Commands › Exchange Online

Set-ExoPhishSimOverrideRule

Exchange Online ExchangeOnlineManagement Set-*

Modify non-Microsoft phishing simulation override rules that bypass filtering. For more information, see Configure the advanced delivery policy for non-Microsoft phishing simulations and email delivery to SecOps mailboxes.

Quick start script

# Set-ExoPhishSimOverrideRule — quick start (serv365.ai)
# 1. Connect (app-only shown; interactive: omit the certificate parameters)
Connect-ExchangeOnline -CertificateThumbprint $thumb -AppId $appId -Organization $org

# 2. Capture the current state first — you cannot roll back what you never recorded
$before = Get-ExoPhishSimOverrideRule
$before | Format-List

# 3. Make the change (dry run first)
Set-ExoPhishSimOverrideRule -Identity <ComplianceRuleIdParameter> -WhatIf
Set-ExoPhishSimOverrideRule -Identity <ComplianceRuleIdParameter>

# 4. Verify and diff
$after = Get-ExoPhishSimOverrideRule
Compare-Object ($before | Out-String) ($after | Out-String)

Syntax

Set-ExoPhishSimOverrideRule [-Identity] <ComplianceRuleIdParameter>
 [-AddDomains <MultiValuedProperty>]
 [-AddSenderIpRanges <MultiValuedProperty>]
 [-Comment <String>]
 [-Confirm]
 [-DomainController <Fqdn>]
 [-RemoveDomains <MultiValuedProperty>]
 [-RemoveSenderIpRanges <MultiValuedProperty>]
 [-WhatIf]
 [<CommonParameters>]

Parameters (9)

Parameter	Type	Required	What it controls
-Identity	ComplianceRuleIdParameter	yes	The Identity parameter specifies the phishing simulation override rule that you want to modify. You can use any value that uniquely identifies the rule. For example:
-AddDomains	MultiValuedProperty		The AddDomains parameter specifies an existing entry to add to the list of email domains that are used by the non-Microsoft phishing simulation.
-AddSenderIpRanges	MultiValuedProperty		The AddSenderIpRanges parameter specifies an existing entry to add to the list of source IP addresses that are used by the non-Microsoft phishing simulation. Valid values are:
-Comment	String		The Comment parameter specifies an optional comment. If you specify a value that contains spaces, enclose the value in quotation marks ("), for example: "This is an admin note".
-Confirm	SwitchParameter		The Confirm switch specifies whether to show or hide the confirmation prompt. How this switch affects the cmdlet depends on whether the cmdlet requires confirmation before proceeding.
-DomainController	Fqdn		This parameter is reserved for internal Microsoft use.
-RemoveDomains	MultiValuedProperty		The RemoveDomains parameter specifies an existing entry to remove from the list of email domains that are used by the non-Microsoft phishing simulation.
-RemoveSenderIpRanges	MultiValuedProperty		The RemoveSenderIpRanges parameter specifies an existing entry to remove from the list of source IP addresses that are used by the non-Microsoft phishing simulation. Valid values are:
-WhatIf	SwitchParameter		The WhatIf switch shows what the command does without making any changes. You don't need to specify a value with this switch.

Reference facts derived from Microsoft documentation, © Microsoft, licensed CC BY 4.0; restructured with original guidance by serv365.ai.