Set up O365 to Forward Phishing Emails to Radiant Security

Auto-forward O365 phishing emails to Radiant Security.

Overview

Radiant Security analyzes phishing emails reported by end users for malicious indicators. Each email is evaluated against a series of questions or actions that determine if an email is benign or malicious. 

In order to analyze these emails, Radiant Security needs access to the original email reported by end users. We do this by forwarding emails from your dedicated in-house phishing mailbox to a mailbox on our side.  

This guide will walk you through how to set up Microsoft O365 to automatically forward suspected phishing emails to Radiant Security for triage and investigation.

Prerequisites

This configuration requires that you are an administrator of the O365 account.

Configure Method for Reporting Phishing Emails

There are two configuration requirements that are necessary to complete in order to enable the Report Phishing button so that an end user can submit a suspected phishing email: 

• Create a dedicated phishing mailbox
• Enable auto-forwarding to Radiant Security
• Enable the Report Phishing Button
• Allow forwarding to an external email

Create a dedicated phishing mailbox

In this step, you will create a dedicated phishing mailbox for your organization.

1. Log in to the Admin Exchange Center portal.
2. From the menu, navigate to Recipients > Mailboxes.
   
3. Click Add a shared mailbox.
   
4. Fill in the details for the mailbox:
   1. Display Name: Phishing Mailbox
   2. Email address: Phishing
   3. Select Domain: <select your domain>
      
5. Click Create to save the new mailbox.

Enable auto-forwarding to Radiant Security

Next, enable auto-forwarding O365 to automatically forward emails from your new dedicated phishing mailbox to Radiant Security. You can choose to do this in O365 client or in the Outlook application. Complete the following series of steps to enable auto-forwarding.

Add Radiant Security as a Trusted Domain

In this step, you will enable forwarding emails from your domain to our external domain.

1. From the Exchange Admin Center menu, navigate to Mail flow > Remote domains.

2. Click + Add Remote Domain.

3. Fill in the details for the external domain

   1. Name: Radiant Security
   2. Domain: report.radiantsecurity.ai

4. Click Next.

5. On the Email reply types page, confirm that Allow automatic forwarding is enabled.

   
6. Click Next to keep all default settings unchanged.
7. Click Save to add the external domain.

Add “Radiant Security Alerts” as a contact

In this step, you’ll add Radiant Security as a contact so that we receive the forwarded phishing emails to a mailbox on our side.

1. From the Exchange Admin Center menu, navigate to Recipients > Contacts.
2. Click + Add a contact.
3. Fill in the following contact details:
   • Contact type: Mail Contact
   • Display Name: Radiant Security Alerts
   • Email address: alerts@report.radiantsecurity.ai
4. Click Add to save the new contact.

Set up Auto-Forwarding

In this step, you’ll configure O365 to automatically forward all suspected phishing emails to the new Radiant Security Alerts contact created in the previous step.

1. From the Exchange Admin Center menu, navigate to Recipients > Mailboxes.
2. Click the row to open the Phishing Mailbox created in the very first step.
3. In the pop-out menu, click the Manage mail flow settings link.
   
4. Next to Email Forwarding, click Edit.
   
5. Click the toggle to enable Forward all emails sent to this mailbox.
6. Set the forward address as the contact from the previous step: Radiant Security Alerts.
7. Click Save.
8. Return to the Manage mail flow settings page, then click Edit to change the Message Size Restrictions to the following values:
   1. Sent messages maximum size (KB): 153600
   2. Received messages maximum size (KB): 153600
      
      
9. Click Save.

Enable the Report Phishing button

In this step, you’ll enable the O365 right-click action which allows a user to report suspected phishing emails to the dedicated phishing mailbox you created in the previous step. 

1. Log in to Microsoft 365 Defender.
2. From the menu, navigate to Policies & Rules > Threat policies > User reported message settings.
3. Enable the toggle for Microsoft Outlook Report Message button.
4. Select Microsoft and my organization's mailbox.
   
5. From the drop-down, select the phishing@<your domain>.com mailbox that you created previously.
6. Leave all default settings unchanged.
7. Click Save.

Allow forwarding to an external email

1. From the Microsoft 365 Defender menu, navigate to Policies & rules > Threat policies > Anti-spam policies.
2. Click + Create Policy and select Outbound.
   
3. Fill in the details for Name your policy:
   1. Name: Forwarding alerts to Radiant Security
4. Under Users, groups, and domains, enter the following:
   1. Users: Phishing Mailbox
      

5. Under Protection settings, set the following rule:

   1. Automatic forwarding Rules: On - Forwarding is enabled
      

6. Click Create to save the forward rule.

Report a test email

In this step, you’ll report an email in order to make sure the integration is working and also that there is organizational knowledge on how to report phishing emails end-to-end.

 

We value your opinion. Did you find this article helpful? Share your thoughts by clicking here or reach to our Product and Customer Success teams at support@radiantsecurity.ai 

 

Last updated: 2024-08-23