> For the complete documentation index, see [llms.txt](https://docs.expel.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.expel.io/more-features/expel-managed-phishing/setup-guides/phishing-submission-button-setup.md). # Phishing Submission Button Setup Expel developed buttons for Google Workspace, Gmail, and Microsoft 365 for submitting suspected phishing attempts. {% hint style="info" %} Read/write mail access is required for our analysts to quarantine and remediate on your behalf. {% endhint %} ## Prerequisites 1. You must be one of your organization’s Google Workspace/Gmail/Microsoft 365 **administrators** (for Gmail, you must be a **domain super admin**) to complete this process. 2. For Gmail and Microsoft 365, you must first download the necessary file in Workbench (Organization Settings > Your Organizations > scroll down to the Phishing tab). You will need its contents to complete the setup. * For Gmail, this file is called `GmailAddOn.zip` . * For Microsoft 365, this file is called `Manifest.zip`.
Google Workspace Button Setup {% hint style="info" %} This button is set up via a Google Workspace Add-On. {% endhint %} ### Step 1: Install the Extension 1. Log in to [Google Workspace](https://admin.google.com/) as an administrator. 2. From the Admin Console, select **Devices**.
Select the Devices option.
3. In the navigation pane of the Devices page, select **Chrome > Apps & extensions > Users & browsers**.
Image showing the side menu and where to select Users and browsers.
4. In the lower right corner of the page, select the yellow + button and then select **Add Chrome app or extension by ID**.
Image of the yellow buttons and tooltips.
5. In the box that appears, enter the extension ID: `gpkcimdiphdhnenbncknfiakplflhmnc`. 6. Select **Save**. 7. Select the arrow next to the extension and choose **Force install**.
Image showing the installation policy menu, and then force install option.
### Step 2: Configure the Extension for All Users 1. With the Expel Phishing extension selected, an option panel appears on the right. In that option panel, locate the **Policy for extensions** field.
Image showing the policy for extensions area in the panel.
2. The Policy for extensions field expects a JSON block. Our custom JSON configuration accepts three parameters: ``` destinations_forward_attachment REQUIRED (array of strings) - Where the submitted phishing emails will be forwarded to as an attachment. This is where the Expel Phishing alias provided by the EM should be entered. destinations_forward_inline (array of strings) - Where submitted phishing emails will be forwarded to inline. valid_domains REQUIRED (array of strings) - List of domains for which the button appears (for example, if gmail.com is included, users logging into personal Gmail accounts see the button). custom_success_message (string) - Customized success message to show on submission of email to Expel Phishing. move_to_trash (boolean) DEFAULT is true - Set to false and the button leaves the original message in the user’s inbox. If set to true, the button moves the original message to the trash folder upon submission. ``` Below are some example configurations and we are happy to help build this with you if needed. After you decide on the configuration, paste the JSON block into the **Policy for extension** area. **Forward to Expel only** ``` { "customConfig":{ “Value”:{ “destinations_forward_attachment”: [“alias@expel-phishing.io”], “valid_domains”: [“company.com”], “custom_success_message”: “Thank you for being vigilant! The security team is looking into this and will update you shortly.” } } } ``` **Forward to both an internal distribution list and Expel** ``` { "customConfig":{ “Value”:{ “destinations_forward_attachment”: [ “phishingreport@company.com”, “alias@expel-phishing.io” ], “valid_domains”: [“company.com”] } } } ``` **Forward to both Expel as an attachment and an internal security team as inline** ``` { "customConfig":{ “Value”:{ “destinations_forward_attachment”: [“alias@expel-phishing.io”], “destinations_forward_inline”: [“security@company.com”], “valid_domains”: [“company.com”] } } } ``` **Forward to both Expel and an internal security team and also show the button for users logging into personal Gmail accounts** ``` { "customConfig":{ “Value”:{ “destinations_forward_attachment”: [“alias@expel-phishing.io”, “security@company.com”], “valid_domains”: [“company.com”, “gmail.com”] } } } ``` 3. Select **SAVE** to complete the configuration. ### Step 3: Allowlist the Extension 1. Go back to the Admin console and select **Security**.
Select the Security option.
2. Scroll down and open **App access control**.
Image of the App Access Control area.
3. Select **MANAGE THIRD-PARTY APP ACCESS**. 4. In the Connected apps section, hover over **Expel Phishing** and select **Change access**. 5. Choose **Trusted: Can access all Google services** and then select **SAVE**.
Image of the manage whether your app can access Google services menu and the options to select.
The Expel Phishing app is now listed as Trusted in the Connected apps view. ### Step 4: Enable Domain-wide Delegation 1. Go back to the Admin console and select **Security**.
Select the Security option.
2. Scroll down and open **App access control**.
Image of the app access control area.
3. Select **MANAGE DOMAIN WIDE DELEGATION**.
Manage domain wide delegation is at the bottom of the screen.
4. Select **Add new**.
Add new is located by API clients.
5. Enter the following for the Client ID and the OAuth Scopes: * **Client ID:** `528472867238-v8803num13j6691ue52qqm6tuoqpu9ns.apps.googleusercontent.com` * **OAuth scopes:** `https://www.googleapis.com/auth/gmail.modify` 6\. Select **Authorize**.
Gmail Button Setup ### Step 1: Create a Google Workspace Add-on Project 1. Navigate to and log in as the domain super admin. 2. Select **New project**.
Image of New Project button.
3. Select Untitled project, rename the project "Report potential phishing", and then select **Rename**. 4. Select the **plus sign (+)** next to Files, and then select **Script**.
Image showing the selection of the plus sign to access Script.
5. Enter "Config" as the file name and press Enter. 6. At the bottom of the navigation bar, select the **Settings** icon.
Image of the gear icon that represents Settings.
7. Select the **Show "appscript.json" manifest file in editor** checkbox. 8. In the navigation bar, select the **Code Editor (<>)** icon. 9. Using the [`GmailAddOn.zip` file](#prerequisites), extract, copy, and paste the contents of each file into the corresponding files in the Apps Script editor. 10. After the files are copied into and saved in the Apps Script editor, select **Deploy > New deployment**.
Image showing where to find the Deploy option.
11. Select the gear icon next to Select type, and then select **Web app** and **Add-on**.
Image of the gear icon showing how to select the two required options.
12. On the Configuration pane, do the following: * In the New description field, enter "Report potential phishing". * In the Who has access field, select the **Anyone within…** option. * Select **Deploy**. 13. After the deployment is complete, copy and save the **Deployment ID** for use in a later step. {% hint style="info" %} Keep this tab open. You will return to it in a later step. {% endhint %} ### Step 2: Create a Google Workspace Cloud Project 1. In a new browser tab, navigate to . 2. Enter "Report Potential Phishing" as the project name and select **CREATE**. 3. From the menu on the left, select **APIs & Services > Enabled APIs & Services**.
Image of the navigation menu to get to Enabled APIs and Services.
4. Search for and select the **Google Workspace Marketplace SDK**. 5. Select **ENABLE**. 6. Select the **App Configuration** tab.
Image showing the location of the app configuration tab.
7. Select **The OAuth Consent Screen must be enabled for this project** hyperlink. 8. On the OAuth consent screen: * Select **Internal** as the User Type. * Select **CREATE**. 9. Complete the following fields, leaving the rest empty: * **App name** - Report potential phishing. * **User support email** - enter an email address for the security team/help desk where end users can direct general questions if they have any. * **Developer contact information** - . 10. Select **SAVE AND CONTINUE**. 11. Select **ADD OR REMOVE SCOPES**. 12. In the Update selected scopes area that opens, copy the following scopes into the **Manually add scopes** box: * `https://www.googleapis.com/auth/gmail.addons.execute` * `https://www.googleapis.com/auth/gmail.addons.current.message.readonly` * `https://www.googleapis.com/auth/gmail.send` 13. Select **ADD TO TABLE**. 14. Verify that the following scopes are added to the table and chosen, and then select **UPDATE**.
Image showing the newly added scopes.
15. The Edit app registration page appears, showing the three scopes. Scroll to the bottom of the page and select **SAVE AND CONTINUE**. ### Step 3: Connect Google Workspace Cloud and Add-on Projects 1. Navigate to . 2. Copy the **App ID**, as you will need it shortly.
Image showing where to copy the app ID.
3. Return to the **Apps Script** tab, or navigate to the **Report potential phishing project** at [https://script.google.com](https://script.google.com/). 4. Navigate to **Project Settings**, and select **Change project** at the bottom of the page.
Image showing the location of the Change Project button.
5. In the **GCP Project Number** field, paste in the App ID you copied from the App Configuration screen and then select **Set project**. 6. Go back to the [API & Services cloud console tab](https://console.cloud.google.com/apis/api/appsmarket-component.googleapis.com/googleapps_sdk) and then do the following on the App Configuration Screen: * Select the **Google Workspace Add-on** checkbox. * Select the **Deploy using Apps Script deployment id** option. * Enter the Deployment ID you copied and saved in [Step 1](#step-1-create-a-google-workspace-add-on-project). 7. In the OAuth Scopes section, select **ADD SCOPE** and then add these three scopes (you will have two default scopes already, bringing the total to five scopes): * `https://www.googleapis.com/auth/gmail.addons.execute` * `https://www.googleapis.com/auth/gmail.addons.current.message.readonly` * `https://www.googleapis.com/auth/gmail.send` 8. Select the following options: * In Installation Settings, select **Admin Only Install**. * In App Visibility, select **Private**. * Select **SAVE**. 9. Scroll to Developer Links and enter the following: * **Developer Name** - Expel * **Developer Website URL** - * **Developer Email** - 10. Select the **Store Listing** tab.
Image showing the Store Listing tab.
11. Under App Details, next to English, select the **down arrow**. 12. Fill in the following App Details fields: * **Application Name** - Report potential phishing * **Short Description** - Report potential phishing emails * **Detailed Description** - Utility to help send potential phishing emails for triage
Image of the App Details fields.
13. Select **DONE**. 14. Fill in the following remaining fields: * **Category** - Administration and Management * **Graphic Assets** (select BROWSE and upload the images from the zip file): * **Application Icon 32x32** - 32x32.png * **Application Icon 128x128** - 128x128.png * **Application Card Banner** - 128x128.png * **Screenshot** (select BROWSE and upload the image from the zip file) - 80x80.png * Support Links: * **Terms of Service URL** - * **Privacy Policy URL** - * **Support URL** - 15. **Distribution** - select All Regions or select from the Regions list. 16. Select **PUBLISH**. ### Step 4: Install the Add-on to the Domain 1. Navigate to . 2. Select the **Report phishing app** and then choose **Domain Instal**l. 3. In the Domain wide install area, select **CONTINUE**. 4. On the OAuth Consent Screen, agree to the terms of service and then select **ALLOW**. 5. In the success message window, select **DONE**. The add-on becomes available to end users shortly. It can take as long as 24 hours for the deployment to take effect.
Microsoft 365 Button Setup ### Deploy Add-in Using the 365 Admin Center 1. Log in to the [Microsoft 365 admin center](https://admin.microsoft.com/AdminPortal). 2. In the navigation menu on the left, go to **Settings > Integrated Apps**. 3. Near the top of the page, select **Add-Ins**. 4. In the tab that appears, select **Deploy Add-in**. 5. Select **Next** and then select **Upload custom apps**. 6. In the Deploy a new add-in section, do the following: * Select **I have the manifest file (.xml) on this device**. * Select **Choose File**. * Find and select the manifest file. * Select **Upload**. 7. In the Configure add-in section, do the following: * Under Assign Users, decide to which users to deploy the add-in. * Under Deployment Method, select **Fixed (Default)**. * Select **Deploy**. The deployment can take up to a few minutes. A success message displays after the process is complete, and you will see the Expel for Phishing add-in in the list of installed add-ins.
Image of the newly installed add-in.

image-9

{% hint style="info" %} Microsoft notes that it can take up to 12 hours for the add-in to propagate to all users, but if you reached this point, the installation is complete. {% endhint %}
--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.expel.io/more-features/expel-managed-phishing/setup-guides/phishing-submission-button-setup.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.