Bypassing Microsoft 365 (formerly Office 365) Advanced Threat Protection (ATP) / Defender for Office - By Email Header

Support Desk
  • Updated
Follow

IMPORTANT NOTICE: Since Microsoft rolled out the "Secure by Default" standard in October 2021, the required method of allowlisting has changed. To correctly allowlist in Exchange and Office 365 environments, please see our article Allowlisting via Microsoft Advanced Delivery.

In order for Phishing Tackle's emails to function correctly, there are two sections that require additional rules to bypass all of Microsoft's Advanced Threat Protection system.

These two sections can be divided as follows (click to jump straight to that section):

 

Mail flow rules

NOTE:
As a precaution, we recommend waiting one hour after enabling the mail flow rules before testing them on a small group of recipients before running any large phishing campaigns. 

 

Advanced Threat Protection (ATP) Attachment Bypass Rule - By Email Header

NOTE:

If you are using a cloud-based spam filter you must create a mail flow rule to bypass ATP link processing by email header. This is because your cloud-based spam filter will change the IP address of the mail we send.

To bypass ATP Attachment Processing, set up the following mail flow rule:

  1. Log into the Microsoft 365 (formerly Office 365) portal and select "Admin centers" > "Exchange".
    ATP - Attachment Bypass Rule - IP addresses - Exchange.png

  2. Select "Mail flow" to expand the settings menu then select "Rules".
    ATP - Attachment Bypass Rule - IP addresses - Mail Flow.png
  3. Click "Add a rule".
    ATP - Attachment Bypass Rule - IP addresses - New Rule.png

  4. Click "Create a new rule".
    ATP - Attachment Bypass Rule - IP addresses - Create Rule.png

  5. Give the rule a name, e.g., "Bypass ATP Attachment Processing - Email Header".
    ATP_-_Attachment_Bypass_Rule_-_Email_Header_-_Name.png

  6. Under "Apply this rule if" select "The message headers" > "includes any of these words".
    ATP_-_Attachment_Bypass_Rule_-_Email_Header_Apply.png
  7. Then enter Phishing Tackle's Email Header Information and Email Header Text. (Our Email Header values can be found here.) Then hit "Save".
    ATP - Attachment Bypass Rule - Email Header Value.png
  8. Under "*Do the following" select "Modify the message properties..." > "set a message header".
    ATP - Attachment Bypass Rule - Email Header - Do.png

  9. Edit the properties of this by selecting the "Enter text" buttons:
    ATP - Attachment Bypass Rule - IP addresses - Enter text.png

    Use the following entries:
    Set the message header to "X-MS-Exchange-Organization-SkipSafeAttachmentProcessing" and set the value to"    1".
    ATP - Attachment Bypass Rule - IP addresses - Value Header.png
  10. Click "Next".
  11. Leave all settings in "Set rule settings" as their default values and click "Next".
    ATP - Attachment Bypass Rule - IP addresses - Rule Settings.png

  12. Review your settings and click "Finish".
    ATP - Attachment Bypass Rule - Email Header Review.png

WARNING, PLEASE READ CAREFULLY:

The next rule to implement is dependent on whether you use Defender for Office 365 (ATP) Plan 1 or Plan 2.

Do not implement BOTH rules below as they will interfere with each other.

 

If you do not know which Defender plan you have...

Simply follow the guide for PLAN 2. If the Safe Links policy (on step 5) is not available, you have PLAN 1.

 

Plan 1 - Advanced Threat Protection (ATP) Link Bypass Rule - By Email Header

To bypass ATP Link Processing, set up the following mail flow rule:

  1. Log into the Microsoft 365 (formerly Office 365) portal and select "Admin centers" > "Exchange".
    ATP - Attachment Bypass Rule - IP addresses - Exchange.png
  2. Select "Mail flow" to expand the settings menu then select "Rules".
    ATP - Attachment Bypass Rule - IP addresses - Mail Flow.png
  3. Click "Add a rule".
    ATP - Attachment Bypass Rule - IP addresses - New Rule.png

  4. Click "Create a new rule".
    ATP - Attachment Bypass Rule - IP addresses - Create Rule.png

  5. Give the rule a name, e.g., "ATP Link Processing - Email Header".
    ATP Link Processing - Email Header - Name.png

  6. Under "Apply this rule if" select "The message headers..." > "includes any of these words".
    ATP Link Processing - Email Header - Apply Rule.png

  7. Then enter Phishing Tackle's Email Header Information and Email Header Text. (Our Email Header values can be found here.) Then hit "Save".
    ATP Link Processing - Email Header - Header Value.png

  8. Under "*Do the following" select "Modify the message properties..." > "set a message header".
    ATP Link Processing - Email Header - Do.png

  9. Edit the properties of this by selecting the "Enter text" buttons:
    ATP - Link Processing Rule - By IP Address - Enter Text.png

    Use the following entries:
    Set the message header to "X-MS-Exchange-Organization-SkipSafeLinksProcessing" set the value to"    1".
    ATP - Link Processing Rule - By IP Address - Entry.png
  10. Click "Next".
  11. Leave all settings in "Set rule settings" as their default values and click "Next".
    ATP Link Processing - Email Header - Rule Settings.png

  12. Review your settings and click "Finish".
    ATP Link Processing - Email Header - Review.png

Plan 2 - URL rewriting rules

  1. The full list of Phishing Tackle phishing URLs can be found within the Phishing Tackle platform. Our knowledge base article here will explain how to access this list. leave the page open, you'll need it later on!

  2. Log into the Microsoft 365 (formerly Office 365) portal and select Admin centers > Security.
    Microsoft_ATP_rules_2.2.png

  3. Under "Email & collaboration" in the left-hand column click "Policies & rules".
    ATP_-_URL_rewriting_rules_-_Policies___Rules.png

  4. Click "Threat policies".
    ATP_-_URL_rewriting_rules_-_Threat_Policies.png

  5. Click "Safe Links".
    ATP_-_URL_rewriting_rules_-_Threat_Policies_-_Safe_Links.png

  6. Click "Create".
    ATP_-_URL_rewriting_rules_-_Threat_Policies_-_Safe_Links_-_Create.png

  7. Enter a name for your Policy, then click "Next".
    ATP_-_URL_rewriting_rules_-_Threat_Policies_-_Safe_Links_-_Name_Policy.png

  8. Specify the users, groups, or domains you would like to use this policy. Then click "Next".
    ATP_-_URL_rewriting_rules_-_Threat_Policies_-_Safe_Links_-_Users.png

  9. For the "Email" section we recommend disabling:
    • Apply Safe Links to email messages sent within the organization.
    • Wait for URL scanning to complete before delivering the message.
      ATP_-_URL_rewriting_rules_-_Threat_Policies_-_Safe_Links_-_Settings.png

  10. Under "Do not rewrite the following URLs in email" click "Manage 0 URLs"
  11. Click "Add URLs".
    ATP_-_URL_rewriting_rules_-_Threat_Policies_-_Safe_Links_-_Manage_URLs.png

  12. Finally, in the "ADD URLs" section, add the list of root domains from the page in Step 1. Each domain must be added using the format https://[rootdomain]/* so if you are adding the root domain "phishingdomain.com", you need to enter https://phishingdomain.com/*

    You can find all our phishing domains here.
    ATP_-_URL_rewriting_rules_-_Threat_Policies_-_Safe_Links_-_Add_URLs.png
  13. Click "Save".
  14. Click "Done".
  15. The settings within "Teams", "Office 365 Apps", and "Click protection settings" can be left as the default setting.
    ATP_-_URL_rewriting_rules_-_Safe_Links_-_Teams__Apps__Click.png
  16. Click "Next".
  17. The notification settings can be left as the default setting.
    ATP_-_URL_rewriting_rules_-_Threat_Policies_-_Safe_Links_-_Notification.png
  18. Click "Next".
  19. Review your ATP Link Policy and click "Submit".
    ATP_-_URL_rewriting_rules_-_Threat_Policies_-_Safe_Links_-_Review.png

 

Please let us know if you require any further assistance, you can contact our support team by clicking here. Or by sending an email to support@phishingtackle.com

Related articles