# Microsoft 365 Whitelist

In this article, we explain the process of **domain whitelisting.** If your organisation operates under the restrictions and security policies of **Microsoft Office 365,** you will need to follow the guidelines provided down below. In this way, you will be able to execute “testing” phishing campaigns towards your personnel, but also send out [Student Notifications](https://docs.cyberawaresecurity.com/admin-portal/student-notifications) regarding their training.

{% embed url="<https://vimeo.com/icsi/microsoft-365-whitelist?share=copy>" %}

&#x20;

**1.** Login to your **Microsoft 365 admin profile** and navigate to your apps. Select the **Admin** option:

![](https://787872742-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdbDWFUV8KfahpvaDhzuK%2Fuploads%2FVYqrs9v3xWVkQsy1Tgzj%2FOffice365_Whitelist_1.png?alt=media\&token=c65dd004-8dfe-4d8b-b7ab-b6b161e2dab0)

**2.** Click on **Show all** to expand:

![](https://787872742-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdbDWFUV8KfahpvaDhzuK%2Fuploads%2FXvZAgvlJflEmnq4mUG0g%2FOffice365_Whitelist_2.png?alt=media\&token=4e7c4830-b9ff-4162-ac00-bf1b6401ff19)

**3.** Navigate to the admin center using the **Security** option:

<figure><img src="https://787872742-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdbDWFUV8KfahpvaDhzuK%2Fuploads%2FZtBxFYs64Mb9k7KEOgLJ%2Fimage.png?alt=media&#x26;token=4387efd7-433a-459e-9ae7-58779a11ded8" alt=""><figcaption></figcaption></figure>

**4.** As From the menu, click on the **Email & collaboration**&#x20;

<figure><img src="https://787872742-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdbDWFUV8KfahpvaDhzuK%2Fuploads%2F7Uxnq106UgZWUyM5YcMh%2Fimage.png?alt=media&#x26;token=ce697a61-cc23-4054-9af3-f57062581cb6" alt=""><figcaption></figcaption></figure>

**5.** Go to **Policies & rules** so you can start setting up your whitelist rules:

<figure><img src="https://787872742-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdbDWFUV8KfahpvaDhzuK%2Fuploads%2FHwYPvdI9LGtrUHcv5Sa3%2Fimage.png?alt=media&#x26;token=0976c705-3f59-49bc-83fe-2fb205962c64" alt=""><figcaption></figcaption></figure>

**6. From Policies & rules click on Threat policies** :

<figure><img src="https://787872742-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdbDWFUV8KfahpvaDhzuK%2Fuploads%2FNUjMbcomOIY2WMZPu6xN%2Fimage.png?alt=media&#x26;token=5c099393-42bc-44f5-b2ad-c845123e0b07" alt=""><figcaption></figcaption></figure>

**7. Click on Advanced delivery:**

<figure><img src="https://787872742-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdbDWFUV8KfahpvaDhzuK%2Fuploads%2Fr21bJSFWceoKNGi5kwpK%2Fimage.png?alt=media&#x26;token=39d9a38b-6567-4d84-b708-39e052ce593c" alt=""><figcaption></figcaption></figure>

**8.** Click on **Phishing simulation**:&#x20;

<figure><img src="https://787872742-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdbDWFUV8KfahpvaDhzuK%2Fuploads%2FQm7JjhlyNRbIGcWI9RQq%2Fimage.png?alt=media&#x26;token=b12dcacb-b147-450c-907d-2eed4b54309e" alt=""><figcaption></figcaption></figure>

**9.** Click on **edit**:

<figure><img src="https://787872742-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdbDWFUV8KfahpvaDhzuK%2Fuploads%2Fvp9L9rwVOqIOhvbEWJXf%2Fimage.png?alt=media&#x26;token=2cacdeb4-5f0c-46a6-915a-33909ef55961" alt=""><figcaption></figcaption></figure>

**10.** Set the domain(s) you would like to **Whitelist** :

<figure><img src="https://787872742-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdbDWFUV8KfahpvaDhzuK%2Fuploads%2FFyeKOag5glEPewHW28fZ%2Fimage.png?alt=media&#x26;token=ec1a941b-0f9d-465b-a56b-b511d731440a" alt=""><figcaption></figcaption></figure>

**11.** Set the domain(s) you would like to **Whitelist from** simulation URLs to allow :

&#x20;

<figure><img src="https://787872742-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdbDWFUV8KfahpvaDhzuK%2Fuploads%2F94zNAfR4RlBkaDuPB4nN%2Fimage.png?alt=media&#x26;token=8765f714-5e0a-4f82-9885-056910eee42a" alt=""><figcaption></figcaption></figure>

**12.** Finally, click on **Save** to apply the changes:

Failing to do so will result in emails arriving at the **spam/junk** folders of target users’ inboxes! Click [here](https://docs.cyberawaresecurity.com/admin-portal/training-campaigns) to learn more about **Training Campaigns** or [here](https://docs.cyberawaresecurity.com/admin-portal/email-campaigns) to dive deeper into **Email Campaigns!**