Skip to main content

Microsoft 365 Allowlisting Guide

Updated

This guide covers Microsoft 365, Exchange Online, and Microsoft Defender for O365 to support reliable delivery of NINJIO emails and phishing simulations.

Complete all four parts: (A) Configure an Exchange mail-flow rule, (B) Set up a Partner Connector, (C) Configure Defender Advanced Delivery, and (D) Test delivery.

See Advanced Configurations below for third-party email security, Safe Links, and SmartScreen settings.

Part A: Create an IP-based mail flow rule

Configure Exchange Online to recognize NINJIO sending IPs, bypass spam filtering, & prioritize Inbox placement.

  1. Open the Exchange admin center → Mail flow → Rules.
  2. Select Add a rule → Create a new rule. Name it NINJIO IP Allowlisting.
  3. Under Apply this rule if, select The sender → IP address is in any of these ranges or exactly matches.

  4. Enter the NINJIO IP addresses below. Click [Add] after each entry:

    1
    2
    3
    4
    5
    6
    7

    		 69.72.33.74
    69.72.46.85
    159.135.230.133
    159.135.235.211
    161.38.196.112
    168.245.68.235
    198.244.55.48
  5. Under Do the following, select Modify the message properties → set the spam confidence level (SCL), then choose Bypass spam filtering (-1).
  6. Select Add action (+), then Modify the message properties → set a message header.
  7. Under Set the message header, enter:
    X-MS-Exchange-Organization-BypassFocusedInbox.
  8. Set the value to true.
  9. Select Next. Under Set rule settings, confirm Rule mode is set to Enforce, then select Next.
  10. Review the configuration, select Finish, then Done.
  11. Select NINJIO IP Allowlisting from the rules list, then switch the rule to Enabled.

Part B: Configure the Exchange Online Partner Connector

Establish a trusted inbound connector for NINJIO's sending infrastructure.

  1. Open the Exchange admin center → Mail flow → Connectors and select Add a connector.
  2. Under New connector, select:
    1. Connection from: Partner organization
    2. Connection to: Office 365
  3. Click Next.
  4. Under Name, enter "NINJIO Phishing Simulation".
  5. Ensure Turn it on is selected, then click Next.
  6. For Authenticating sent email, select: By verifying that the IP address...

  7. Enter the NINJIO IP addresses below. Click [+] after each entry:

    1
    2
    3
    4
    5
    6
    7

    		 69.72.33.74
    69.72.46.85
    159.135.230.133
    159.135.235.211
    161.38.196.112
    168.245.68.235
    198.244.55.48
  8. Click Next.
  9. For Security restrictions, select: Reject email messages if they aren't sent over TLS.
    Leave "And require that the subject name..." unselected Click Next.
  10. For Review connector, click Create connector, then Click Done.
  11. Confirm that the new connector Status is On.

Part C: Configure Microsoft Defender Advanced Delivery

Register NINJIO's sending IPs, domains, and simulation URLs as authorized phishing simulations.

  1. Open Microsoft Defender → Advanced delivery.
  2. Select Phishing simulation → Add. To update an existing policy, select Edit.

  3. Under Domain, enter the NINJIO domains below. Press Enter after each entry:

    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    21
    22
    23
    24
    25
    26
    27
    28
    29
    30
    31
    32
    33
    34
    35
    36

    		 csatsafety-training.org
    cybersecurityawarenesstraining.com
    dashboard-reports.ez-sendfile.net
    device-auth-online.media-sharer.com
    device.secure-paymentlink-auth.com
    drive-signin.org
    efiles.passlink-secure.com
    encryptiaportal.net
    ez-sendfile.net
    file101.ez-sendfile.net
    g-online-suite.drive-signin.org
    index.corporate-forms.com
    media-sharer.com
    mycartcheck-out.com
    myfiles.projectworksuite.com
    mypasschange.com
    myscore.secure-scores.co
    n365-admin.securegateway-access.com
    net-link-secure.com
    officialbusinessonly.documentflow.io
    on365-admin.securegateway-access.com
    online-ops.mypasschange.com
    onlineportalsignin.drive-signin.org
    passlink-secure.com
    ph3d.secure-scores.co
    platform-ops.securegateway-access.com
    safe-dmtffyascrg53bqrp8qitl9.secure-paymentlink-auth.com
    sec.net-link-secure.com
    secure-directory.net-link-secure.com
    secure-paymentlink-auth.com
    secure-registry.mycartcheck-out.com
    secure-scores.co
    secure.encryptiaportal.net
    securegateway-access.com
    security.approvalworkspace.com
    suite.encryptiaportal.net

  4. Under Sending IP, enter the NINJIO IPs below. Press Enter after each entry:

    1
    2
    3
    4
    5
    6
    7

    		 69.72.33.74
    69.72.46.85
    159.135.230.133
    159.135.235.211
    161.38.196.112
    168.245.68.235
    198.244.55.48

  5. Under Simulation URLs to allow, enter the NINJIO URL patterns below. Press Enter after each entry:

    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    21

    		 *.approvalworkspace.com/*
    *.corporate-forms.com/*
    *.credential-update.me/*
    *.csatsafety-training.org/*
    *.cybersecurityawarenesstraining.com/*
    *.documentflow.io/*
    *.drive-signin.org/*
    *.encryptiaportal.net/*
    *.ez-sendfile.net/*
    *.media-sharer.com/*
    *.mycartcheck-out.com/*
    *.mypasschange.com/*
    *.net-link-secure.com/*
    *.passlink-secure.com/*
    *.profileactivity.com/*
    *.projectworksuite.com/*
    *.secure-paymentlink-auth.com/*
    *.secure-scores.co/*
    *.securegateway-access.com/*
    *.sheetreview.com/*
    *.technology-services.net/*
  6. Select Add or Save and verify the entries.

Part D: Check for Additional Security & Test Delivery

Verify any additional security configurations before testing NINJIO email delivery.

Important Note: If your organization uses a third-party email gateway (such as Mimecast, Proofpoint, or Barracuda):

  • Follow the applicable instructions on the NINJIO Allowlisting: Start Here page.
  • Review Third-Party Email Security under Advanced Configurations below to ensure Microsoft 365 is also configured for this additional security layer.

Test Delivery:

  1. Open the NINJIO Admin Portal → Campaign Management → Phishing.
  2. Configure and send a test phishing campaign to yourself.
  3. Confirm the email arrives in your inbox and the phishing simulation link opens successfully.

 

→ Advanced Configurations (as needed)

Use these configurations for third-party email security gateways or to address Safe Links URL rewriting and SmartScreen browser warnings. Expand the applicable section below.

Third-Party Email Security: Additional Allowlisting (Mimecast, Proofpoint, etc.)

For organizations routing email through Proofpoint, Mimecast, Barracuda, or another security gateway before Microsoft 365, first allowlist NINJIO in that system, then complete the steps below..

Microsoft Recommendation: Microsoft recommends Enhanced Filtering for Connectors to preserve original sending IPs when using third-party email gateways. Configure this alongside NINJIO's header-based identification below. When Enhanced Filtering is enabled, Microsoft recommends disabling SCL -1 spam-filter bypass rules for traffic through that connector.

  1. Open the NINJIO Admin Portal → Settings → Whitelist.
  2. Locate the X-Dcoya-Identification header and copy your organization's unique alphanumeric value.
    It looks something like this: 62f34921-g35c-4895-29da-fe1552dr20g2
  3. Open Exchange admin center → Mail flow → Rules.
  4. Select NINJIO IP Allowlisting and edit the rule conditions.
  5. Under Apply this rule if, replace the IP address condition with The message headers → matches these text patterns.

  6. Enter the following values:

    For Enter text: X-Dcoya-Identification
    For Enter words: Your organization's unique alphanumeric value you copied in a prior step.
     

  7. Select Save and confirm the rule is Enabled.
  8. Complete the test in Part D to verify successful delivery.
Microsoft Safe Links: Prevent URL Rewriting

Allows NINJIO phishing simulation URLs from being rewritten by Microsoft Defender for Office 365 Safe Links.

  1. Open Microsoft Defender → Safe Links.
  2. Select the applicable custom Safe Links policy → Edit protection settings.
  3. Under Do not rewrite the following URLs in email, select Manage URLs → Add URLs.

  4. Enter the affected NINJIO simulation URL patterns below, pressing Enter after each entry:

    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    21
    22
    23
    24
    25
    26
    27
    28
    29
    30
    31
    32
    33
    34
    35
    36
    37
    38
    39
    40
    41
    42

    		 approvalworkspace.com/*
    *.approvalworkspace.com/*
    corporate-forms.com/*
    *.corporate-forms.com/*
    credential-update.me/*
    *.credential-update.me/*
    csatsafety-training.org/*
    *.csatsafety-training.org/*
    cybersecurityawarenesstraining.com/*
    *.cybersecurityawarenesstraining.com/*
    documentflow.io/*
    *.documentflow.io/*
    drive-signin.org/*
    *.drive-signin.org/*
    encryptiaportal.net/*
    *.encryptiaportal.net/*
    ez-sendfile.net/*
    *.ez-sendfile.net/*
    media-sharer.com/*
    *.media-sharer.com/*
    mycartcheck-out.com/*
    *.mycartcheck-out.com/*
    mypasschange.com/*
    *.mypasschange.com/*
    net-link-secure.com/*
    *.net-link-secure.com/*
    passlink-secure.com/*
    *.passlink-secure.com/*
    profileactivity.com/*
    *.profileactivity.com/*
    projectworksuite.com/*
    *.projectworksuite.com/*
    secure-paymentlink-auth.com/*
    *.secure-paymentlink-auth.com/*
    secure-scores.co/*
    *.secure-scores.co/*
    securegateway-access.com/*
    *.securegateway-access.com/*
    sheetreview.com/*
    *.sheetreview.com/*
    technology-services.net/*
    *.technology-services.net/*
  5. Select Save and save the updated policy.
  6. Complete the test in Part D to verify successful delivery.
Microsoft SmartScreen: Allow Simulation Websites

Allow NINJIO simulation websites through Microsoft Defender Web Protection and Microsoft Defender for Endpoint, including SmartScreen (Edge browser protection), Network Protection (other browsers and applications), and Web Content Filtering (website category restrictions).

  1. Open Microsoft Defender → Settings → Endpoints → Indicators → URLs/Domains.

  2. Select Add item and enter the affected NINJIO simulation domain from the list below:

    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    21

    		 approvalworkspace.com
    corporate-forms.com
    credential-update.me
    csatsafety-training.org
    cybersecurityawarenesstraining.com
    documentflow.io
    drive-signin.org
    encryptiaportal.net
    ez-sendfile.net
    media-sharer.com
    mycartcheck-out.com
    mypasschange.com
    net-link-secure.com
    passlink-secure.com
    profileactivity.com
    projectworksuite.com
    secure-paymentlink-auth.com
    secure-scores.co
    securegateway-access.com
    sheetreview.com
    technology-services.net
  3. Enter Title: NINJIO Phishing Simulation, then select Next.
  4. Under Action, select Allow → Next.
  5. Under Organizational scope, select the participating device groups, then select Next.
  6. Review the settings and select Submit.
  7. Repeat for each affected domain.
  8. Complete the test in Part D to verify successful delivery.
Other Microsoft Browser & Security Systems

If your organization uses Microsoft Entra Internet Access (Global Secure Access), Microsoft Edge browser restrictions (URL Blocklists), or other Microsoft web-filtering controls, additional allowlisting may be required.

Please contact NINJIO Support for assistance.

Related articles

Comments

0 comments

Please sign in to leave a comment.