To ensure seamless delivery of Right-Hand’s cybersecurity training and phishing simulation emails, we now provide a fully automated PowerShell script that configures your Microsoft 365 environment.
Once downloaded and executed, the script ensures our emails bypass spam filtering, clutter filtering, Safe Links, and Safe Attachments processing, helping prevent delivery issues and reducing setup time, while preserving existing policies to avoid conflicts.
Requirements
Operating System: Windows (Professional or Server editions)
Tool: PowerShell (must be run as Administrator)
Credentials: A valid Office 365 account
Authorization: Access to Exchange Online
Roles that would be required to execute operations:
Global Administrator
Compliance Management
Security Administrator
Note: The Office 365 user executing this script should be a “Global Administrator” or one of the above-listed roles.
Mandatory step:
You can ask for the custom header, which is associated to your company tenant in cyberready from your customer success manager. Alternatively you can mail to [email protected] to get the same. The header has the following format:
X-RHS-TID-<unique hash>
Add the custom header value to the RightHand-Whitelist-Config.txt
Microsoft Exchange and Microsoft Defender Whitelisting
Microsoft Exchange and Microsoft Defender Whitelisting
How to Use the PowerShell Script
Step 1: Unblock the ZIP file
Unblock the ZIP before you extract it. Otherwise, Windows may block the script from running.
Right-click Right-Hand-Whitelisting.zip and select Properties.
On the General tab, check Unblock next to the security message at the bottom.
Click Apply, then OK.
If you don't see the Unblock checkbox, the file is already unblocked..
Step 2: Extract the script
Right-click Right-Hand-Whitelisting.zip and select Extract All…
Choose a folder you can easily find, such as
C:\Users\<YourName>\Downloads\Right-Hand-Whitelisting, and click Extract.Confirm the folder contains these two files:
IP_Whitelisting.ps1
RightHand-Whitelist-Config.txt
Step 3: Add your custom header to the configuration file
Open RightHand-Whitelist-Config.txt in Notepad.
In the [CustomHeader] section, paste only the hash, the part after
X-RHS-TID-, into HeaderValue:[CustomHeader]
HeaderName=X-RHS-TID
HeaderValue=<your unique hash>Don't change any other sections.
Press Ctrl + S to save, then close Notepad.
Note: Don't include X-RHS-TID- in the HeaderValue field, and don't add spaces or quotes.
Step 4: Open PowerShell as Administrator
Click Start and type PowerShell.
Right-click Windows PowerShell and select Run as administrator, then click Yes.
Go to the folder where you extracted the files. Keep the quotation marks, which are required if the path contains spaces:
cd "C:\Users\<YourName>\Downloads\Right-Hand-Whitelisting"
Step 5: Prepare the PowerShell session
Run each command below separately. They apply only to the current PowerShell window and don't change your system settings.
Unblock all files in the folder:
Get-ChildItem | Unblock-File
2. Allow the script to run in this session:
powershell
Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass -Force
3. Enable TLS 1.2, which is required to download the Exchange Online module:
powershell
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
If a command runs successfully, PowerShell returns to the prompt without any message.
Step 6: Run the script
.\IP_Whitelisting.ps1
The script checks for the ExchangeOnlineManagement module and installs it if needed. If you're asked to install the NuGet provider or trust the PSGallery repository, type Y and press Enter.
In the PowerShell window (with Administrator rights), run the script.
.\IP_Whitelisting.ps1
Step 7: Sign in
A Microsoft sign-in window appears. It may open behind the PowerShell window; press Alt + Tab to find it.
Sign in with your Microsoft 365 admin account.
If your account uses multi-factor authentication (MFA), complete the verification, for example with a code from the Microsoft Authenticator app, an app notification, or a text message.
After you sign in, it can take 1–2 minutes before [OK] Connected to Exchange Online. appears.
Step 8: Select domains for Safe Links
After the mail flow rules are configured, the script lists your accepted domains and asks you to choose which ones the Safe Links policy should cover.
Enter the numbers of the domains your users receive email on, for example:
1(single domain)1,3(multiple domains)1-3(range)
Press Enter.
Users in the selected domains are assigned the "RightHand - Bypass Safe Links" policy. Leave the selection blank and press Enter to skip this step.
Step 9: Review the summary
The script usually completes within 3 to 4 minutes. When it finishes, you'll see [OK] Configuration completed successfully. followed by a Configuration Summary:
Safe Links policy and rule
Anti-spam connection filter
Spoofed sender settings
Advanced Delivery: policy, rule, and URL allow list
The script then disconnects from Exchange Online automatically.
Authentication
When you run the script, you’ll be prompted to sign in with your Office 365 credentials.
If your account uses Multi-Factor Authentication (MFA), you’ll also need to complete an extra verification step, such as:
Entering a 6-digit code from the Microsoft Authenticator app
Approving a text message or mobile notification sent to your registered device.
Script Execution Time
The script usually completes within 3 to 4 minutes, depending on the number of domains being processed.
When the script runs successfully, you'll see confirmation messages displayed in the PowerShell window.
Conclusion
This PowerShell script streamlines whitelisting Right-Hand IPs and domains in Microsoft Exchange and Defender.
✅ Use the correct Office 365 credentials when prompted.
✅ Verify the updated allow policy in the Microsoft Exchange admin center or Microsoft 365 Security Center after running the script.