Expel Managed Phishing Setup

This topic guides you through setting up your Expel Managed Phishing service. When you forward a suspicious email to us, you will either use an integrated button or a custom email forwarding domain.

Before You Begin

• Review the customer questionnaire.

Step 1: Update Your Allow List

Establish trust by adding the inbound and outbound emails to your allow list.

• Outbound - custom forwarding email (provided by Expel): <companyidentifier>@expel-phishing.io.
• Inbound - acknowledgement and outcome response emails from Expel: [e-mail].

Step 2: Set Up Forwarding

You have two options for forwarding suspicious emails:

1. If you have Microsoft 365 or Google Workspace, you can set up a phishing submission button.
2. If you have a different email provider or the button cannot be deployed, you can forward your suspected emails to us as an EML attachment by using your custom email forwarding destination.

About the Destination Address

• The destination address should be the short version of your Expel organization name followed by @expel-phishing.io.
• You can find the short version of your Expel organization name in the Workbench breadcrumbs. In the example below, "CEC" is the short name so [e-mail] would be the custom forwarding email destination.

If you see a setup dialog box while looking for your custom email forwarding destination, press the Back button to close the wizard and you will be redirected appropriately.

Step 3: Enable Fetching of Phishing Data

This step is only available for Microsoft 365 and Google Workspace, and only applies to those using a custom email forwarding destination. If you are using a different email provider or have set up the phishing button, or if you simply do not wish to enable this feature, skip to Step 4.

When a user forwards a suspicious email to an alias or shared inbox (for example, [e-mail]) instead of reporting it in their email client, some data necessary for proper analysis might be lost. You can configure the Expel Managed Phishing service to retrieve all the required information and ensure an accurate threat assessment.

If you do not enable this feature, email submissions without an .eml file are not processed or analysed. Email clients generate .eml files when a suspicious message is reported directly in the client, for example, by clicking a dedicated button.

Google Workspace Instructions

Before you begin, provision the Expel service account and configure Google Workspace in Workbench. For more information, see Google Workspace (Formerly G Suite) Setup for Workbench.

Step 1: Onboard Your Google Workspace Instance

1. In your Google Cloud project, search for and select Gmail API.
2. Enable the Gmail API permissions for the project.
3. In the Google Workspace admin console, access the Domain-wide delegation configuration.
4. Locate the API client created for the Expel service account and select Edit.
5. Add the following OAuth scope: https://www.googleapis.com/auth/gmail.readonly
6. Select Authorize.

Step 2: Enable Gmail Logs in BigQuery

Go to Enable Gmail Logs in BigQuery for instructions. When you have finished, return to this page and go to Step 4: Send a Test Email.

Microsoft 365 Instructions

Before you begin, configure the Message Trace API. For more information, see Microsoft 365 Message Trace Setup.

Step 1: Enable the Required Permissions

Option 1: Connection Through the Expel Enterprise Application

If you connected to Workbench through the native Expel enterprise application, do the following:

1. Navigate to the Expel Admin Consent page.
2. Review and accept the requested permissions.

Option 2: Connection Through a Custom Microsoft Entra ID Application

If you connected to Workbench by creating a custom Microsoft Entra ID application, do the following:

1. In the Azure portal, navigate to the App registrations page.
2. Select the custom Microsoft Entra ID application and navigate to API permissions.
3. Select Add a permission.
4. Select Microsoft Graph, and select Application permissions.
5. Search for and select mail.read.
6. Select Add permissions.
7. In the Configured permissions section, select Grant admin consent for Expel.
8. Confirm the action by selecting Yes.

Your Expel Managed Phishing service will now be set up to accept and analyze forwarded emails. As we receive these emails, Workbench searches your email client for the original suspicious email. Then, we send all the relevant information and metadata from that initial email to Workbench for assessment by a member of the Expel Security Operations team.

Step 4: Send a Test Email

Send a test email submission to Expel using the button, or the custom forwarding email destination. Indicate in the email that “This is a test for the Expel Managed Phishing service.”