> For the complete documentation index, see [llms.txt](https://docs.expel.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.expel.io/more-features/expel-managed-phishing/setup-guides/expel-managed-phishing-setup.md). # Expel Managed Phishing Setup This topic guides you through setting up your Expel Managed Phishing service. When you forward a suspicious email to us, you will either use an integrated button or a custom email forwarding domain. ## Before You Begin * Review the [customer questionnaire](/more-features/expel-managed-phishing/customer-questionnaire.md). ## Step 1: Update Your Allow List Establish trust by adding the inbound and outbound emails to your allow list. * **Outbound -** custom forwarding email (provided by Expel): `@expel-phishing.io`. * **Inbound -** acknowledgement and outcome response emails from Expel: `soc@expel.io`. ## Step 2: Set Up Forwarding You have two options for forwarding suspicious emails: 1. If you have Microsoft 365 or Google Workspace, you can set up a [phishing submission button](/more-features/expel-managed-phishing/setup-guides/phishing-submission-button-setup.md). 2. If you have a different email provider or the button cannot be deployed, you can forward your suspected emails to us as an EML attachment by using your [custom email forwarding destination](#user-content-fn-1)[^1]. **About the Destination Address** * The destination address should be the short version of your Expel organization name followed by `@expel-phishing.io`. * You can find the short version of your Expel organization name in the Workbench breadcrumbs. In the example below, "CEC" is the short name so `cec@expel-phishing.io` would be the custom forwarding email destination.
An image showing where to find the Expel organization name in the breadcrumbs.
{% hint style="info" %} If you see a setup dialog box while looking for your custom email forwarding destination, press the Back button to close the wizard and you will be redirected appropriately. {% endhint %} ## Step 3: Enable Fetching of Phishing Data {% hint style="warning" %} **This step is only available for Microsoft 365 and Google Workspace, and only applies to those using a custom email forwarding destination.** If you are using a different email provider or have set up the phishing button, or if you simply do not wish to enable this feature, [skip to Step 4](#step-4-send-a-test-email). {% endhint %} When a user forwards a suspicious email to an alias or shared inbox (for example, `security@acme.com`) instead of reporting it in their email client, some data necessary for proper analysis might be lost. You can configure the Expel Managed Phishing service to retrieve all the required information and ensure an accurate threat assessment. **If you do not enable this feature, email submissions without an .eml file are not processed or analysed.** Email clients generate .eml files when a suspicious message is reported directly in the client, for example, by clicking a dedicated button.
Google Workspace Instructions {% hint style="warning" %} Before you begin, provision the Expel service account and configure Google Workspace in Workbench. For more information, see [Google Workspace (Formerly G Suite) Setup for Workbench](/connect-your-technology/d-j-integrations/google/google-workspace-formerly-g-suite-setup-for-workbench.md). {% endhint %} ### Step 1: Onboard Your Google Workspace Instance 1. In your Google Cloud project, search for and select **Gmail API**. 2. Enable the Gmail API permissions for the project. 3. In the Google Workspace admin console, access the [Domain-wide delegation configuration](https://admin.google.com/ac/owl/domainwidedelegation). 4. Locate the API client created for the Expel service account and select **Edit**. 5. Add the following OAuth scope: `https://www.googleapis.com/auth/gmail.readonly` 6. Select **Authorize**. ### Step 2: Enable Gmail Logs in BigQuery Go to [Enable Gmail Logs in BigQuery](/more-features/expel-managed-phishing/setup-guides/enable-gmail-logs-in-bigquery.md) for instructions. When you have finished, return to this page and go to [Step 4: Send a Test Email](#step-4-send-a-test-email).
Microsoft 365 Instructions {% hint style="warning" %} Before you begin, configure the Message Trace API. For more information, see [Microsoft 365 Message Trace Setup](/more-features/expel-managed-phishing/setup-guides/microsoft-365-message-trace-setup.md). {% endhint %} ### Step 1: Enable the Required Permissions **Option 1: Connection Through the Expel Enterprise Application** If you connected to Workbench through the native Expel enterprise application, do the following: 1. Navigate to the **Expel Admin Consent** page. 2. Review and accept the requested permissions. **Option 2: Connection Through a Custom Microsoft Entra ID Application** If you connected to Workbench by creating a custom Microsoft Entra ID application, do the following: 1. In the Azure portal, navigate to the [App registrations page](https://portal.azure.com/#blade/Microsoft_AAD_RegisteredApps/ApplicationsListBlade). 2. Select the custom Microsoft Entra ID application and navigate to **API permissions**. 3. Select **Add a permission**. 4. Select **Microsoft Graph**, and select **Application permissions**. 5. Search for and select `mail.read`. 6. Select **Add permissions**. 7. In the Configured permissions section, select **Grant admin consent for Expel**. 8. Confirm the action by selecting **Yes**.
Your Expel Managed Phishing service will now be set up to accept and analyze forwarded emails. As we receive these emails, Workbench searches your email client for the original suspicious email. Then, we send all the relevant information and metadata from that initial email to Workbench for assessment by a member of the Expel Security Operations team. ## Step 4: Send a Test Email Send a test email submission to Expel using the button, or the custom forwarding email destination. Indicate in the email that “This is a test for the Expel Managed Phishing service.” [^1]: To view your custom email forwarding destination, go to [Organization Settings > My Organizations](https://workbench.expel.io/settings/organizations/), scroll down to the **Phishing** tab, and look for the **Destination Address**. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.expel.io/more-features/expel-managed-phishing/setup-guides/expel-managed-phishing-setup.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.