Is there a way using the graph api to either inject an pseudo phishing test email directly into the users mailbox to bypass the built in phishing detection mechanisms and blockers and if this is not possible is there a way to access the tenant's spam, ip, or phishing detection blockers to disable and enable them programatically so that we can implement the email sending without it getting blocked?

The tenant can add your sending systems here: https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/advanced-delivery-policy-configure?view=o365-worldwide if you have the perms, you can set via ExO Powershell

Direct injecting a pseudo phishing test email directly into users mailbox

Accepted answer

Andy David - MVP 145.6K Reputation points MVP

2024-04-03T20:39:37.5666667+00:00

The tenant can add your sending systems here:

https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/advanced-delivery-policy-configure?view=o365-worldwide

if you have the perms, you can set via ExO Powershell
Please sign in to rate this answer.
Paolo Grimaldi 25 Reputation points

2024-04-03T20:49:15.25+00:00

Thank you for your quick reply, I still need to read the docs thoroughly but from what I can see you can set policies using powershell for secops mailboxes and safe simulation urls, how do this policies relate to the information being reported back in the beta endpoint https://graph.microsoft.com/beta/security/threatSubmission/emailThreats and what does the post verb on this endpoint allow us to perform with the correct permissions?

Andy David - MVP 145.6K Reputation points MVP

2024-04-03T20:56:49.27+00:00

the settings I linked are to allow the messages through the transport and anti-phishing infrastructure and not be blocked.

The endpoint you are referencing pertains to the submission of messages as phishing to Defender for mitigation or reporting, etc...

https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/submissions-admin?view=o365-worldwide

Paolo Grimaldi 25 Reputation points

2024-04-03T21:03:11.7433333+00:00

Gotcha, just to finally corroborate my understanding there is no way using the microsoft graph api to tap into the advance policy filters the only way is to set it via set via ExO Powershell. Not even thru modification of the allow block list https://learn.microsoft.com/en-us/graph/api/resources/security-tenantallowblocklistentryresult?view=graph-rest-beta
Sign in to comment

Share via

Direct injecting a pseudo phishing test email directly into users mailbox

0 additional answers