Skip to main content
Start here. This is the primary and recommended whitelisting method for Microsoft environments, and it does most of the work. Microsoft has two separate places where our systems need to be whitelisted: rules and policies. Configuring only one of them is the most common reason simulations still end up filtered. Both are needed, along with a connector for stable mail flow.

​
Create a whitelisting rule

1

Open the Exchange admin center

Go to admin.exchange.microsoft.com and sign in with your organisation’s Microsoft 365 account.
2

Create a new rule

In the left menu, go to Mail flow then Rules, and create a new rule.
3

Set the condition

Under Apply this rule if, choose The sender IP address is in any of these ranges or exactly matches, and enter our sending IP addresses.
4

Set the action

Under Do the following, choose Modify the message properties then set the spam confidence level (SCL), and select Bypass spam filtering.
5

Enforce and finish

Make sure the rule mode is set to enforced, then review and click Finish.

​
Configure the phishing simulation policy

Microsoft’s Advanced delivery feature exists specifically for phishing simulations and is the correct mechanism to use. It tells Exchange Online Protection and Defender to leave simulation mail alone without weakening protection against real threats.
1

Open the security portal

Go to security.microsoft.com and sign in.
2

Find Advanced delivery

Go to Email & collaboration then Policies & rules, click Threat policies, and open Advanced delivery.
3

Edit the phishing simulation tab

Click Edit on the Phishing simulation tab.
4

Fill in the three fields

5

Save

Confirm with Save.
Both lists on that page need whitelisting. See Platform domains and Phishing domains. If your environment only allows a limited number of simulation URLs, configure the ones most relevant to you and deactivate the rest under Settings then Campaign.

​
Hitting the 30 simulation URL limit

The portal caps simulation URLs at 30. If you run into that limit, whitelist fewer domains: keep the ones most relevant to you, and deactivate the rest under Settings then Campaign. If you need more than 30, contact support@outkept.com for a PowerShell script that raises the limit.

​
Set up the connector

A connector establishes a stable mail flow between OutKept and Microsoft 365, and enforces TLS on it.
You need administrative permissions in Exchange Online to create a connector.
1

Open the Exchange admin center

From the Microsoft 365 admin center, select Exchange under Admin centers.
2

Go to connectors

Select Mail flow in the left menu, then the Connectors tab.
3

Add a connector

Click Add a connector. Under Connection from, select Partner organization. Connection to is already set to Office 365. Click Next.
4

Name it

Give it a descriptive name, for example OutKept. Click Next.
5

Set the authentication mechanism

Select By verifying that the IP address of the sending server matches one of the following IP addresses, which belong to your partner organization, and add our sending IP addresses. Click Next.
6

Enforce TLS

Check Reject email messages if they aren’t sent over TLS. Leave every other checkbox unchecked. Click Next.
7

Create

Review the settings and click Create connector.
Microsoft’s own reference for this is Set up a connector to apply security restrictions to mail sent from your partner organization.

​
Then what

Have other security products enabled? Whitelist them now. Once everything that applies to your environment is whitelisted, send a test email from the platform and confirm every interaction is recorded. See Testing your whitelisting.