Allow phishing simulations in Microsoft 365 and Google Workspace

Email security systems check links before a person sees the message. Microsoft Defender Safe Links, Gmail and other filters open the links in incoming emails to make sure they are safe. For a phishing simulation, this means the platform records a click that no employee made, and the report can no longer be trusted. The fix is a one-off setting that tells your mail system which emails belong to an authorised simulation.

This guide is for the IT administrator of a company that runs simulations with Opsinel. The Microsoft 365 and Google Workspace steps follow the vendors’ own documentation (linked at the end), so they apply to other phishing simulation platforms too.

What goes wrong without it

• Safe Links or another filter opens the link while checking the message, and the employee is recorded as having clicked.
• An employee reports the email with the Report button in Outlook, the report is analysed automatically, and that also looks like a click.
• The message is moved to quarantine or junk, or removed after delivery by zero-hour auto purge (ZAP), so the employee never sees it.
• Gmail shows a warning about a suspicious message, and the employee realises at once that it is a test.

Step 1: collect three values

Before changing anything, find out where the simulation emails come from:

Sending IP

The public IP address of the server that sends the simulations.

Sending domain

The domain in the MAIL FROM (envelope sender) address, or the domain that signs the email with DKIM.

Link domain

The domain the simulation links and lesson pages run through. For Opsinel, this is opsinel.com.

Opsinel shows the exact sending domain and IP for each campaign in the “Check before sending” window that opens when you launch a simulation. If you send through your own mail server (SMTP), you can also read them from the header of a test email (Outlook: View → View message source; Gmail: ⋮ → Show original), in the Authentication-Results line:

• “sender IP is …” is the sending IP;
• “smtp.mailfrom=” is the MAIL FROM domain;
• “header.d=” is the DKIM domain.

Each sender has its own IP and domain. If you add another sender later, add its values as well.

Step 2: Microsoft 365 advanced delivery policy

The advanced delivery policy is Microsoft’s supported way to let non-Microsoft phishing simulations through. You need the Security Administrator role in the Defender portal and Organization Management in Exchange Online, or the Security Administrator role in Microsoft Entra.

• Open the Microsoft Defender portal at security.microsoft.com and go to Email & collaboration → Policies & rules → Threat policies → Advanced delivery (in the Rules section).
• Select the Phishing simulation tab, then Add (or Edit, if entries already exist).
• Under Domain, enter the sending domain. You can add up to 50 domains.
• Under Sending IP, enter the sending IP: a single address, a range or a CIDR block. You can add up to 10 entries.
• Leave “Simulation URLs to allow” empty. It is only needed for simulations outside email, such as Teams messages or Office documents.
• Select Add, then Close.

A message is treated as a simulation when it matches at least one domain and one IP on the list. Microsoft 365 filters and ZAP then take no action on it, Safe Links still wraps the links but does not block or open them at the time of click, and the Report button in Outlook does not open the links or raise an alert.

If you prefer PowerShell

In Exchange Online PowerShell, create the policy with New-PhishSimOverridePolicy -Name PhishSimOverridePolicy, then the rule with New-ExoPhishSimOverrideRule -Policy PhishSimOverridePolicy -Domains <domain> -SenderIpRanges <IP>. For now, IPv6 addresses can only be added through PowerShell.

Cases to check

• Your MX record does not point to Microsoft 365 (mail passes through another filter first): the IP in the Authentication-Results header must match the one in the policy. You may need Enhanced Filtering for Connectors.
• You send simulations from your own domain to your own Microsoft 365 tenant: Microsoft does not currently support this internal (DIR:INT) case. Microsoft suggests a dedicated Receive connector that does not treat these messages as internal, or sending directly to your Microsoft 365 MX host. It does not recommend setting intra-organisation scanning to None.
• Do not add simulation links to “Do not rewrite the following URLs in email” in Safe Links policies: according to Microsoft, this can trigger unwanted alerts, and the advanced delivery policy already allows them.
• If a custom Safe Links policy uses “Do not rewrite URLs, do checks via SafeLinks API only”, older Outlook versions may still treat simulation links as threats; in that case Microsoft suggests turning the setting off.
• If reported emails go to a dedicated security mailbox, add it on the SecOps mailbox tab of the same page.

Step 3: Google Workspace Gmail settings

You need the Gmail Settings administrator privilege. All settings are in the Google Admin console under Apps → Google Workspace → Gmail → Spam, Phishing and Malware. Google says changes can take up to 24 hours, though they usually apply sooner.

• Email allowlist: add the sending IP. Messages from it no longer go to spam, but Gmail may still show a warning banner.
• Spam: select Configure or Add another rule, tick “Bypass spam filters and hide warnings for messages from senders or domains in selected lists” and select an address list containing the sending domain (create one if needed). Without a selected list, the option has no effect.

Add only the IP address that sends the simulations to the Email allowlist. If other senders share your mail server’s IP, every message from that IP would skip the spam check.

Inbound gateway: only if warnings remain

Some platforms also suggest adding the sending IP to the Inbound gateway setting. This changes how Gmail treats all mail from that IP: according to Google, it does not enforce the sender’s DMARC policy for messages that arrive through a gateway. Use it only if warnings remain after the two steps above, and never tick “Reject all mail not from gateway IPs”: with it, Gmail rejects mail from every other sender.

Other filters and system emails

• If you use a separate email gateway, URL filter or DNS filter, allow opsinel.com: click tracking and the lesson pages run through it.
• Opsinel system emails (invitations, training assignments, reminders) are sent from mail.opsinel.com. Allow this domain so employees receive them.
• Employees do not need to be told about these settings: they do not reveal when a test will happen.

Step 4: test before the first campaign

• Send a test simulation to a mailbox in your own organisation.
• Check that it arrives in the inbox without a warning banner and that images load.
• In Microsoft 365, find the message in Threat Explorer and filter by System override source = Phishing simulation.
• Click Report in Outlook. No click should appear in the report.
• Now click the link yourself. Only now should a click appear.

If the Report button still creates a click, the advanced delivery policy is not matching the message. Compare the domain and IP in the policy with the Authentication-Results header of the test email.

To see the whole simulation, from the email to the report, go to how Opsinel works.