How to Prevent False Positives in Microsoft 365 Phishing Tests
Question details
Users reporting phishing simulation emails via Outlook's Report Message feature inadvertently trigger false clicks and enrollments because Microsoft's automated systems process the links.
- Product
- Microsoft 365 Exchange Online
- Device & OS
- not provided
- Scenario
- Administrators are conducting third-party phishing simulations, but the campaign data is being skewed by automated link scanning.
- Observed behavior
- When a user reports a simulation email, Microsoft's automated analysis processes the links, which the third-party provider records as a false user click, resulting in unwarranted security training enrollment.
Ensure you have Microsoft 365 Exchange Administrator or Security Administrator privileges before creating or modifying mail flow rules in your tenant.
Configure an Exchange Mail Flow Rule to Handle Simulation Messages
Create a dedicated mail flow rule in the Exchange admin center to identify approved phishing simulation messages and prevent Microsoft from triggering false positives.
By setting up a specific mail flow rule, you can intercept phishing simulation emails reported by users before Microsoft's automated threat analysis scans the links and triggers a false click event.
Log in to the Microsoft 365 admin portal with administrator credentials and navigate to the Exchange Admin Center.
Go to 'Mail flow' in the left-hand navigation pane, select 'Rules', and click the plus icon to add a new rule.
Under 'Apply this rule if', set conditions that uniquely identify your simulation emails, such as specific sender IP addresses, sender domains, or hidden campaign markers in the email headers provided by your vendor.
Under 'Do the following', configure the rule to bypass spam filtering, forward the message for approval, reject it with an explanation, or delete it without notification, depending on your organization's campaign requirements.
Save the new rule and coordinate with your phishing-simulation provider to test it with a small control group before rolling it out organization-wide.
Looking for a Secure and Lightweight Office Suite?
While managing complex Microsoft 365 server configurations, you may want a simpler, cost-effective alternative for daily document tasks. WPS Office provides a complete desktop suite that is highly compatible with Microsoft formats without the enterprise overhead.
- 1. Download the Installer: Visit the official WPS Office website and click the Free Download button for your specific operating system.
- 2. Install the Software: Run the downloaded installer file and follow the quick on-screen prompts to set up the suite on your computer.
- 3. Open Your Documents: Launch WPS Office to instantly open, edit, and save your existing .docx, .xlsx, and .pptx files with perfect formatting.
Frequently Asked Questions
Why does Outlook's Report Message button trigger phishing clicks?
When a user clicks the Report Message button, Microsoft 365's automated security systems often scan the links contained in the email to analyze the potential threat. This automated 'bot' scan is recorded by the simulation provider's server as an actual user click.
Can I simply whitelist the phishing simulation provider's IP addresses?
While adding the provider's IP addresses to your Microsoft 365 Advanced Delivery policy for Phishing Simulations is a recommended best practice, configuring a mail flow rule adds an essential layer of control for handling how reported messages are processed.
Will bypassing spam filtering for simulations expose my organization to real threats?
No, as long as the mail flow rule is tightly scoped. You should use specific, secret header markers or dedicated IP addresses provided exclusively by your simulation vendor to ensure only authorized test emails bypass the filters.
