This will result in a view in the admin portal that looks like this: The Phishing Simulation Advanced Delivery Policy once edited

Adding a new Advanced Delivery Phishing Simulation Policy Once all the IPs are added you can click Add or Save (if editing) the policy as the Simulation URLs are option (see below). You would add all the IPs that your providers send from here as shown: Adding Sending IPs to the Advanced Delivery Policy

In the case of KnowBe4 they list a US and EU range, though the EU range completely encompasses the US range. The Sending IPs that you need are also provided by your simulation provider. You are allowed to add 10 domains to this list, so in cases where the phish simulation provider uses lots of domains it may be that they are all signed with one or two DKIM domains. The Sending Domains value can be the P1 domain of the phish simulation emails and from October 2021 it can be the DKIM signing domain as well. For KnowBe4 this is as shown: Adding a Sending Domain to the Advanced Delivery policy To create the policy you need to add one or more Sending Domains. The Phishing Simulation tab of the Advanced Delivery Policy There is only a single policy, so if you use two or more phish training providers you would add all the values to a single policy. Then click the Phishing Simulation tab.Ĭlick Add to add a new policy (as shown) or Edit if you are updating an existing policy. The Advanced Delivery policy is found in the new Security Center () > Policies & Rules > Threat Policies > Advanced Delivery. The Microsoft “Attack Simulation Training” feature does not require this setup, as this training provider places the messages directly in the mailbox and does not deliver them via SMTP (where they could be filtered out). The IPs and other values you need are obtained from your phish training provider, but this blog post uses (some of) the values from KnowBe4. So to ensure that any third-party phish simulation companies “messages” reach your users, you need to turn on the Advanced Delivery policy. With the introduction of “Secure by Default” in Exchange Online, where you used to add IPs and other settings such as allow-lists to allow your phish training emails to get through to your users this will no longer work, and shortly it will no longer work to bypass the Exchange Online filters using mail flow (transport) rules.

Microsoft secure email powershell