Direct Delivery

Overview

Direct Delivery allows you to send messages directly to a Microsoft or Google user's inbox using the Microsoft Graph or Google API, bypassing traditional mail servers. This approach minimizes delivery issues often encountered during simulated phishing tests.

To ensure successful delivery, the recipient email addresses must exist and have active mailboxes within the Azure or Google Workspace tenant where Direct Delivery is enabled. Messages cannot be delivered to alias addresses. When Direct Delivery is enabled for a PhishingBox Group, campaigns will automatically send simulated phishing and training emails to the group's targets using this method.

Direct Delivery settings can be configured at either the Account level (Mail Settings) or the Group level (Create/Edit Group). Use the links below to navigate to the relevant section:

• Mail Settings
• Create / Edit Group 

Mail Settings 

When a PhishingBox account has Direct Delivery enabled, you’ll have the option to activate it in the Campaign Wizard on the Review Tab. This allows you to send simulated phishing and training emails to the account's targets using Direct Delivery.

Microsoft

Follow the steps below to enable Direct Delivery for a Microsoft 365 tenant:

1. Navigate to Administration > Settings > Mail Settings > Direct Delivery tab
2. Click the "Enable Direct Delivery For Microsoft Entra ID" button.
   
3. Click "Accept" to grant the following requested permissions:
   • Read all users' full profiles
   • Read mail in all mailboxes
   • Read and write mail in all mailboxes
   • Sign in and read user profile
     

     NOTE: These permissions grant access to read, modify or delete emails. Direct Delivery will never interface with inboxes to read, modify or delete emails. These permissions are only used to deliver mail to inboxes. 

To disable Direct Delivery, click the "Disable Direct Delivery for Microsoft Entra ID" button.

Google

Follow the steps below to enable Direct Delivery for a Google Workspace tenant:

1. Log in as a global administrator on your Google Workspace account.
2. Navigate to Security > Access and data control > API controls.
3. Click on "MANAGE DOMAIN WIDE DELEGATION" at the bottom of the page.
4. Click "Add new".
5. Use 101149194897466439972 as the client ID.  
6. Enter https://www.googleapis.com/auth/gmail.insert for the OAuth scope.  
7. Click "Authorize" on the new domain-wide delegation policy.
8. Got to the PhishingBox Portal.
9. Navigate to Administration > Settings > Mail Settings > Direct Delivery tab
10. Click the "Enable Direct Delivery For Google Workspace" button.
    
11. Authorize the Direct Delivery by entering the email of a global domain admin.
12. Click "Save".

To disable Direct Delivery, click the "Disable Direct Delivery for Google Workspace" button.

Create / Edit Group 

When a PhishingBox group has Direct Delivery enabled, campaigns will automatically use Direct Delivery to send simulated phishing and training emails to the group’s targets, regardless of the toggle option on the final screen of campaign creation.

NOTE: It's possible to enable Direct Delivery for the entire account instead of a specific group. See the Direct Delivery Section of our Mail Settings article. 

Microsoft

To enable Microsoft 365 Direct Delivery for a group, follow these steps:

1. Targets / Groups > Edit Group > Direct Delivery Tab
2. Click the "Enable Direct Delivery For Microsoft Entra ID" button.
3. Click "Accept" to grant the following requested permissions:
   • Read all users' full profiles
   • Read mail in all mailboxes
   • Read and write mail in all mailboxes
   • Sign in and read user profile

NOTE: These permissions grant access to read, modify or delete emails. Direct Delivery will never interface with inboxes to read, modify or delete emails. These permissions are only used to deliver mail to inboxes. 

To disable Direct Delivery, click the "Disable Direct Delivery for Microsoft Entra ID" button.

Google

To enable Google Workspace Direct Delivery for a group, follow these steps:

1. Log in as a global administrator on your Google Workspace account.
2. Navigate to Security > Access and data control > API controls.
3. Click on "MANAGE DOMAIN WIDE DELEGATION" at the bottom of the page.
4. Click "Add new".
5. Use 101149194897466439972 as the client ID.  
6. Enter https://www.googleapis.com/auth/gmail.insert for the OAuth scope.  
7. Click "Authorize" on the new domain-wide delegation policy.
8. Got to the PhishingBox Portal.
9. Navigate to Administration > Settings > Mail Settings > Direct Delivery tab
10. Click the "Enable Direct Delivery For Google Workspace" button.
    
11. Authorize the Direct Delivery by entering the email of a global domain admin.
12. Click "Save".

To disable Direct Delivery, click the "Disable Direct Delivery for Google Workspace" button.

Back to top