Riot phishing and smishing simulations take employees to a fake login page hosted on a Riot domain. Microsoft Defender SmartScreen, built into Edge, can flag these pages as unsafe. When that happens, the employee sees a red warning page instead of the simulation, and your campaign results no longer show how employees really behave.
What an employee sees when SmartScreen flags a simulation page. Illustration, the real page may look slightly different.
Add the Riot simulation domains to Edge's allowlist to stop the warning.
Did you know? The allowlist only turns off SmartScreen checks for the domains you add. Every other website keeps full SmartScreen protection.
Who should do this? A Windows administrator who manages Edge with Microsoft Intune or Group Policy. If your company uses Microsoft Defender for Endpoint, you need access to the Microsoft Defender portal instead.
Which steps do I need?
Your company uses Microsoft Defender for Endpoint: do steps ❶, ❹ and ❺. On these devices, Edge ignores the policy from steps ❷ and ❸.
You manage Edge with Intune: do steps ❶, ❷ and ❺.
You manage Edge with Group Policy: do steps ❶, ❸ and ❺.
❶ Get your Riot simulation domains
You need the phishing page domains Riot generated for you. You will have about 10 domains to add, listed in Riot under Settings > Domain > Check configuration.
Add each of these domains as its own entry in the steps below.
⚠️ Do not copy example domains from this article. Use the list from your own Riot workspace. Riot can add new domains over time, so check the list again before a large campaign.
❷ Add the domains with Microsoft Intune
Edge uses the SmartScreenAllowListDomains policy for this.
In the Intune admin center, go to Devices > Configuration > Create > New policy.
Choose Windows 10 and later as the platform and Settings catalog as the profile type.
Click Add settings, search for
SmartScreen, and select the Microsoft Edge > SmartScreen settings category.Select Configure the list of domains for which Microsoft Defender SmartScreen won't trigger warnings, set it to Enabled, and add each Riot domain from step 1. Enter the domain only, without
https://or a path.Assign the profile to the groups that will receive simulations, then click Create.
❸ Add the domains with Group Policy
Make sure the Microsoft Edge administrative templates (
MSEdge.admx) are installed.Open the Group Policy Management Editor and go to Computer Configuration > Administrative Templates > Microsoft Edge > SmartScreen settings.
Open Configure the list of domains for which Microsoft Defender SmartScreen won't trigger warnings.
Select Enabled, click Show…, and add each Riot domain on its own line.
Click OK, then Apply.
⚠️ Edge only applies this policy on managed devices: Windows computers joined to Active Directory, Windows 10 or 11 Pro or Enterprise computers enrolled in device management, or Macs managed with an MDM.
❹ Microsoft Defender for Endpoint: add URL indicators
If your company has enabled Microsoft Defender for Endpoint, Edge ignores the SmartScreenAllowListDomains policy. Add the Riot domains as allowed indicators instead.
Open the Microsoft Defender portal.
Check that Custom network indicators is turned on in Settings > Endpoints > General > Advanced features.
Go to Settings > Endpoints > Indicators (under Rules).
Select the IP addresses or URLs/Domains tab, then click Add item.
Enter a Riot domain, set the action to Allow, choose the device groups in Scope, and click Save. Repeat for each domain from step ❶.
❺ Try it out
Check the configuration on a managed computer.
Open Edge and go to
edge://policy.Click Reload policies.
Check that SmartScreenAllowListDomains is listed with the status OK and shows your Riot domains. Skip this check if you used Defender indicators in step ❹.
Open one of your Riot domains in a new tab, for example
https://followed by the first domain in your list. You should see the page load without a red warning.
Please note: the configuration can take several hours to reach every computer. Microsoft says Defender indicators usually apply in under two hours, and in rare cases up to 48 hours. If everything looks correct and you still see a warning, wait and try again.