Configure Microsoft 365

Riot sends phishing e-mails. Therefore, without proper configuration, some of these e-mails would not pass Microsoft’s spam filter. This would be unfortunate because it would compromise your campaign statistics.

The following guide explains how to avoid this phenomenon, and to allow your campaigns to run smoothly.

Which steps do I need?

The Connection Filter operates at the SMTP connection layer, before message content is evaluated. Adding the Riot IP here tells Exchange Online Protection (EOP) to accept the connection and pass the message to the content filtering pipeline, where the rest of your configuration (transport rules, Advanced Delivery, etc.) can do its job.
​

The Connection Filter IP Allow List is a global bypass, it tells EOP to accept all mail from that IP, regardless of content. This is a valid security concern. However:

Open the Connection filter policy (Default), you must see our IP.

To whitelist Riot, you will need to add the IP address we use to send emails. Go to Exchange admin center and open Mail flow > Rules.
​

Now click the + Add a rule > Create a new rule.

The IP address we will use to send our emails is 159.135.234.25. This IP address is dedicated to Riot and won’t be used by any third parties.

First, start by naming the rule: the name doesn’t really matter, Call it "Riot bypass" for instance.

Then, you will need to apply this rule for the reserved IP address 159.135.234.25. To do that, in the Apply this rule if… list, select The sender….
​

And then IP address is in any of these ranges or exactly matches.

Add IP 159.135.234.25 and save.

Then, under Do the following, select Modify the message properties > set the spam confidence level (SCL), choose Bypass spam filtering and click Save.

You should have a rule like this:

From time to time, some links sent by Riot might be flagged as suspicious. That’s why we suggest to add an additional header to prevent that from happening.

To do that, add a rule like the previous one then:

Select Modify the message properties… and then set a message header.

Then on the right, call the property X-MS-Exchange-Organization-SkipSafeLinksProcessing.

Set the value to 1.

You’re all set now, so don’t forget to Save the rule.

Some organisations give their employees the option to use a “Clutter Folder” in newer versions of Outlook and Exchange.
Add another rule like the previous one with:

Microsoft provides an additional setting that makes it very easy to whitelist Riot emails. Go to the Advanced delivery options and click on Edit.

It will open a side panel. In there, you will have to enter both the domain name noreply.link we use to send phishing emails and the IP address 159.135.234.25. When both match, Microsoft lets the links in our emails through at click.

Then, in Simulation URLs to allow, add the phishing page domains Riot generated for you. You will have about 10 domains to register, listed in Riot under Settings > Domain > Check configuration.

Add one entry per domain, in this exact format: *.domain.com/*. For example (your list will differ):

⚠️ Do not add noreply.link here: it is a sender domain and goes in the Domain field above.

This is the only Microsoft allow list that accepts our phishing links (each one uses its own subdomain) and is checked at click, whichever Safe Links policy covers the user. Microsoft accepts up to 30 entries here.

⚠️ Do not copy the domains from the screenshot below, they are examples.

noreply.link is our default sender domain, but it is not the only one. Each template can send from its own domain, which looks like the service it imitates: for example m1crosoft.com, micros0ft.app or micr0osoft.com for Microsoft templates, dpcsuign.com or docu-sign.pro for DocuSign.

When you create a campaign, Riot lists the sender domains used by the templates you picked, just below them. Add every one of them here next to noreply.link, or the emails sent from the missing ones will not be allowed.

To fully allow emails sent from our sending IP, we need to add another parameter, for this go to this page and click on Add.

This will open a side panel. You must enter the following information *, 159.135.234.25 This allows all senders from Riot's sending IP to be authorized.

Once added, click on Add and here we go!

To avoid blocking our Riot phishing urls by Microsoft Defender, We need to add a configuration in Safe Links, go to this page and click on Create.
If the page is blank, you probably don't have Microsoft Defender and you can skip this step.

Without this step, Microsoft Defender can block our links when an employee clicks them.

Once clicked, a page opens, you will have to pick a name for your safe links policy, eg. "Riot Safe links Policy"

In Users and domains, leave Users, Groups and Domains empty so the policy covers every recipient.

Then, take some time to carefully follow those settings in the picture below 👇

Under Do not rewrite the following URLs in email, click Manage URLs, then Add URLs.

Add each domain listed in Riot under Settings > Domain > Check configuration as its own entry, in this exact format: *.domain.com/*

Then click "next" and choose default for notification. Leave Use custom URLs unchecked: it only changes the warning page users see.

Then click "next" and "finish".

Open Preset security policies in Microsoft Defender. If Standard protection or Strict protection is turned on, Microsoft applies it before the Riot Safe Links policy you just created. For every employee covered by that preset, your Riot policy is ignored, and our links can still be blocked.

In that case, make sure step 5 is done. The Simulation URLs you add there apply to all employees, whatever preset covers them.

If your emails go through another security tool before reaching Microsoft 365 (Proofpoint, Mimecast, Barracuda…), it can block or change our emails before Microsoft sees them. Allow Riot in that tool too, with the same values as in this guide: our sending IP 159.135.234.25, our sender domains and our phishing page domains.

Your network can also block our phishing pages when an employee clicks. A web proxy, firewall or secure web gateway (Zscaler, Cisco Umbrella, Palo Alto, Netskope, Fortinet…) or Microsoft Defender for Endpoint can show its own block page instead of ours. When that happens, Riot records no click, and your results look better than they are. Allow our phishing page domains and all their subdomains in that tool (for example *.domain.com), using the same list as in step 5.

Step-by-step guides: Proofpoint, Barracuda, Vade Secure, Mailinblack, Trend Micro, Sophos, Libraesva, Darktrace (email) · Zscaler (web proxy).

Now that you have configured Microsoft Outlook to receive Riot emails, go back to the platform and test the configuration.

Please note: the configuration may take a few minutes to propagate. If everything is well configured and you encounter a problem, wait 10 minutes and try again.