Configures Microsoft 365 to allow CyberHoot phishing simulation emails to bypass security filters while maintaining protection for real threats. It handles two critical configurations:
CyberHoot-M365.ps1 to a working directorycd C:\path\to\scriptCyberHoot-M365.ps1 to a working directorycd /path/to/scriptchmod +x CyberHoot-M365.ps1PowerShell Script to Bypass Link Protection in M365
Save this text file as a .ps1 file and then run as a PowerShell script with appropriate permissions.
Check what’s currently configured and what will be added:
./CyberHoot-M365.ps1 -Mode Validate
```
**What it does:**
- Shows which CyberHoot entries are missing
- Reports on existing configuration
- **Makes no changes** to your environment
- Creates JSON snapshots in current directory
**Sample Output:**
```
Validation report:
Advanced Delivery:
Rule exists: False
Missing domains: 10
Missing IP ranges: 9
Missing simulation URLs: 10
Safe Links:
Policy exists: False
Rule exists: False
Missing DoNotRewriteUrls: 10Deploy the CyberHoot configuration:
./CyberHoot-M365.ps1 -Mode Apply
```
**What it does:**
- Creates/updates Advanced Delivery phishing simulation rules
- Creates/updates Safe Links exclusions
- **Preserves existing vendor entries** (KnowBe4, Proofpoint, etc.)
- Creates before/after JSON snapshots
- Shows summary of what was added
**Sample Output:**
```
Apply completed.
Summary:
Mode: Apply
Domains added: 10
IPs added: 9
Simulation URLs added: 10
DoNotRewriteUrls added: 10
Re-run validation to confirm everything applied:
./CyberHoot-M365.ps1 -Mode ValidateShould show all missing counts at 0.
Get detailed output during execution:
./CyberHoot-M365.ps1 -Mode Apply -VerboseSave snapshots to a specific folder:
./CyberHoot-M365.ps1 -Mode Apply -OutputDir "C:\M365-Snapshots"Remove only CyberHoot entries (preserves other vendors):
./CyberHoot-M365.ps1 -Mode RollbackWarning: This removes CyberHoot’s configuration. Only use if you’re discontinuing CyberHoot or troubleshooting.
The script creates timestamped JSON files:
cyberhoot-m365-Apply-before-YYYYMMDD-HHMMSS.json – State before changescyberhoot-m365-Apply-after-YYYYMMDD-HHMMSS.json – State after changesUse these for:
Cause: Insufficient permissions or tenant licensing
Solution: Ensure you have Exchange Online administrator role and Advanced Delivery is available in your tenant
Cause: Connectivity or permission issues
Solution: Verify you can access Exchange Online admin center manually
Expected behavior: Script is idempotent – safe to run multiple times without duplicating entries
Cause: Configuration propagation delay
Solution: Wait 15-30 minutes, then send a test simulation email
For issues with the script, review:
./CyberHoot-M365.ps1 -Mode Validate -VerboseDiscover and share the latest cybersecurity trends, tips and best practices – alongside new threats to watch out for.
Remember Heartbleed? That security nightmare from a few years back that made everyone panic about their...
Read more
Remember 2020? We scanned QR codes for everything. Restaurant menus. Parking meters. That awkward moment at a...
Read more
Phishing emails used to be easy to spot. Bad grammar. Weird links. Obvious scams. Those days are...
Read moreGet sharper eyes on human risks, with the positive approach that beats traditional phish testing.
