Skip to main content
Microsoft’s web protection products (SmartScreen, Defender XDR, web content filtering) block the landing pages our simulations use. Blocked landing pages mean users never reach the educational page, so the training half of the simulation is lost.
Do Domain & IP whitelisting first. This is an addition to it, not a replacement.
A custom indicator policy overrides the blocked category for a specific site, and supersedes web content filtering for the device group it applies to.
1

Open indicators

In the Microsoft Defender portal, go to System then Settings then Endpoints then Indicators then URL/Domain, and click Add Item.
2

Add the domains

Enter the full domain list, one at a time.
3

Describe the indicator

Give it a title such as OutKept phishing domain and a description such as Domain used by OutKept simulations.
4

Set the action

Select Allow.
5

Set the scope

Add it to All devices in my organisation, or a narrower scope that fits your setup.
Microsoft needs time to propagate this. Wait one to two hours before the policy takes effect. Testing earlier looks like a failure that is really just a delay.

​
Then what

Have other security products enabled? Whitelist them now. Once everything that applies to your environment is whitelisted, send a test email from the platform and confirm every interaction is recorded. See Testing your whitelisting.