7 Minute Security's phishing exercises are typically designed to test the end-users rather than the technical controls protecting email inboxes.  So during the process, we may ask you to allowlist our phishing domain within M365 so that the emails come through without being gobbled by spam filters.  To do this:

1. Navigate to [https://admin.exchange.microsoft.com](https://admin.exchange.microsoft.com/) and login with an M365 admin account.

2. In the navigation tree on the left side, head to **Mail flow > Rules**

![](/static/phishallowlist-01.png)

3. Click **Add a rule > Create New Rule**:

![](/static/phishallowlist-02.png)

4. Give the rule an appropriate name, and then under *Apply this rule if*, choose **The sender**.  Then set the condition for *The sender* to be **domain is**, and type in the phishing domain name 7 Minute Security will give you.  Below is an example where the phishing domain name is **domain.com**:

![](/static/phishallowlist-03.png)

5. Next, under Do the following, click the drop down menu and choose **Modify the message properties**, then set the action to **set a message header**.  Set the message header to *X-MS-Exchange-Organization-BypassClutter* and the value to *true*:

![](/static/phishallowlist-04.png)

6. Click the + next to set a *message header* so that a new condition is created:

![](/static/phishallowlist-05.png)

7.  Under *And*, click the drop-down and choose **Modify the message properties** again.  Then in the next drop-down, choose **set the spam confidence level (SCL)** and set it to **Bypass spam filtering**.  Note that even when you choose **Bypass spam filtering** it is reflected as a value of *'-1'* when settings are saved (this is totally fine):

![](/static/phishallowlist-06.png)

8. Click **Next** near the lower left of this open window.

![](/static/phishallowlist-07.png)

9. At the next screen, leave all values at their defaults, but make sure you also click **Activate this rule on** (so that the rule gets enabled) and then click **Next**:

![](/static/phishallowlist-08.png)