GoPhish Phishing simulation and Suspected Microsoft 365 URL Detonation

A correctly matched Advanced Delivery phishing simulation is not detonated by Safe Links, so verify that each GoPhish message received the Phishing simulation system override and then correlate Defender click telemetry with GoPhish web logs to identify the actual requester.^1^

1. Verify that Advanced Delivery matched the message

Since Safe Links and Safe Attachments exceptions are already configured, do not add further broad allowlists. Instead:

1. In Microsoft Defender, open Email & collaboration → Explorer.
2. Find one affected test message.
3. Open its email entity details.
4. Under Override(s), check for:
   • Tenant override: Phishing simulation, or
   • System override source: Phishing simulation.
5. Repeat this for a message whose URL GoPhish recorded as accessed automatically.

When that override is present, Microsoft documents that Safe Links:

• Does not block or detonate the simulation URL at click time.
• May still wrap the URL.
• Automatically allows email phishing-simulation URLs during mail flow and at click time.

Therefore, a rewritten safelinks.protection.outlook.com URL alone does not show that Microsoft detonated the GoPhish link.^1^

Do not add these email URLs to Do not rewrite the following URLs in email as another workaround. Microsoft states that doing so can produce unwanted click alerts; correctly identified email simulations are already allowed.

2. If the override is missing, correct the match criteria

Advanced Delivery must match at least:

• One Domain: the SMTP envelope sender (5321.MailFrom) domain or the applicable DKIM domain.
• One Sending IP.

The message must also traverse the Microsoft 365 transport pipeline; Advanced Delivery does not apply to direct-injection messages.^1^

Compare the configured values with the affected message’s headers—not only with the visible From address:

• Return-Path or 5321.MailFrom
• DKIM signing domain
• Authentication-Results
• Connecting IP observed by Microsoft 365

If mail passes through a non-Microsoft gateway before Microsoft 365, the IP in Authentication-Results must match the Advanced Delivery sending IP. If the gateway hides the original GoPhish IP, configure Enhanced Filtering for Connectors on the inbound connector so Microsoft 365 can detect the real source IP.^2^

Portal path:

1. Microsoft Defender → Email & collaboration → Policies & rules → Threat policies → Enhanced filtering.
2. Select the inbound connector.
3. Choose Automatically detect and skip the last IP address, or explicitly enter only the gateway IPs that should be skipped.
4. Send a new test and confirm that the email entity now shows Phishing simulation.

Do not add the gateway’s IP as the simulation sender merely to force a match; Microsoft warns that this can bypass filtering for unrelated senders impersonating the configured simulation domain.^1^

Advanced Delivery also does not support simulations authenticated as internal (DIR:INT), particularly when routed through an Exchange Server gateway. If that applies, route the test directly to the Microsoft 365 MX endpoint or use a dedicated receive connector that does not authenticate the simulation as internal.

3. Attribute the accesses instead of assuming Microsoft detonation

In Defender for Office 365 Plan 2:

1. Open Email & collaboration → Explorer → URL clicks.
2. Filter by the campaign URL, recipient, and delivery time.
3. Compare click time, user, application, and action with the GoPhish event.

Threat Explorer’s URL-click view represents user-click telemetry from email and supported Microsoft 365 applications.^3^

For deeper correlation, run this in Microsoft Defender XDR → Hunting → Advanced hunting:

UrlClickEvents
| where Timestamp > ago(7d)
| where Url contains "your-simulation-domain.example"
| project Timestamp, AccountUpn, IPAddress, AppName,
          AppVersion, ActionType, NetworkMessageId,
          SourceId, ReportId, Url
| order by Timestamp asc

UrlClickEvents supplies the account, source IP, client application, message ID, and redirect chain associated with Safe Links click records.^4^

Interpret the result as follows:

• Matching Defender and GoPhish timestamps/IPs: investigate the named client, link preview, or user/device activity.
• GoPhish request with no corresponding Defender click: investigate another mail gateway, endpoint security product, proxy, sandbox, or crawler.
• Requests occur before the Phishing simulation override appears: the message likely did not match Advanced Delivery; return to the envelope-domain and source-IP checks.
• A third-party security layer is present: review its URL inspection or prefetch logs. A similar GoPhish case involving Microsoft 365 also had Trend Micro Cloud App Security in the path, and its attempted Microsoft bypass rule did not stop the accesses.^5^

Use GoPhish server logs to compare the request’s timestamp, source IP, user agent, HTTP method, redirect behavior, and requested path. Avoid blocking broad Microsoft or cloud IP ranges: shared cloud addresses do not establish which service generated a request and may carry legitimate traffic.

If the message consistently shows the Phishing simulation override, no third-party scanner accounts for the request, and the request can be correlated to Microsoft infrastructure, preserve the message ID, headers, UTC timestamps, URL, and GoPhish access-log entries and open a Microsoft 365 support request.

References

1. Configure the advanced delivery policy for non-Microsoft phishing ...
2. Enhanced Filtering for Connectors in Exchange Online
3. About Threat Explorer and Real-time detections in Microsoft Defender for Office 365
4. UrlClickEvents
5. GoPhish links clicked almost immediately upon receival (by Microsoft ...