KillPhish is an advanced email threat protection add-in for Microsoft 365 (Office 365). It works on the Outlook Web App (OWA), Outlook for desktop on both Windows and Mac, Outlook for iOS, and Outlook for Android. KillPhish can give an email a risk assessment (low, medium, or high risk). It enables reporting phishing and other types of threats. Each inbox's risk profile is unique, and KillPhish can help expose telltale signs of threats to your security.
Deployment
To deploy KillPhish to your organization, follow the steps below.
-
Sign in to Microsoft 365 with your work or school account.
-
Select the app launcher icon in the upper-left and choose Admin.
-
In the navigation menu, press Show all, then choose Settings > Integrated apps.
-
Choose Upload custom apps at the top of the page, beside Get apps.
- Choose Upload manifest file (.xml) from device and locate the manifest file. The manifest file can be downloaded from the Microsoft Add-In (KillPhish) tab on the Reporting Settings page in Portal.
-
Choose Next after Microsoft has had time to validate the manifest.
-
On the Edit who has access page, choose Everyone, Specific Users/Groups, or Only me. Use the search box to find the users and groups to whom you want to deploy the add-in.
-
When finished, choose Next. Then, click Accept permissions button. You must consent to the permissions required by KillPhish. The add-in requires permission to sign in and read user profile and read and write user mail (delegated permissions) and sign in as any user to read and write mail (application permissions). The latest build of KillPhish (released April 5, 2022) uses Microsoft Graph API to get message contents, send reported emails from the users' inboxes, and delete emails. These API calls require Mail.ReadWrite, Mail.Send, and User.Read permission at both the delegated and application level.
-
Click Next to begin deployment of the add-in. This process may take up to three minutes. Then, finish the walkthrough by pressing Next. You now see your add-in along with other apps in Microsoft 365.
Note: Outlook add-ins can take up to 24 hours to appear on users' ribbons. -
The add-in will work on Outlook Web App (OWA) and the Outlook desktop app at this point. If you would like it to work on Outlook for iOS and Android, you'll need to enter tenant id of the Microsoft account that the add-in was deployed to. The tenant id can be found by logging into Azure and clicking on Azure Active Directory, or going to this link: https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Overview.
NOTE: Changes to the Branding Name or Branding Icon will require a redeployment of the manifest file.
Troubleshooting
Allow up to 72 hours for the plugin to become fully functional and ready for use by your users.
If you run into the following error with the KillPhish plugin,
then the plugin may be getting blocked by a firewall or security software.
The KillPhish add-in is supported on the most recent build/version of Outlook. While KillPhish may function on older versions, continued functionality is not guaranteed. It is recommended that updates be made to the most recent build/version for all devices.
NOTE: Outlook add-ins can take up to 12 hours to appear on users' ribbons
KillPhish and Shared Mailboxes
KillPhish will not work on shared mailboxes.
Comments
0 comments
Please sign in to leave a comment.