Phin Security

Microsoft: Manual Allowlisting Guide

The Microsoft Manual Allowlisting Guide instructs Microsoft 365 administrators to manually configure advanced delivery settings, anti-spam connection filter policies, and transport rules in the M365 Security Portal to ensure Phin emails—sent from specified IP addresses and containing designated simulated URLs—are successfully delivered to end users' inboxes, while recommending the use of Microsoft's Automated Allowlisting feature for streamlined implementation.

Follow this guide to ensure that your Phin emails arrive successfully to end users' inboxes.

Microsoft Manual Allowlisting

If you're a Microsoft customer, it is strongly recommended to use the Microsoft Automated Allowlisting feature, which performs all the steps listed below automatically.

Step 1: Advanced Delivery Configuration

  1. 1.Go to the M365 Security Portal: https://security.microsoft.com/
  2. 2.Select Email & Collaboration in the sidebar and navigate to Policies & Rules > Threat policies > Advanced Delivery > Phishing Simulation.
  3. 3.Click Edit to add IPs, URLs, and domains (listed below).

Note: Step 2 below is a new additional step for admins who may have already completed Step 1 in the past.

Step 2: Anti-Spam Policy

  1. 1.Go to the M365 Security Portal: https://security.microsoft.com/
  2. 2.Expand Email & Collaboration in the sidebar and navigate to Policies & rules > Threat Policies > Anti-spam.
  3. 3.Click Connection filter policy and then Edit connection filter policy on the flyout.
  4. 4.Add the IP addresses below to the Always allow messages from the following IP addresses or address range field.

Step 3: Transport Rules

  1. 1.Create the transport rules listed here: Enabling Transport Rules

Sending IPs (4)

All messages sent over SMTP are sent through the following IPs:

  • Phishing emails: 198.244.59.179, 35.237.125.73
  • Training & Reminders: 198.2.177.227, 198.2.178.214

Simulated URLs (9)

Make sure to add the URLs exactly as they appear below!

  • .betterphish.com/
  • .shippingalerts.com/
  • .amazingdealz.net/
  • .berrysupply.net/
  • .coronacouncil.org/
  • .couponstash.net/
  • .intelligentbros.com/
  • .creditsafetyteam.com/
  • .autheticate.com/
  • .notificationhandler.com/

Sending Domains (10)

  • phinsecurity.com
  • betterphish.com
  • shippingalerts.com
  • amazingdealz.net
  • berrysupply.net
  • coronacouncil.org
  • couponstash.net
  • intelligentbros.com
  • creditsafetyteam.com
  • autheticate.com
  • notificationhandler.com

Resources