Skip to main content
Microsoft whitelisting comes in one required part and several optional ones. Do the required part first, then add only what your tenant actually runs.

​
Start with domain & IP whitelisting

Domain & IP whitelisting

The primary and recommended method: the mail flow rule, the Advanced delivery phishing simulation policy, and the connector. Start here.

​
Then add whichever of the following apply to your environment

Safe Links

Stops our links being rewritten, which would otherwise break interaction tracking.

Safe Attachments

Stops sandbox detonation registering as a false attachment open.

Web protection

SmartScreen, Defender XDR and web content filtering blocking our landing pages.

Whitelisting by header

Fallback for when domain & IP whitelisting is not possible in your environment.
Skip anything you do not use. If you have no Defender licence and no web content filtering, domain & IP whitelisting on its own is enough.

​
Which ones do I need

​
Testing

Once the parts that apply to you are in place, send a test email from the platform and confirm every interaction is recorded. See Testing your whitelisting.
Safe Links and web protection changes take time to propagate on Microsoft’s side, up to an hour for Safe Links, one to two hours for web protection. Test after that, not before.