email quarantine and reason "high confidence phish"
Hi I started testing a phishing email campaign from an external vendor KnowBe4. The emails keep going to quarantine reason "high confidence phish" What is the best way to fix this? I tried excluded the URL from Safe Links and added their sender IPs to O365 Tenant allow/block list. Thank you in advanced.
Attack Simulation goes to Junk Folder
I tried a test simulation that only went to me. However, it went to my junk folder. I didn't see anything in the Attack Simulation documentation about whitelisting and assumed that, since it is all going through Microsoft products, it would just work. Are there other steps I need to have the simulations go to users' mailboxes?
Advanced Delivery for third party phishing attack scenario
Hello MSFT Team, Normally every quarterly we perform the third party phishing attack simulator in the Organization to educate the end user's but this time all the phishing testing emails are getting quarantined by marking as high phishing. After searching on the google found below link to use O365 advanced delivery policy for third party phishing. In the advanced delivery policy we have added: Domain : added sending domain Sending IP : added sending IP Simulation URLs to allow : added simulation URLs as well https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/configure-advanced-delivery?view=o365-worldwide&source=docs Followed the above msft blog and added the rule successfully but still the testing phishing emails are getting quarantined and marked as high phish. But one thing has been observed that third party phishing simulator is hosted on amazonses.com and sending domain is different but we have added only the sending domain. Do I need to add the amazonses.com domain as well in advanced delivery policy. Please can someone shed some light on it as I searching lot of blogs on advanced delivery policy but found nothing. Any help really appreciated. Regards Anand Sunka
Defender for O365 with onprem mailboxes
Hi all, Just wanted to confirm the usability of some features of Defender for O365 when having a exchange hibrid scenario but still most of the mailboxes on-prem. From my understanding not all features will work Safe Attachments (dynamic delivery will not work for onprem mailboxes) Safe Links (works if the MX is pointing to EOP) ATP for SharePoint, OneDrive, and Microsoft Teams (not applicable to EXO) ATP anti-phishing protection (not sure if all settings will work for onprem mailboxes) Real-time detections (reports) Thanks in advanced, Rgs RM
Adding Targeted Users/Groups in Attack Simulator
Is there a setting that may have changed recently or needs to be changed that enables filtering by groups when creating a simulation. I am unable to browse our groups in our organization any longer, I can choose from other options like City, Departments, Titles, etc. but the AD groups do not populate any longer in this list when trying to add Target Users. Thank you, Jerid
