Some third party anti-spam tools interact with emails after they hit the Exchange. Many of these work by having a “mail transport rule” that pushes the email out to a third party anti-spam tool that then inspects the email and sends it back into the mail flow again if the mail is deemed “OK“.
This process changes the email’s IP address, which in turn makes it so that Microsoft does not know it's a phishing simulation - so we need to ensure the IP address is kept original. To avoid this, we put a “mail-flow rule” up in “front” of the “third party anti-spam mail transport rule” that tells the “third party anti-spam mail transport rule” not to run.
How is it done?
When creating a rule to bypass interactions from third party anti-spam solutions such as Avanan, Trend Micro etc, follow the steps below.
Step 1. Create a new rule
Go to Exchange → Mail Flow → Rules → Add new Rule → Create new rule
Step 2: Fill in conditions for the rule
These are the settings you should fill in for the rule.
-
Name the rule: “CyberPilot Phishing simulation”
-
Apply this rule if: “The sender”
-
IP Address is any of these ranges or exact match
-
3.75.105.111
-
3.77.162.184
-
3.120.101.167
-
35.159.187.97
-
91.233.64.66
-
91.233.64.65
-
91.233.64.64
-
-
-
Do the following: “Modify the message properties”
-
Bypass spam filtering “Set the spam confidence level (SCL) -1”
-
Click: “Next”
Step 3: Apply settings to the rule
These are the settings you should fill in for the rule.
-
Rule mode: “Enforce”
-
Severity: “Not specified”
-
Stop processing more rules: “Check”
-
Match sender address in message: “Header”
- Click: “Next”
- Click: “Finish”
- Click: “Done”
Now click on the rule and “Enable” it.
Step 4: Change the priority of the rule
Now click: “Edit rule settings“
Change the priority to: “0” and click: “Save”
Click: “Done”