Step title="Save">
    Confirm with **Save**.
  </Step>
</Steps>

<Warning>
  Both lists on that page need whitelisting. See
  [Platform domains](/nl/whitelisting-values#platform-domains) and
  [Phishing domains](/nl/whitelisting-values#phishing-domains). If your environment only
  allows a limited number of simulation URLs, configure the ones most relevant to you and
  deactivate the rest under **Settings** then **Campaign**.
</Warning>

### Hitting the 30 simulation URL limit

The portal caps simulation URLs at 30. If you run into that limit, whitelist fewer domains:
keep the ones most relevant to you, and deactivate the rest under **Settings** then
**Campaign**.

If you need more than 30, contact [support@outkept.com](mailto:support@outkept.com) for a
PowerShell script that raises the limit.

## Set up the connector

A connector establishes a stable mail flow between OutKept and Microsoft 365, and enforces
TLS on it.

<Info>
  You need administrative permissions in Exchange Online to create a connector.
</Info>

<Steps>
  <Step title="Open the Exchange admin center">
    From the [Microsoft 365 admin center](https://admin.microsoft365.com), select
    **Exchange** under Admin centers.
  </Step>

  <Step title="Go to connectors">
    Select **Mail flow** in the left menu, then the **Connectors** tab.
  </Step>

  <Step title="Add a connector">
    Click **Add a connector**. Under **Connection from**, select *Partner organization*.
    **Connection to** is already set to Office 365. Click **Next**.
  </Step>

  <Step title="Name it">
    Give it a descriptive name, for example `OutKept`. Click **Next**.
  </Step>

  <Step title="Set the authentication mechanism">
    Select *By verifying that the IP address of the sending server matches one of the
    following IP addresses, which belong to your partner organization*, and add our
    [sending IP addresses](/nl/whitelisting-values#sending-ip-addresses). Click **Next**.
  </Step>

  <Step title="Enforce TLS">
    Check **Reject email messages if they aren't sent over TLS**. Leave every other checkbox
    unchecked. Click **Next**.
  </Step>

  <Step title="Create">
    Review the settings and click **Create connector**.
  </Step>
</Steps>

Microsoft's own reference for this is
[Set up a connector to apply security restrictions to mail sent from your partner organization](https://learn.microsoft.com/en-us/exchange/mail-flow-best-practices/use-connectors-to-configure-mail-flow/set-up-connectors-to-route-mail).

## Then what

**Have other security products enabled? Whitelist them now.**

| Product | Where to go |
| - | - |
| Other Microsoft products: Safe Links, Safe Attachments, web protection, whitelisting by header | [Microsoft 365](/nl/whitelisting-microsoft-365) |
| Third-party gateways and firewalls: Barracuda, FortiNet, Vade, WatchGuard | [Whitelisting](/nl/whitelisting) |

Once everything that applies to your environment is whitelisted, send a test email from the
platform and confirm every interaction is recorded. See
[Testing your whitelisting](/nl/whitelisting-testing).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.