ZeroPhish Whitelisting Guide

Microsoft 365 / Office 365 Cloud

Configure Microsoft 365 Defender and Exchange Online so that authorized ZeroPhish simulation emails bypass filtering and reach your users inboxes as intended.

All whitelisting guides

Values you will need

Have these ready before you start. Contact whitelist@sabry.sa if your assigned values differ.

Simulation IP address
8.213.46.122
Custom header name
X-PHISHTEST
Custom header value
SABRY

Sender domains to whitelist

Add these alongside the IP wherever a step asks for sender addresses or domains.

*@safelinks.online*@helprservice.com*@helprservice.info

Microsoft 365 applies several protection layers. The steps below cover the modern Advanced delivery policy plus the connection filter, a transport rule, anti-phishing and Safe Attachments, so simulations are not blocked at any layer. Apply the steps relevant to your tenant.
1

Configure the Connection Filter policy

  1. Sign in to the Microsoft 365 Defender portal (security.microsoft.com).
  2. Go to Email & Collaboration → Policies & Rules → Threat policies.
  3. Under Anti-spam policies, select Connection filter policy, then click Edit policy.
  4. In the IP Allow list section, click Add and enter:
    • IP address: 8.213.46.122
    • Description: Phishing Simulation Server
  5. Click Add, then Save.
2

Create an Advanced delivery policy (recommended)

  1. In Threat policies, under the Rules section, select Advanced delivery.
  2. Open the Simulation tab, then click Add (domain, file types, and senders).
  3. Under Sender addresses and domains, add your simulation sender domains (see the list above).
  4. Under IP addresses, add 8.213.46.122.
  5. Enable Don’t apply any protection settings to the specified delivery servers.
  6. Click Save.
3

Create a transport rule for the custom header

  1. Open the Exchange admin center (admin.exchange.microsoft.com) → Mail flow → Rules → Add a new rule.
  2. Name it Phishing Simulation Header Whitelist.
  3. Condition — A message header → includes any of these words:
    • Header name: X-PHISHTEST
    • Words: SABRY
  4. Actions:
    • Modify the message properties → set the SCL → Bypass spam filtering
    • Set a message header → X-PhishingSimulation = Approved
  5. In Properties, set Priority to a low number (1–5) and Mode to Enforce.
  6. Click Save.
4

Configure the Anti-phishing policy

  1. In Threat policies, under Anti-phishing, edit the default policy or create a new one.
  2. Under Add trusted senders and domains, add your simulation domains.
  3. Under Impersonation, exclude your simulation domains from impersonation protection.
  4. Click Save.
5

Configure the Safe Attachments policy

  1. In Threat policies, under Safe Attachments, select your policy.
  2. Add an exception for messages where the header X-PHISHTEST contains SABRY.
  3. Click Save.
6

Verify Exchange Online Protection (EOP) settings

  1. In Threat policies, review your spam filter (EOP) configuration to confirm nothing will block the simulation.
  2. Where needed, add an exception based on the sender IP (8.213.46.122) or the X-PHISHTEST header.

Priority matters. Keep the transport rule above any blocking rules, keep the Advanced delivery entries current, and allow a few minutes for changes to replicate before you send a test campaign.
Need a hand with the configuration?
Our team can set up the Microsoft 365 whitelist with you on a short call.

Contact support

Back to all whitelisting guides