Phin Security

November 2024 Release Notes 3.16

The November 2024 Release 3.16 introduces a Microsoft Automated Allowlisting integration (open beta) requiring all Phin partners to update their email service provider IPs by January 6, 2025, to ensure phishing simulation email delivery, with new IPs provided for Microsoft Defender, Google Workspace, and third-party tools, plus a new automated allowlisting tool for Microsoft users that simplifies the process, and a mail flow rule feature adding a financial banner to certain emails.

November's Release: Microsoft Automated Allowlisting Integration (Open Beta)

Updated IPs (Allowlisting)

ACTION REQUIRED: Phin Security has updated its email service provider and IP addresses. All Phin partners must update their allowlisted IPs for all clients by 1/6/2025 to continue sending simulated phishing emails. Failure to update allowlists will result in failed delivery.

If your end-users are in Outlook, ensure the following IPs are listed in Microsoft Defender > Advanced Delivery > Phishing Simulation:

  • 198.2.177.227
  • 198.244.59.179
  • 35.237.125.73
  • 198.2.178.214

This can be done manually or using the new Automated Allowlisting solution. At this time, Automated Allowlisting is only available for Microsoft users.

Important Note: Automated Allowlisting should take no more than a couple of minutes per company and can be done simultaneously in new tabs (you don't have to wait for one company to finish before proceeding to the next).

Google Workspace Users

If your end-users are in Google, follow the steps in the Google Workspace Admin article to ensure the IPs listed above are included in your allowlist.

3rd Party Tools (Ex: Inky, Barracuda, Avanon, etc.)

If you are using third-party software, you must add the IPs listed above to those platforms.

Microsoft DMI Users

For tenants only using Microsoft DMI, it is strongly recommended to use the automated allowlisting tool or follow the manual steps in addition to enabling Microsoft DMI to ensure the delivery of phishing and training emails.

Automated Allowlisting for Microsoft

Automated allowlisting performs all the steps for you listed in manual allowlisting with the single press of a button. Follow the instructions to enable automated allowlisting at the company level.

Mail Flow Rule: Financial Banner

This feature, a subset of the Microsoft Automated Allowlisting integration set, will add a banner to the top of all end-user emails that include certain keywords. Learn more about this feature in the knowledge base.

Improvements to Graph API Message Sending (DMI)

The engineering team has reworked the Graph API sending integration to make it easier to use and compatible with more tenants and deployments.

  • The process for sending messages via Graph has been completely reworked, making it significantly more durable and updated to work across more tenant configurations and environments.
  • Attachment sending for Graph API messages has been improved for better compatibility.
  • False positive detection has been improved and expanded, now covering more known Microsoft filtering services that previously caused links to be clicked even with the integration enabled in some environments.

Knowledge Base

Phin updates the Knowledge Base with new features with every release. You can read about the platform and its updates at https://www.phinsec.io/knowledge.

Thanks for using our product!

Feedback helps drive Phin's development direction. Please continue to reach out and help shape the product's future. All ideas are welcome!

The Dev Team @ Phin

Need help or have an idea? Submit a ticket through the knowledge base.